diff options
| author | Yves-Alexis Perez <corsac@debian.org> | 2013-02-07 13:27:27 +0100 |
|---|---|---|
| committer | Yves-Alexis Perez <corsac@debian.org> | 2013-02-07 13:27:27 +0100 |
| commit | b4f62acfae5e58d8bbdb5a2f3a4d22dc7a47f8af (patch) | |
| tree | 6a9ea7adf70239d85185a20f7d5878cfe95f8070 /testing | |
| parent | 6307450b402e3c4a901fb8c0e54d8ad583ce2118 (diff) | |
| parent | 7585facf05d927eb6df3929ce09ed5e60d905437 (diff) | |
| download | vyos-strongswan-b4f62acfae5e58d8bbdb5a2f3a4d22dc7a47f8af.tar.gz vyos-strongswan-b4f62acfae5e58d8bbdb5a2f3a4d22dc7a47f8af.zip | |
Merge tag 'upstream/5.0.2'
Upstream version 5.0.2
Diffstat (limited to 'testing')
1422 files changed, 18757 insertions, 40922 deletions
diff --git a/testing/INSTALL b/testing/INSTALL deleted file mode 100644 index bb4272eaf..000000000 --- a/testing/INSTALL +++ /dev/null @@ -1,145 +0,0 @@ - - ------------------------------- - strongSwan UML - Installation - ------------------------------- - - -Contents --------- - - 1. Making the host system UML-capable - 2. Installing the required files - 3. Creating the UML testing environment - - -1. Making the host system UML-capable - ---------------------------------- - - UML instances can be run on both Linux 2.4 and Linux 2.6 kernels. - If you are using a vanilla kernel from kernel.org then you must first - apply the host SKAS patch available from - - http://www.user-mode-linux.org/~blaisorblade/patches/ - - and recompile and reboot your host kernel. Some Linux distributions as e.g. - SuSE already include the SKAS patch in their kernels. - - You will also need the UML utilities (uml_mconsole and uml_switch) - available from - - http://prdownloads.sourceforge.net/user-mode-linux/uml_utilities_20040406.tar.bz2 - - Many Linux distributions offer the UML utilities as a package. - - -2. Installing the required files - ----------------------------- - -First create a directory where you want the strongSwan UML testing environment -to be located.The default directory is "~/strongswan-testing". If you choose a -different location, please adapt the UMLTESTDIR variable in "testing.conf" -accordingly. - - mkdir ~/strongswan-testing - -Now copy the "testing" subdirectory coming with the strongSwan distribution to -the UML testing environment: - - cp -r testing ~/strongswan-testing - -Next you need to copy several files into the ~/strongswan-testing directory that -are required for the strongSwan testing environment: - - * A vanilla Linux kernel on which the UML kernel will be based on. - We recommend the use of - - http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.36.tar.bz2 - - * The Linux kernel 2.6.36 does not require any patches for the uml guest kernel - to successfully start up. - - * The matching .config file required to compile the UML kernel: - - http://download.strongswan.org/uml/.config-2.6.36 - - * A gentoo-based UML file system (compressed size 130 MBytes) found at - - http://download.strongswan.org/uml/gentoo-fs-20100830.tar.bz2 - - * The latest strongSwan distribution - - http://download.strongswan.org/strongswan-4.5.1.tar.bz2 - - -3. Creating the environment - ------------------------ - -Now change into the testing subdirectory - - cd ~/strongswan-testing/testing - -and make the UML testing environment: - - ./make-testing <hosts> - -The "make-testing" script calls a series of subscripts which can be -enabled or disabled individually by setting the corresponding flags -in "testing.conf": - - if [ $ENABLE_BUILD_UMLKERNEL = "yes" ] - then - scripts/build-umlkernel - fi - -builds an UML kernel out of the vanilla Linux kernel and the corresponding -UML kernel patch. - - if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ] - then - scripts/build-hostconfig - fi - -generates the default configurations for the UML hosts alice, venus, moon, -carol, winnetou, dave, sun, and bob by replacing the wildcards PH_IP_ALICE, -etc. by the actual IP addresses defined in "testing.conf". - - if [ $ENABLE_BUILD_UMLROOTFS = "yes" ] - then - scripts/build-umlrootfs - fi - -takes the gentoo-based UML file system and compiles the latest strongSwan -distribution into it. - - if [ $ENABLE_BUILD_SSHKEYS = "yes" ] - then - scripts/build-sshkeys - fi - -adds the common RSA public key of the UML instances to your ~/.ssh/known_hosts -directory so that you can log onto the UML instances using ssh without typing -in a password. The "scripts/build-sshkeys" script should only be run once. - - if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ] - then - scripts/build-umlhostfs <hosts> - fi - -creates the customized UML file systems for the instances given as command line -arguments by adding the default host configurations to the UML root file system. -If the "make-starting" scripts is called without any arguments then by default -the UML file systems are created for the hosts alice, venus, moon, carol, -winnetou, dave, sun, and bob. Each UML root file system has as size defined by -the ROOTFSSIZE in testing.conf which by default is 544 MBytes. Thus all 8 UML -hosts plus the master copy will require a total of 5 GBytes of disk space. - - if [ $ENABLE_START_TESTING = "yes" ] - then - ./start-testing <hosts> - fi - -starts the automated testing. More details on the tests you'll find in the -README document. - ------------------------------------------------------------------------------ - diff --git a/testing/Makefile.am b/testing/Makefile.am index 2aa7d70bc..305bf7f72 100644 --- a/testing/Makefile.am +++ b/testing/Makefile.am @@ -1,11 +1,4 @@ -noinst_SCRIPTS = do-tests -CLEANFILES = do-tests -EXTRA_DIST = do-tests.in make-testing start-testing stop-testing \ - testing.conf ssh_config hosts images scripts tests INSTALL README - -do-tests : do-tests.in - sed \ - -e "s:\@routing_table\@:$(routing_table):" \ - $(srcdir)/$@.in > $@ - chmod +x $@ +EXTRA_DIST = do-tests make-testing start-testing stop-testing \ + testing.conf ssh_config config hosts images scripts tests \ + README diff --git a/testing/Makefile.in b/testing/Makefile.in index d37e9ec73..0f7ada07d 100644 --- a/testing/Makefile.in +++ b/testing/Makefile.in @@ -1,9 +1,9 @@ -# Makefile.in generated by automake 1.11.1 from Makefile.am. +# Makefile.in generated by automake 1.11.3 from Makefile.am. # @configure_input@ # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -# Inc. +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. @@ -14,7 +14,6 @@ # PARTICULAR PURPOSE. @SET_MAKE@ - VPATH = @srcdir@ pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ @@ -35,8 +34,7 @@ POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = testing -DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in \ - INSTALL +DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ $(top_srcdir)/m4/config/ltoptions.m4 \ @@ -53,7 +51,6 @@ mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = -SCRIPTS = $(noinst_SCRIPTS) SOURCES = DIST_SOURCES = DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) @@ -76,6 +73,7 @@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -103,6 +101,7 @@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ MYSQLCFLAG = @MYSQLCFLAG@ MYSQLCONFIG = @MYSQLCONFIG@ @@ -130,6 +129,7 @@ RANLIB = @RANLIB@ RTLIB = @RTLIB@ RUBY = @RUBY@ RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ @@ -142,6 +142,7 @@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ @@ -195,7 +196,6 @@ libexecdir = @libexecdir@ linux_headers = @linux_headers@ localedir = @localedir@ localstatedir = @localstatedir@ -lt_ECHO = @lt_ECHO@ maemo_CFLAGS = @maemo_CFLAGS@ maemo_LIBS = @maemo_LIBS@ manager_plugins = @manager_plugins@ @@ -242,10 +242,9 @@ top_srcdir = @top_srcdir@ urandom_device = @urandom_device@ xml_CFLAGS = @xml_CFLAGS@ xml_LIBS = @xml_LIBS@ -noinst_SCRIPTS = do-tests -CLEANFILES = do-tests -EXTRA_DIST = do-tests.in make-testing start-testing stop-testing \ - testing.conf ssh_config hosts images scripts tests INSTALL README +EXTRA_DIST = do-tests make-testing start-testing stop-testing \ + testing.conf ssh_config config hosts images scripts tests \ + README all: all-am @@ -325,7 +324,7 @@ distdir: $(DISTFILES) done check-am: all-am check: check-am -all-am: Makefile $(SCRIPTS) +all-am: Makefile installdirs: install: install-am install-exec: install-exec-am @@ -337,14 +336,18 @@ install-am: all-am installcheck: installcheck-am install-strip: - $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ - install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ - `test -z '$(STRIP)' || \ - echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi mostlyclean-generic: clean-generic: - -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES) distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) @@ -433,12 +436,6 @@ uninstall-am: mostlyclean-libtool pdf pdf-am ps ps-am uninstall uninstall-am -do-tests : do-tests.in - sed \ - -e "s:\@routing_table\@:$(routing_table):" \ - $(srcdir)/$@.in > $@ - chmod +x $@ - # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: diff --git a/testing/README b/testing/README index 097b4264d..a62497269 100644 --- a/testing/README +++ b/testing/README @@ -1,158 +1,88 @@ - ------------------------------------ - strongSwan UML - Running the Tests - ------------------------------------ + ------------------------------ + strongSwan Integration Tests + ------------------------------ Contents -------- - 1. Starting up the UML testing environment - 2. Running the automated tests - 3. Manual testing + 1. Building the testing environment + 2. Starting up the testing environment + 3. Running the automated tests + 4. Manual testing -1. Starting up the UML testing environment - --------------------------------------- - -When the strongSwan UML testing environment has been put into place by -running the "make-testing" script then you are ready to start up the -UML instances by calling +1. Building the testing environment + -------------------------------- - ./start-testing <hosts> - -This main script first calls the subscript +The testing environment can be built with the "make-testing" script after +adjusting the variables in the testing.conf file. By default everything is +built when executing the script. Setting any of the ENABLE_BUILD_* variables +in the configuration file to "no" will not build those parts. - scripts/start-switches -that starts the three UML switches umlswitch0, umlswitch1, and umlswitch2 -which are connecting the UML instances among each other and via tun/tap -devices also make them accessible from the host system. - -Then depending on the setting of the UMLSTARTMODE variable defined -in "testing.conf", the UML instances given on the command line are started -up with different terminals: +2. Starting up the testing environment + ----------------------------------- -If you are running the KDE graphical environment then by setting +When the strongSwan testing environment has been put into place by running +the "make-testing" script you are ready to start up the KVM instances by +executing the "start-testing" script. - UMLSTARTMODE=konsole - -the script - scripts/kstart-umls <hosts> - -is called which starts up each of the UML instances defined by <hosts> in -a KDE konsole. If - - UMLSTARTMODE=xterm - -is set then - - scripts/xstart-umls <hosts> - -starts up the UML instances in an xterm each. And with the choice - - UMLSTARTMODE=screen - -the instances are started up by - - scripts/start-umls <hosts> - -in the background but the Linux command "screen -r <host>" can be used to -connect a terminal to the UML instance <host> if desired. - - - if [ $ENABLE_DO_TESTS = "yes" ] - then - do-tests - fi - -either executes all the tests defined in the "testing/tests" directory -if the variable SELECTEDTESTSONLY in "testing.conf" is set to "no" or the -selected tests defined by the string in SELELECTEDTESTS if SELECTEDTESTSONLY -is set to "yes". - - if [ $ENABLE_STOP_TESTING = "yes" ] - then - stop-testing <hosts> - fi - -stops the both the UML switches and the UML instances designated by the -<hosts> argument. - - -2. Running the automated tests +3. Running the automated tests --------------------------- The script ./do-tests <testnames> -runs the automated tests. With an empty <testnames> argument the tests -as defined in "testing.conf" are executed, otherwise the tests enumerated -by the <testnames> argument will be run as shown in the example below. +runs the automated tests. If the <testnames> argument is omitted all tests +are executed, otherwise only the tests listed will be run as shown in the +example below: - ./do-tests net2net-psk net2net-cert + ./do-tests ikev2/net2net-psk ikev2/net2net-cert Each test is divided into the following phases: - * scripts/load-testconfig <testname> - loads the UML hosts with test specific settings if such are provided. - - * next the "pretest.dat" script found in each test directory is executed. - Among other commands, strongSwan is started on the IPsec hosts. + * Load the test-specific guest configuration if any is provided. - * the "evaltest.dat" script evaluates if the test has been successful. - - * the "posttest.dat" script terminates the test e.g. by stopping - strongSwan on the IPsec hosts. + * Next the "pretest.dat" script found in each test directory is executed. + Among other commands, strongSwan is started on the IPsec hosts. - * scripts/restore-defaults <testname> - restores the default settings on the UML hosts. + * The "evaltest.dat" script evaluates if the test has been successful. -The test results and configuration settings for all tests settings are stored -in a folder labeled with the current date in the directory - - ~/strongswan-testing/testresults - -the same results are also automatically transferred to the Apache server -running on UML instance "winnetou" and can be accessed via the URL + * The "posttest.dat" script terminates the test e.g. by stopping + strongSwan on the IPsec hosts. It is also responsible to cleaning up + things (e.g. firewall rules) set up in "pretest.dat". - http://192.168.0.150/testresults/ + * Restore the default configuration on every host (new files have to be + deleted manually in "posttest.dat"). +The test results and configuration files for all tests are stored in a +folder labeled with the current date and time in the $TESTRESULTSDIR directory. -3. Manual testing - -------------- - -The greates flexibility can be achieved with manual testing. Just set - - ENABLE_DO_TESTS="no" - ENABLE_STOP_TESTING="no" - -in "testing.conf" and start the UML instances that you want to experiment with -by calling +The same results are also automatically transferred to the Apache server +running on guest "winnetou" and can be accessed via the URL - ./start-testing <hosts> - -If you want to preload a test scenario with configurations differing from -the default values, e.g. when using Preshared Keys then you can do this -with the command + http://192.168.0.150/testresults/ - scripts/load-testconfig net2net-psk - -You can then log onto any UML instance using its konsole, xterm or screen -terminal as root with the default password - tuxmux - -You can then execute any commands the UML instances, including changing -and recompiling the strongSwan source code located in the /root directory. +4. Manual testing + -------------- -After you have finished testing, the default configuration settings can -restored with the command +Instead of running tests automatically with "do-tests" it is possible to +preload a test scenario with the script: - scripts/restore-defaults net2net-psk + scripts/load-testconfig <testname> +Individual configuration files can be changed and any command can be executed by +logging into a guest host directly (via SSH or a console window). No password +is required to login as root. The sources for every software built during +"make-testing" are mounted at /root/shared/, which allows you to change and +recompile these components. ------------------------------------------------------------------------------ +After you have finished testing, the default configuration can be restored +with the following command (newly created files have to be deleted manually) + scripts/restore-defaults diff --git a/testing/config/kernel/config-3.5 b/testing/config/kernel/config-3.5 new file mode 100644 index 000000000..9494331eb --- /dev/null +++ b/testing/config/kernel/config-3.5 @@ -0,0 +1,1817 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/x86_64 3.5.3 Kernel Configuration +# +CONFIG_64BIT=y +# CONFIG_X86_32 is not set +CONFIG_X86_64=y +CONFIG_X86=y +CONFIG_INSTRUCTION_DECODER=y +CONFIG_OUTPUT_FORMAT="elf64-x86-64" +CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig" +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_HAVE_LATENCYTOP_SUPPORT=y +CONFIG_MMU=y +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_NEED_SG_DMA_LENGTH=y +CONFIG_GENERIC_ISA_DMA=y +CONFIG_GENERIC_BUG=y +CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_ARCH_MAY_HAVE_PC_FDC=y +# CONFIG_RWSEM_GENERIC_SPINLOCK is not set +CONFIG_RWSEM_XCHGADD_ALGORITHM=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HAS_DEFAULT_IDLE=y +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_ARCH_HAS_CPU_AUTOPROBE=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_ZONE_DMA32=y +CONFIG_AUDIT_ARCH=y +CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11" +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" +CONFIG_HAVE_IRQ_WORK=y +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_EXTABLE_SORT=y + +# +# General setup +# +CONFIG_EXPERIMENTAL=y +CONFIG_BROKEN_ON_SMP=y +CONFIG_INIT_ENV_ARG_LIMIT=32 +CONFIG_CROSS_COMPILE="" +CONFIG_LOCALVERSION="" +CONFIG_LOCALVERSION_AUTO=y +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_BZIP2=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_BZIP2 is not set +# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_XZ is not set +# CONFIG_KERNEL_LZO is not set +CONFIG_DEFAULT_HOSTNAME="(none)" +CONFIG_SWAP=y +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y +CONFIG_BSD_PROCESS_ACCT=y +# CONFIG_BSD_PROCESS_ACCT_V3 is not set +# CONFIG_FHANDLE is not set +# CONFIG_TASKSTATS is not set +# CONFIG_AUDIT is not set +CONFIG_HAVE_GENERIC_HARDIRQS=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_HARDIRQS=y +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +CONFIG_CLOCKSOURCE_WATCHDOG=y +CONFIG_ARCH_CLOCKSOURCE_DATA=y +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_GENERIC_CLOCKEVENTS_BUILD=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CMOS_UPDATE=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y + +# +# RCU Subsystem +# +CONFIG_TINY_RCU=y +# CONFIG_PREEMPT_RCU is not set +# CONFIG_TREE_RCU_TRACE is not set +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_LOG_BUF_SHIFT=14 +CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y +# CONFIG_CGROUPS is not set +# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_NAMESPACES=y +# CONFIG_UTS_NS is not set +# CONFIG_IPC_NS is not set +# CONFIG_PID_NS is not set +# CONFIG_NET_NS is not set +# CONFIG_SCHED_AUTOGROUP is not set +# CONFIG_SYSFS_DEPRECATED is not set +# CONFIG_RELAY is not set +# CONFIG_BLK_DEV_INITRD is not set +CONFIG_CC_OPTIMIZE_FOR_SIZE=y +CONFIG_SYSCTL=y +CONFIG_ANON_INODES=y +# CONFIG_EXPERT is not set +# CONFIG_SYSCTL_SYSCALL is not set +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_ALL is not set +CONFIG_HOTPLUG=y +CONFIG_PRINTK=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_PCSPKR_PLATFORM=y +CONFIG_HAVE_PCSPKR_PLATFORM=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +CONFIG_VM_EVENT_COUNTERS=y +CONFIG_PCI_QUIRKS=y +CONFIG_COMPAT_BRK=y +CONFIG_SLAB=y +# CONFIG_SLUB is not set +# CONFIG_PROFILING is not set +CONFIG_HAVE_OPROFILE=y +CONFIG_OPROFILE_NMI_TIMER=y +# CONFIG_JUMP_LABEL is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_OPTPROBES=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_ATTRS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_DMA_API_DEBUG=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y +CONFIG_HAVE_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_PERF_EVENTS_NMI=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y + +# +# GCOV-based kernel profiling +# +# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set +CONFIG_SLABINFO=y +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +# CONFIG_MODULES is not set +CONFIG_BLOCK=y +# CONFIG_BLK_DEV_BSG is not set +# CONFIG_BLK_DEV_BSGLIB is not set +# CONFIG_BLK_DEV_INTEGRITY is not set + +# +# Partition Types +# +# CONFIG_PARTITION_ADVANCED is not set +CONFIG_MSDOS_PARTITION=y + +# +# IO Schedulers +# +CONFIG_IOSCHED_NOOP=y +CONFIG_IOSCHED_DEADLINE=y +CONFIG_IOSCHED_CFQ=y +# CONFIG_DEFAULT_DEADLINE is not set +CONFIG_DEFAULT_CFQ=y +# CONFIG_DEFAULT_NOOP is not set +CONFIG_DEFAULT_IOSCHED="cfq" +# CONFIG_INLINE_SPIN_TRYLOCK is not set +# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK is not set +# CONFIG_INLINE_SPIN_LOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK_IRQ is not set +# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set +# CONFIG_INLINE_SPIN_UNLOCK_BH is not set +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_READ_TRYLOCK is not set +# CONFIG_INLINE_READ_LOCK is not set +# CONFIG_INLINE_READ_LOCK_BH is not set +# CONFIG_INLINE_READ_LOCK_IRQ is not set +# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set +CONFIG_INLINE_READ_UNLOCK=y +# CONFIG_INLINE_READ_UNLOCK_BH is not set +CONFIG_INLINE_READ_UNLOCK_IRQ=y +# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_WRITE_TRYLOCK is not set +# CONFIG_INLINE_WRITE_LOCK is not set +# CONFIG_INLINE_WRITE_LOCK_BH is not set +# CONFIG_INLINE_WRITE_LOCK_IRQ is not set +# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set +CONFIG_INLINE_WRITE_UNLOCK=y +# CONFIG_INLINE_WRITE_UNLOCK_BH is not set +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set +# CONFIG_MUTEX_SPIN_ON_OWNER is not set +CONFIG_FREEZER=y + +# +# Processor type and features +# +CONFIG_ZONE_DMA=y +# CONFIG_SMP is not set +CONFIG_X86_MPPARSE=y +CONFIG_X86_EXTENDED_PLATFORM=y +CONFIG_SCHED_OMIT_FRAME_POINTER=y +CONFIG_PARAVIRT_GUEST=y +# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set +# CONFIG_XEN is not set +# CONFIG_XEN_PRIVILEGED_GUEST is not set +CONFIG_KVM_CLOCK=y +CONFIG_KVM_GUEST=y +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_CLOCK=y +# CONFIG_PARAVIRT_DEBUG is not set +CONFIG_NO_BOOTMEM=y +# CONFIG_MEMTEST is not set +# CONFIG_MK8 is not set +# CONFIG_MPSC is not set +CONFIG_MCORE2=y +# CONFIG_MATOM is not set +# CONFIG_GENERIC_CPU is not set +CONFIG_X86_INTERNODE_CACHE_SHIFT=6 +CONFIG_X86_CMPXCHG=y +CONFIG_X86_L1_CACHE_SHIFT=6 +CONFIG_X86_XADD=y +CONFIG_X86_WP_WORKS_OK=y +CONFIG_X86_INTEL_USERCOPY=y +CONFIG_X86_USE_PPRO_CHECKSUM=y +CONFIG_X86_P6_NOP=y +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=64 +CONFIG_X86_DEBUGCTLMSR=y +CONFIG_CPU_SUP_INTEL=y +CONFIG_CPU_SUP_AMD=y +CONFIG_CPU_SUP_CENTAUR=y +CONFIG_HPET_TIMER=y +CONFIG_DMI=y +CONFIG_GART_IOMMU=y +# CONFIG_CALGARY_IOMMU is not set +CONFIG_SWIOTLB=y +CONFIG_IOMMU_HELPER=y +CONFIG_NR_CPUS=1 +# CONFIG_IRQ_TIME_ACCOUNTING is not set +CONFIG_PREEMPT_NONE=y +# CONFIG_PREEMPT_VOLUNTARY is not set +# CONFIG_PREEMPT is not set +CONFIG_X86_LOCAL_APIC=y +CONFIG_X86_IO_APIC=y +# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set +# CONFIG_X86_MCE is not set +# CONFIG_I8K is not set +# CONFIG_MICROCODE is not set +# CONFIG_X86_MSR is not set +# CONFIG_X86_CPUID is not set +CONFIG_ARCH_PHYS_ADDR_T_64BIT=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +CONFIG_DIRECT_GBPAGES=y +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_DEFAULT=y +CONFIG_ARCH_SELECT_MEMORY_MODEL=y +CONFIG_ARCH_MEMORY_PROBE=y +CONFIG_ARCH_PROC_KCORE_TEXT=y +CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_SPARSEMEM_MANUAL=y +CONFIG_SPARSEMEM=y +CONFIG_HAVE_MEMORY_PRESENT=y +CONFIG_SPARSEMEM_EXTREME=y +CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y +CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y +CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_HAVE_MEMBLOCK=y +CONFIG_HAVE_MEMBLOCK_NODE_MAP=y +CONFIG_ARCH_DISCARD_MEMBLOCK=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTPLUG_SPARSE=y +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_PAGEFLAGS_EXTENDED=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +# CONFIG_COMPACTION is not set +CONFIG_MIGRATION=y +CONFIG_PHYS_ADDR_T_64BIT=y +CONFIG_ZONE_DMA_FLAG=1 +CONFIG_BOUNCE=y +CONFIG_VIRT_TO_BUS=y +# CONFIG_KSM is not set +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +# CONFIG_TRANSPARENT_HUGEPAGE is not set +CONFIG_CROSS_MEMORY_ATTACH=y +CONFIG_NEED_PER_CPU_KM=y +# CONFIG_CLEANCACHE is not set +# CONFIG_FRONTSWAP is not set +# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set +CONFIG_X86_RESERVE_LOW=64 +CONFIG_MTRR=y +CONFIG_MTRR_SANITIZER=y +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 +CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 +CONFIG_X86_PAT=y +CONFIG_ARCH_USES_PG_UNCACHED=y +CONFIG_ARCH_RANDOM=y +# CONFIG_EFI is not set +CONFIG_SECCOMP=y +# CONFIG_CC_STACKPROTECTOR is not set +# CONFIG_HZ_100 is not set +CONFIG_HZ_250=y +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 +CONFIG_SCHED_HRTICK=y +# CONFIG_KEXEC is not set +# CONFIG_CRASH_DUMP is not set +CONFIG_PHYSICAL_START=0x1000000 +CONFIG_RELOCATABLE=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +# CONFIG_CMDLINE_BOOL is not set +CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y +CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y + +# +# Power management and ACPI options +# +CONFIG_SUSPEND=y +CONFIG_SUSPEND_FREEZER=y +# CONFIG_HIBERNATION is not set +CONFIG_PM_SLEEP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +# CONFIG_PM_RUNTIME is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_ACPI=y +CONFIG_ACPI_SLEEP=y +# CONFIG_ACPI_PROCFS is not set +# CONFIG_ACPI_PROCFS_POWER is not set +# CONFIG_ACPI_EC_DEBUGFS is not set +CONFIG_ACPI_PROC_EVENT=y +CONFIG_ACPI_AC=y +CONFIG_ACPI_BATTERY=y +CONFIG_ACPI_BUTTON=y +CONFIG_ACPI_FAN=y +# CONFIG_ACPI_DOCK is not set +CONFIG_ACPI_PROCESSOR=y +# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set +CONFIG_ACPI_THERMAL=y +# CONFIG_ACPI_CUSTOM_DSDT is not set +CONFIG_ACPI_BLACKLIST_YEAR=0 +# CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_PCI_SLOT is not set +CONFIG_X86_PM_TIMER=y +# CONFIG_ACPI_CONTAINER is not set +# CONFIG_ACPI_HOTPLUG_MEMORY is not set +# CONFIG_ACPI_SBS is not set +# CONFIG_ACPI_HED is not set +# CONFIG_ACPI_BGRT is not set +# CONFIG_ACPI_APEI is not set +# CONFIG_SFI is not set + +# +# CPU Frequency scaling +# +# CONFIG_CPU_FREQ is not set +CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_GOV_LADDER=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_INTEL_IDLE is not set + +# +# Memory power savings +# +# CONFIG_I7300_IDLE is not set + +# +# Bus options (PCI etc.) +# +CONFIG_PCI=y +CONFIG_PCI_DIRECT=y +# CONFIG_PCI_MMCONFIG is not set +CONFIG_PCI_DOMAINS=y +# CONFIG_PCI_CNB20LE_QUIRK is not set +# CONFIG_PCIEPORTBUS is not set +CONFIG_ARCH_SUPPORTS_MSI=y +CONFIG_PCI_MSI=y +# CONFIG_PCI_DEBUG is not set +# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set +# CONFIG_PCI_STUB is not set +CONFIG_HT_IRQ=y +# CONFIG_PCI_IOV is not set +# CONFIG_PCI_PRI is not set +# CONFIG_PCI_PASID is not set +# CONFIG_PCI_IOAPIC is not set +CONFIG_PCI_LABEL=y +CONFIG_ISA_DMA_API=y +CONFIG_AMD_NB=y +# CONFIG_PCCARD is not set +# CONFIG_HOTPLUG_PCI is not set +# CONFIG_RAPIDIO is not set + +# +# Executable file formats / Emulations +# +CONFIG_BINFMT_ELF=y +CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +# CONFIG_HAVE_AOUT is not set +# CONFIG_BINFMT_MISC is not set +# CONFIG_IA32_EMULATION is not set +# CONFIG_COMPAT_FOR_U64_ALIGNMENT is not set +CONFIG_HAVE_TEXT_POKE_SMP=y +CONFIG_X86_DEV_DMA_OPS=y +CONFIG_NET=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_UNIX=y +# CONFIG_UNIX_DIAG is not set +CONFIG_XFRM=y +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_USER=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_IPCOMP=y +CONFIG_NET_KEY=y +CONFIG_NET_KEY_MIGRATE=y +CONFIG_INET=y +# CONFIG_IP_MULTICAST is not set +CONFIG_IP_ADVANCED_ROUTER=y +# CONFIG_IP_FIB_TRIE_STATS is not set +CONFIG_IP_MULTIPLE_TABLES=y +# CONFIG_IP_ROUTE_MULTIPATH is not set +# CONFIG_IP_ROUTE_VERBOSE is not set +CONFIG_IP_ROUTE_CLASSID=y +# CONFIG_IP_PNP is not set +# CONFIG_NET_IPIP is not set +# CONFIG_NET_IPGRE_DEMUX is not set +# CONFIG_ARPD is not set +# CONFIG_SYN_COOKIES is not set +CONFIG_INET_AH=y +CONFIG_INET_ESP=y +CONFIG_INET_IPCOMP=y +CONFIG_INET_XFRM_TUNNEL=y +CONFIG_INET_TUNNEL=y +CONFIG_INET_XFRM_MODE_TRANSPORT=y +CONFIG_INET_XFRM_MODE_TUNNEL=y +CONFIG_INET_XFRM_MODE_BEET=y +# CONFIG_INET_LRO is not set +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +# CONFIG_INET_UDP_DIAG is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +CONFIG_IPV6=y +# CONFIG_IPV6_PRIVACY is not set +# CONFIG_IPV6_ROUTER_PREF is not set +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_INET6_AH=y +CONFIG_INET6_ESP=y +CONFIG_INET6_IPCOMP=y +CONFIG_IPV6_MIP6=y +CONFIG_INET6_XFRM_TUNNEL=y +CONFIG_INET6_TUNNEL=y +CONFIG_INET6_XFRM_MODE_TRANSPORT=y +CONFIG_INET6_XFRM_MODE_TUNNEL=y +CONFIG_INET6_XFRM_MODE_BEET=y +# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set +# CONFIG_IPV6_SIT is not set +# CONFIG_IPV6_TUNNEL is not set +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_SUBTREES=y +# CONFIG_IPV6_MROUTE is not set +# CONFIG_NETWORK_SECMARK is not set +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +CONFIG_NETFILTER=y +# CONFIG_NETFILTER_DEBUG is not set +CONFIG_NETFILTER_ADVANCED=y + +# +# Core Netfilter Configuration +# +CONFIG_NETFILTER_NETLINK=y +# CONFIG_NETFILTER_NETLINK_ACCT is not set +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_CONNTRACK_MARK=y +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_EVENTS=y +# CONFIG_NF_CONNTRACK_TIMEOUT is not set +# CONFIG_NF_CONNTRACK_TIMESTAMP is not set +# CONFIG_NF_CT_PROTO_DCCP is not set +# CONFIG_NF_CT_PROTO_SCTP is not set +CONFIG_NF_CT_PROTO_UDPLITE=y +# CONFIG_NF_CONNTRACK_AMANDA is not set +# CONFIG_NF_CONNTRACK_FTP is not set +# CONFIG_NF_CONNTRACK_H323 is not set +# CONFIG_NF_CONNTRACK_IRC is not set +# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set +# CONFIG_NF_CONNTRACK_SNMP is not set +# CONFIG_NF_CONNTRACK_PPTP is not set +CONFIG_NF_CONNTRACK_SANE=y +# CONFIG_NF_CONNTRACK_SIP is not set +# CONFIG_NF_CONNTRACK_TFTP is not set +CONFIG_NF_CT_NETLINK=y +# CONFIG_NF_CT_NETLINK_TIMEOUT is not set +# CONFIG_NETFILTER_TPROXY is not set +CONFIG_NETFILTER_XTABLES=y + +# +# Xtables combined modules +# +CONFIG_NETFILTER_XT_MARK=y +CONFIG_NETFILTER_XT_CONNMARK=y +CONFIG_NETFILTER_XT_SET=y + +# +# Xtables targets +# +# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +# CONFIG_NETFILTER_XT_TARGET_CT is not set +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_HL=y +# CONFIG_NETFILTER_XT_TARGET_HMARK is not set +# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_NOTRACK=y +# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set +# CONFIG_NETFILTER_XT_TARGET_TEE is not set +CONFIG_NETFILTER_XT_TARGET_TRACE=y +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set + +# +# Xtables matches +# +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +# CONFIG_NETFILTER_XT_MATCH_CPU is not set +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ECN=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_HL=y +# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set +# CONFIG_NETFILTER_XT_MATCH_OSF is not set +# CONFIG_NETFILTER_XT_MATCH_OWNER is not set +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set +CONFIG_NETFILTER_XT_MATCH_REALM=y +# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +# CONFIG_NETFILTER_XT_MATCH_TIME is not set +CONFIG_NETFILTER_XT_MATCH_U32=y +CONFIG_IP_SET=y +CONFIG_IP_SET_MAX=256 +CONFIG_IP_SET_BITMAP_IP=y +CONFIG_IP_SET_BITMAP_IPMAC=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETPORT=y +# CONFIG_IP_SET_HASH_NETIFACE is not set +CONFIG_IP_SET_LIST_SET=y +# CONFIG_IP_VS is not set + +# +# IP: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_CONNTRACK_IPV4=y +CONFIG_NF_CONNTRACK_PROC_COMPAT=y +CONFIG_IP_NF_QUEUE=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +# CONFIG_IP_NF_MATCH_RPFILTER is not set +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_TARGET_REJECT=y +CONFIG_IP_NF_TARGET_ULOG=y +CONFIG_NF_NAT=y +CONFIG_NF_NAT_NEEDED=y +CONFIG_IP_NF_TARGET_MASQUERADE=y +CONFIG_IP_NF_TARGET_NETMAP=y +CONFIG_IP_NF_TARGET_REDIRECT=y +CONFIG_NF_NAT_PROTO_UDPLITE=y +# CONFIG_NF_NAT_FTP is not set +# CONFIG_NF_NAT_IRC is not set +# CONFIG_NF_NAT_TFTP is not set +# CONFIG_NF_NAT_AMANDA is not set +# CONFIG_NF_NAT_PPTP is not set +# CONFIG_NF_NAT_H323 is not set +# CONFIG_NF_NAT_SIP is not set +CONFIG_IP_NF_MANGLE=y +CONFIG_IP_NF_TARGET_CLUSTERIP=y +CONFIG_IP_NF_TARGET_ECN=y +CONFIG_IP_NF_TARGET_TTL=y +CONFIG_IP_NF_RAW=y +CONFIG_IP_NF_ARPTABLES=y +CONFIG_IP_NF_ARPFILTER=y +CONFIG_IP_NF_ARP_MANGLE=y + +# +# IPv6: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV6=y +CONFIG_NF_CONNTRACK_IPV6=y +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +# CONFIG_IP6_NF_MATCH_RPFILTER is not set +CONFIG_IP6_NF_MATCH_RT=y +CONFIG_IP6_NF_TARGET_HL=y +CONFIG_IP6_NF_FILTER=y +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_RAW=y +# CONFIG_IP_DCCP is not set +# CONFIG_IP_SCTP is not set +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +CONFIG_L2TP=y +# CONFIG_L2TP_V3 is not set +# CONFIG_BRIDGE is not set +# CONFIG_NET_DSA is not set +# CONFIG_VLAN_8021Q is not set +# CONFIG_DECNET is not set +# CONFIG_LLC2 is not set +# CONFIG_IPX is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_WAN_ROUTER is not set +# CONFIG_PHONET is not set +# CONFIG_IEEE802154 is not set +# CONFIG_NET_SCHED is not set +# CONFIG_DCB is not set +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +CONFIG_BQL=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_IRDA is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +CONFIG_FIB_RULES=y +CONFIG_WIRELESS=y +# CONFIG_CFG80211 is not set +# CONFIG_LIB80211 is not set + +# +# CFG80211 needs to be enabled for MAC80211 +# +# CONFIG_WIMAX is not set +# CONFIG_RFKILL is not set +CONFIG_NET_9P=y +CONFIG_NET_9P_VIRTIO=y +# CONFIG_NET_9P_DEBUG is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +CONFIG_HAVE_BPF_JIT=y + +# +# Device Drivers +# + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +# CONFIG_DEVTMPFS is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y +CONFIG_FW_LOADER=y +CONFIG_FIRMWARE_IN_KERNEL=y +CONFIG_EXTRA_FIRMWARE="" +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_SYS_HYPERVISOR is not set +# CONFIG_GENERIC_CPU_DEVICES is not set +# CONFIG_DMA_SHARED_BUFFER is not set +# CONFIG_CONNECTOR is not set +# CONFIG_MTD is not set +# CONFIG_PARPORT is not set +CONFIG_PNP=y +CONFIG_PNP_DEBUG_MESSAGES=y + +# +# Protocols +# +CONFIG_PNPACPI=y +CONFIG_BLK_DEV=y +# CONFIG_BLK_DEV_FD is not set +# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +# CONFIG_BLK_CPQ_DA is not set +# CONFIG_BLK_CPQ_CISS_DA is not set +# CONFIG_BLK_DEV_DAC960 is not set +# CONFIG_BLK_DEV_UMEM is not set +# CONFIG_BLK_DEV_COW_COMMON is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +# CONFIG_BLK_DEV_CRYPTOLOOP is not set + +# +# DRBD disabled because PROC_FS, INET or CONNECTOR not selected +# +CONFIG_BLK_DEV_NBD=y +# CONFIG_BLK_DEV_NVME is not set +# CONFIG_BLK_DEV_SX8 is not set +# CONFIG_BLK_DEV_RAM is not set +# CONFIG_CDROM_PKTCDVD is not set +# CONFIG_ATA_OVER_ETH is not set +CONFIG_VIRTIO_BLK=y +# CONFIG_BLK_DEV_HD is not set +# CONFIG_BLK_DEV_RBD is not set + +# +# Misc devices +# +# CONFIG_SENSORS_LIS3LV02D is not set +# CONFIG_IBM_ASM is not set +# CONFIG_PHANTOM is not set +# CONFIG_INTEL_MID_PTI is not set +# CONFIG_SGI_IOC4 is not set +# CONFIG_TIFM_CORE is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_HP_ILO is not set +# CONFIG_VMWARE_BALLOON is not set +# CONFIG_PCH_PHUB is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_93CX6 is not set +# CONFIG_CB710_CORE is not set + +# +# Texas Instruments shared transport line discipline +# + +# +# Altera FPGA firmware download module +# +CONFIG_HAVE_IDE=y +# CONFIG_IDE is not set + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +# CONFIG_SCSI is not set +# CONFIG_SCSI_DMA is not set +# CONFIG_SCSI_NETLINK is not set +# CONFIG_ATA is not set +# CONFIG_MD is not set +# CONFIG_FUSION is not set + +# +# IEEE 1394 (FireWire) support +# +# CONFIG_FIREWIRE is not set +# CONFIG_FIREWIRE_NOSY is not set +# CONFIG_I2O is not set +# CONFIG_MACINTOSH_DRIVERS is not set +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +CONFIG_DUMMY=y +# CONFIG_EQUALIZER is not set +# CONFIG_MII is not set +# CONFIG_NET_TEAM is not set +# CONFIG_MACVLAN is not set +# CONFIG_NETCONSOLE is not set +# CONFIG_NETPOLL is not set +# CONFIG_NET_POLL_CONTROLLER is not set +CONFIG_TUN=y +# CONFIG_VETH is not set +CONFIG_VIRTIO_NET=y +# CONFIG_ARCNET is not set + +# +# CAIF transport drivers +# +CONFIG_ETHERNET=y +CONFIG_NET_VENDOR_3COM=y +# CONFIG_VORTEX is not set +# CONFIG_TYPHOON is not set +CONFIG_NET_VENDOR_ADAPTEC=y +# CONFIG_ADAPTEC_STARFIRE is not set +CONFIG_NET_VENDOR_ALTEON=y +# CONFIG_ACENIC is not set +CONFIG_NET_VENDOR_AMD=y +# CONFIG_AMD8111_ETH is not set +# CONFIG_PCNET32 is not set +CONFIG_NET_VENDOR_ATHEROS=y +# CONFIG_ATL2 is not set +# CONFIG_ATL1 is not set +# CONFIG_ATL1E is not set +# CONFIG_ATL1C is not set +CONFIG_NET_VENDOR_BROADCOM=y +# CONFIG_B44 is not set +# CONFIG_BNX2 is not set +# CONFIG_CNIC is not set +# CONFIG_TIGON3 is not set +# CONFIG_BNX2X is not set +CONFIG_NET_VENDOR_BROCADE=y +# CONFIG_BNA is not set +# CONFIG_NET_CALXEDA_XGMAC is not set +CONFIG_NET_VENDOR_CHELSIO=y +# CONFIG_CHELSIO_T1 is not set +# CONFIG_CHELSIO_T3 is not set +# CONFIG_CHELSIO_T4 is not set +# CONFIG_CHELSIO_T4VF is not set +CONFIG_NET_VENDOR_CISCO=y +# CONFIG_ENIC is not set +# CONFIG_DNET is not set +CONFIG_NET_VENDOR_DEC=y +# CONFIG_NET_TULIP is not set +CONFIG_NET_VENDOR_DLINK=y +# CONFIG_DL2K is not set +# CONFIG_SUNDANCE is not set +CONFIG_NET_VENDOR_EMULEX=y +# CONFIG_BE2NET is not set +CONFIG_NET_VENDOR_EXAR=y +# CONFIG_S2IO is not set +# CONFIG_VXGE is not set +CONFIG_NET_VENDOR_HP=y +# CONFIG_HP100 is not set +CONFIG_NET_VENDOR_INTEL=y +# CONFIG_E100 is not set +# CONFIG_E1000 is not set +# CONFIG_E1000E is not set +# CONFIG_IGB is not set +# CONFIG_IGBVF is not set +# CONFIG_IXGB is not set +# CONFIG_IXGBE is not set +# CONFIG_IXGBEVF is not set +CONFIG_NET_VENDOR_I825XX=y +# CONFIG_ZNET is not set +# CONFIG_IP1000 is not set +# CONFIG_JME is not set +CONFIG_NET_VENDOR_MARVELL=y +# CONFIG_SKGE is not set +# CONFIG_SKY2 is not set +CONFIG_NET_VENDOR_MELLANOX=y +# CONFIG_MLX4_EN is not set +# CONFIG_MLX4_CORE is not set +CONFIG_NET_VENDOR_MICREL=y +# CONFIG_KS8851_MLL is not set +# CONFIG_KSZ884X_PCI is not set +CONFIG_NET_VENDOR_MYRI=y +# CONFIG_MYRI10GE is not set +# CONFIG_FEALNX is not set +CONFIG_NET_VENDOR_NATSEMI=y +# CONFIG_NATSEMI is not set +# CONFIG_NS83820 is not set +CONFIG_NET_VENDOR_8390=y +# CONFIG_NE2K_PCI is not set +CONFIG_NET_VENDOR_NVIDIA=y +# CONFIG_FORCEDETH is not set +CONFIG_NET_VENDOR_OKI=y +# CONFIG_PCH_GBE is not set +# CONFIG_ETHOC is not set +CONFIG_NET_PACKET_ENGINE=y +# CONFIG_HAMACHI is not set +# CONFIG_YELLOWFIN is not set +CONFIG_NET_VENDOR_QLOGIC=y +# CONFIG_QLA3XXX is not set +# CONFIG_QLCNIC is not set +# CONFIG_QLGE is not set +# CONFIG_NETXEN_NIC is not set +CONFIG_NET_VENDOR_REALTEK=y +# CONFIG_8139CP is not set +# CONFIG_8139TOO is not set +# CONFIG_R8169 is not set +CONFIG_NET_VENDOR_RDC=y +# CONFIG_R6040 is not set +CONFIG_NET_VENDOR_SEEQ=y +# CONFIG_SEEQ8005 is not set +CONFIG_NET_VENDOR_SILAN=y +# CONFIG_SC92031 is not set +CONFIG_NET_VENDOR_SIS=y +# CONFIG_SIS900 is not set +# CONFIG_SIS190 is not set +# CONFIG_SFC is not set +CONFIG_NET_VENDOR_SMSC=y +# CONFIG_EPIC100 is not set +# CONFIG_SMSC9420 is not set +CONFIG_NET_VENDOR_STMICRO=y +# CONFIG_STMMAC_ETH is not set +CONFIG_NET_VENDOR_SUN=y +# CONFIG_HAPPYMEAL is not set +# CONFIG_SUNGEM is not set +# CONFIG_CASSINI is not set +# CONFIG_NIU is not set +CONFIG_NET_VENDOR_TEHUTI=y +# CONFIG_TEHUTI is not set +CONFIG_NET_VENDOR_TI=y +# CONFIG_TLAN is not set +CONFIG_NET_VENDOR_VIA=y +# CONFIG_VIA_RHINE is not set +# CONFIG_VIA_VELOCITY is not set +CONFIG_NET_VENDOR_WIZNET=y +# CONFIG_WIZNET_W5100 is not set +# CONFIG_WIZNET_W5300 is not set +# CONFIG_FDDI is not set +# CONFIG_HIPPI is not set +# CONFIG_NET_SB1000 is not set +# CONFIG_PHYLIB is not set +# CONFIG_PPP is not set +# CONFIG_SLIP is not set +CONFIG_WLAN=y +# CONFIG_AIRO is not set +# CONFIG_ATMEL is not set +# CONFIG_PRISM54 is not set +# CONFIG_HOSTAP is not set +# CONFIG_WL_TI is not set + +# +# Enable WiMAX (Networking options) to see the WiMAX drivers +# +# CONFIG_WAN is not set +# CONFIG_VMXNET3 is not set +# CONFIG_ISDN is not set + +# +# Input device support +# +CONFIG_INPUT=y +# CONFIG_INPUT_FF_MEMLESS is not set +# CONFIG_INPUT_POLLDEV is not set +# CONFIG_INPUT_SPARSEKMAP is not set +# CONFIG_INPUT_MATRIXKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_MOUSEDEV_PSAUX=y +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +# CONFIG_INPUT_JOYDEV is not set +# CONFIG_INPUT_EVDEV is not set +# CONFIG_INPUT_EVBUG is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +CONFIG_KEYBOARD_ATKBD=y +# CONFIG_KEYBOARD_LKKBD is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_OMAP4 is not set +# CONFIG_KEYBOARD_XTKBD is not set +CONFIG_INPUT_MOUSE=y +CONFIG_MOUSE_PS2=y +CONFIG_MOUSE_PS2_ALPS=y +CONFIG_MOUSE_PS2_LOGIPS2PP=y +CONFIG_MOUSE_PS2_SYNAPTICS=y +CONFIG_MOUSE_PS2_LIFEBOOK=y +CONFIG_MOUSE_PS2_TRACKPOINT=y +# CONFIG_MOUSE_PS2_ELANTECH is not set +# CONFIG_MOUSE_PS2_SENTELIC is not set +# CONFIG_MOUSE_PS2_TOUCHKIT is not set +# CONFIG_MOUSE_SERIAL is not set +# CONFIG_MOUSE_APPLETOUCH is not set +# CONFIG_MOUSE_BCM5974 is not set +# CONFIG_MOUSE_VSXXXAA is not set +# CONFIG_MOUSE_SYNAPTICS_USB is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +# CONFIG_INPUT_TOUCHSCREEN is not set +# CONFIG_INPUT_MISC is not set + +# +# Hardware I/O ports +# +CONFIG_SERIO=y +CONFIG_SERIO_I8042=y +CONFIG_SERIO_SERPORT=y +# CONFIG_SERIO_CT82C710 is not set +# CONFIG_SERIO_PCIPS2 is not set +CONFIG_SERIO_LIBPS2=y +# CONFIG_SERIO_RAW is not set +# CONFIG_SERIO_ALTERA_PS2 is not set +# CONFIG_SERIO_PS2MULT is not set +# CONFIG_GAMEPORT is not set + +# +# Character devices +# +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_VT_CONSOLE_SLEEP=y +CONFIG_HW_CONSOLE=y +# CONFIG_VT_HW_CONSOLE_BINDING is not set +CONFIG_UNIX98_PTYS=y +# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set +CONFIG_LEGACY_PTYS=y +CONFIG_LEGACY_PTY_COUNT=256 +# CONFIG_SERIAL_NONSTANDARD is not set +# CONFIG_NOZOMI is not set +# CONFIG_N_GSM is not set +# CONFIG_TRACE_SINK is not set +CONFIG_DEVKMEM=y + +# +# Serial drivers +# +# CONFIG_SERIAL_8250 is not set +CONFIG_FIX_EARLYCON_MEM=y + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_MFD_HSU is not set +# CONFIG_SERIAL_JSM is not set +# CONFIG_SERIAL_TIMBERDALE is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +# CONFIG_SERIAL_PCH_UART is not set +# CONFIG_SERIAL_XILINX_PS_UART is not set +CONFIG_HVC_DRIVER=y +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_IPMI_HANDLER is not set +# CONFIG_HW_RANDOM is not set +# CONFIG_NVRAM is not set +# CONFIG_RTC is not set +# CONFIG_GEN_RTC is not set +# CONFIG_R3964 is not set +# CONFIG_APPLICOM is not set +# CONFIG_MWAVE is not set +# CONFIG_RAW_DRIVER is not set +# CONFIG_HPET is not set +# CONFIG_HANGCHECK_TIMER is not set +# CONFIG_TCG_TPM is not set +# CONFIG_TELCLOCK is not set +CONFIG_DEVPORT=y +# CONFIG_I2C is not set +# CONFIG_SPI is not set +# CONFIG_HSI is not set + +# +# PPS support +# +# CONFIG_PPS is not set + +# +# PPS generators support +# + +# +# PTP clock support +# + +# +# Enable Device Drivers -> PPS to see the PTP clock options. +# +CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y +# CONFIG_GPIOLIB is not set +# CONFIG_W1 is not set +CONFIG_POWER_SUPPLY=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_PDA_POWER is not set +# CONFIG_TEST_POWER is not set +# CONFIG_BATTERY_DS2780 is not set +# CONFIG_BATTERY_DS2781 is not set +# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_CHARGER_MAX8903 is not set +CONFIG_HWMON=y +# CONFIG_HWMON_VID is not set +# CONFIG_HWMON_DEBUG_CHIP is not set + +# +# Native drivers +# +# CONFIG_SENSORS_ABITUGURU is not set +# CONFIG_SENSORS_ABITUGURU3 is not set +# CONFIG_SENSORS_K8TEMP is not set +# CONFIG_SENSORS_K10TEMP is not set +# CONFIG_SENSORS_FAM15H_POWER is not set +# CONFIG_SENSORS_I5K_AMB is not set +# CONFIG_SENSORS_F71805F is not set +# CONFIG_SENSORS_F71882FG is not set +# CONFIG_SENSORS_CORETEMP is not set +# CONFIG_SENSORS_IT87 is not set +# CONFIG_SENSORS_NTC_THERMISTOR is not set +# CONFIG_SENSORS_PC87360 is not set +# CONFIG_SENSORS_PC87427 is not set +# CONFIG_SENSORS_SIS5595 is not set +# CONFIG_SENSORS_SMSC47M1 is not set +# CONFIG_SENSORS_SMSC47B397 is not set +# CONFIG_SENSORS_SCH56XX_COMMON is not set +# CONFIG_SENSORS_VIA_CPUTEMP is not set +# CONFIG_SENSORS_VIA686A is not set +# CONFIG_SENSORS_VT1211 is not set +# CONFIG_SENSORS_VT8231 is not set +# CONFIG_SENSORS_W83627HF is not set +# CONFIG_SENSORS_W83627EHF is not set +# CONFIG_SENSORS_APPLESMC is not set + +# +# ACPI drivers +# +# CONFIG_SENSORS_ACPI_POWER is not set +# CONFIG_SENSORS_ATK0110 is not set +CONFIG_THERMAL=y +CONFIG_THERMAL_HWMON=y +# CONFIG_WATCHDOG is not set +CONFIG_SSB_POSSIBLE=y + +# +# Sonics Silicon Backplane +# +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y + +# +# Broadcom specific AMBA +# +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_CORE is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_MFD_TMIO is not set +# CONFIG_ABX500_CORE is not set +# CONFIG_MFD_CS5535 is not set +# CONFIG_LPC_SCH is not set +# CONFIG_LPC_ICH is not set +# CONFIG_MFD_RDC321X is not set +# CONFIG_MFD_JANZ_CMODIO is not set +# CONFIG_MFD_VX855 is not set +# CONFIG_REGULATOR is not set +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +# CONFIG_AGP is not set +CONFIG_VGA_ARB=y +CONFIG_VGA_ARB_MAX_GPUS=16 +# CONFIG_VGA_SWITCHEROO is not set +# CONFIG_DRM is not set +# CONFIG_STUB_POULSBO is not set +# CONFIG_VGASTATE is not set +# CONFIG_VIDEO_OUTPUT_CONTROL is not set +# CONFIG_FB is not set +# CONFIG_EXYNOS_VIDEO is not set +# CONFIG_BACKLIGHT_LCD_SUPPORT is not set + +# +# Console display driver support +# +CONFIG_VGA_CONSOLE=y +# CONFIG_VGACON_SOFT_SCROLLBACK is not set +CONFIG_DUMMY_CONSOLE=y +CONFIG_SOUND=y +# CONFIG_SOUND_OSS_CORE is not set +# CONFIG_SND is not set +# CONFIG_SOUND_PRIME is not set + +# +# HID support +# +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +# CONFIG_HIDRAW is not set +CONFIG_HID_GENERIC=y + +# +# Special HID drivers +# +CONFIG_USB_ARCH_HAS_OHCI=y +CONFIG_USB_ARCH_HAS_EHCI=y +CONFIG_USB_ARCH_HAS_XHCI=y +CONFIG_USB_SUPPORT=y +CONFIG_USB_ARCH_HAS_HCD=y +# CONFIG_USB is not set + +# +# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may +# +# CONFIG_USB_GADGET is not set + +# +# OTG and related infrastructure +# +# CONFIG_UWB is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_INFINIBAND is not set +# CONFIG_EDAC is not set +# CONFIG_RTC_CLASS is not set +# CONFIG_DMADEVICES is not set +# CONFIG_AUXDISPLAY is not set +# CONFIG_UIO is not set +CONFIG_VIRTIO=y +CONFIG_VIRTIO_RING=y + +# +# Virtio drivers +# +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_BALLOON=y +CONFIG_VIRTIO_MMIO=y +# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set + +# +# Microsoft Hyper-V guest support +# +# CONFIG_HYPERV is not set +# CONFIG_STAGING is not set +CONFIG_X86_PLATFORM_DEVICES=y +# CONFIG_ACERHDF is not set +# CONFIG_ASUS_LAPTOP is not set +# CONFIG_FUJITSU_TABLET is not set +# CONFIG_HP_ACCEL is not set +# CONFIG_THINKPAD_ACPI is not set +# CONFIG_SENSORS_HDAPS is not set +# CONFIG_INTEL_MENLOW is not set +# CONFIG_ACPI_WMI is not set +# CONFIG_TOPSTAR_LAPTOP is not set +# CONFIG_TOSHIBA_BT_RFKILL is not set +# CONFIG_ACPI_CMPC is not set +# CONFIG_INTEL_IPS is not set +# CONFIG_IBM_RTL is not set +# CONFIG_XO15_EBOOK is not set +# CONFIG_SAMSUNG_Q10 is not set +# CONFIG_APPLE_GMUX is not set + +# +# Hardware Spinlock drivers +# +CONFIG_CLKEVT_I8253=y +CONFIG_I8253_LOCK=y +CONFIG_CLKBLD_I8253=y +CONFIG_IOMMU_SUPPORT=y +# CONFIG_AMD_IOMMU is not set +# CONFIG_INTEL_IOMMU is not set +# CONFIG_IRQ_REMAP is not set + +# +# Remoteproc drivers (EXPERIMENTAL) +# + +# +# Rpmsg drivers (EXPERIMENTAL) +# +# CONFIG_VIRT_DRIVERS is not set +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_VME_BUS is not set + +# +# Firmware Drivers +# +# CONFIG_EDD is not set +CONFIG_FIRMWARE_MEMMAP=y +# CONFIG_DELL_RBU is not set +# CONFIG_DCDBAS is not set +CONFIG_DMIID=y +# CONFIG_DMI_SYSFS is not set +# CONFIG_ISCSI_IBFT_FIND is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +CONFIG_EXT2_FS=y +# CONFIG_EXT2_FS_XATTR is not set +# CONFIG_EXT2_FS_XIP is not set +CONFIG_EXT3_FS=y +# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set +# CONFIG_EXT3_FS_XATTR is not set +# CONFIG_EXT4_FS is not set +CONFIG_JBD=y +CONFIG_REISERFS_FS=y +# CONFIG_REISERFS_CHECK is not set +# CONFIG_REISERFS_PROC_INFO is not set +# CONFIG_REISERFS_FS_XATTR is not set +# CONFIG_JFS_FS is not set +# CONFIG_XFS_FS is not set +# CONFIG_GFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +CONFIG_FS_POSIX_ACL=y +CONFIG_FILE_LOCKING=y +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +# CONFIG_FANOTIFY is not set +CONFIG_QUOTA=y +# CONFIG_QUOTA_NETLINK_INTERFACE is not set +CONFIG_PRINT_QUOTA_WARNING=y +# CONFIG_QUOTA_DEBUG is not set +# CONFIG_QFMT_V1 is not set +# CONFIG_QFMT_V2 is not set +CONFIG_QUOTACTL=y +CONFIG_AUTOFS4_FS=y +# CONFIG_FUSE_FS is not set + +# +# Caches +# +# CONFIG_FSCACHE is not set + +# +# CD-ROM/DVD Filesystems +# +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +# CONFIG_ZISOFS is not set +# CONFIG_UDF_FS is not set + +# +# DOS/FAT/NT Filesystems +# +# CONFIG_MSDOS_FS is not set +# CONFIG_VFAT_FS is not set +# CONFIG_NTFS_FS is not set + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +# CONFIG_TMPFS_POSIX_ACL is not set +# CONFIG_TMPFS_XATTR is not set +# CONFIG_HUGETLBFS is not set +# CONFIG_HUGETLB_PAGE is not set +# CONFIG_CONFIGFS_FS is not set +CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ADFS_FS is not set +# CONFIG_AFFS_FS is not set +# CONFIG_HFS_FS is not set +# CONFIG_HFSPLUS_FS is not set +# CONFIG_BEFS_FS is not set +# CONFIG_BFS_FS is not set +# CONFIG_EFS_FS is not set +# CONFIG_LOGFS is not set +# CONFIG_CRAMFS is not set +# CONFIG_SQUASHFS is not set +# CONFIG_VXFS_FS is not set +# CONFIG_MINIX_FS is not set +# CONFIG_OMFS_FS is not set +# CONFIG_HPFS_FS is not set +# CONFIG_QNX4FS_FS is not set +# CONFIG_QNX6FS_FS is not set +# CONFIG_ROMFS_FS is not set +# CONFIG_PSTORE is not set +# CONFIG_SYSV_FS is not set +# CONFIG_UFS_FS is not set +CONFIG_NETWORK_FILESYSTEMS=y +# CONFIG_NFS_FS is not set +# CONFIG_NFSD is not set +# CONFIG_CEPH_FS is not set +# CONFIG_CIFS is not set +# CONFIG_NCP_FS is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_9P_FS=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="iso8859-1" +# CONFIG_NLS_CODEPAGE_437 is not set +# CONFIG_NLS_CODEPAGE_737 is not set +# CONFIG_NLS_CODEPAGE_775 is not set +# CONFIG_NLS_CODEPAGE_850 is not set +# CONFIG_NLS_CODEPAGE_852 is not set +# CONFIG_NLS_CODEPAGE_855 is not set +# CONFIG_NLS_CODEPAGE_857 is not set +# CONFIG_NLS_CODEPAGE_860 is not set +# CONFIG_NLS_CODEPAGE_861 is not set +# CONFIG_NLS_CODEPAGE_862 is not set +# CONFIG_NLS_CODEPAGE_863 is not set +# CONFIG_NLS_CODEPAGE_864 is not set +# CONFIG_NLS_CODEPAGE_865 is not set +# CONFIG_NLS_CODEPAGE_866 is not set +# CONFIG_NLS_CODEPAGE_869 is not set +# CONFIG_NLS_CODEPAGE_936 is not set +# CONFIG_NLS_CODEPAGE_950 is not set +# CONFIG_NLS_CODEPAGE_932 is not set +# CONFIG_NLS_CODEPAGE_949 is not set +# CONFIG_NLS_CODEPAGE_874 is not set +# CONFIG_NLS_ISO8859_8 is not set +# CONFIG_NLS_CODEPAGE_1250 is not set +# CONFIG_NLS_CODEPAGE_1251 is not set +# CONFIG_NLS_ASCII is not set +# CONFIG_NLS_ISO8859_1 is not set +# CONFIG_NLS_ISO8859_2 is not set +# CONFIG_NLS_ISO8859_3 is not set +# CONFIG_NLS_ISO8859_4 is not set +# CONFIG_NLS_ISO8859_5 is not set +# CONFIG_NLS_ISO8859_6 is not set +# CONFIG_NLS_ISO8859_7 is not set +# CONFIG_NLS_ISO8859_9 is not set +# CONFIG_NLS_ISO8859_13 is not set +# CONFIG_NLS_ISO8859_14 is not set +# CONFIG_NLS_ISO8859_15 is not set +# CONFIG_NLS_KOI8_R is not set +# CONFIG_NLS_KOI8_U is not set +# CONFIG_NLS_MAC_ROMAN is not set +# CONFIG_NLS_MAC_CELTIC is not set +# CONFIG_NLS_MAC_CENTEURO is not set +# CONFIG_NLS_MAC_CROATIAN is not set +# CONFIG_NLS_MAC_CYRILLIC is not set +# CONFIG_NLS_MAC_GAELIC is not set +# CONFIG_NLS_MAC_GREEK is not set +# CONFIG_NLS_MAC_ICELAND is not set +# CONFIG_NLS_MAC_INUIT is not set +# CONFIG_NLS_MAC_ROMANIAN is not set +# CONFIG_NLS_MAC_TURKISH is not set +# CONFIG_NLS_UTF8 is not set + +# +# Kernel hacking +# +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +# CONFIG_PRINTK_TIME is not set +CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4 +CONFIG_ENABLE_WARN_DEPRECATED=y +CONFIG_ENABLE_MUST_CHECK=y +CONFIG_FRAME_WARN=1024 +# CONFIG_MAGIC_SYSRQ is not set +# CONFIG_STRIP_ASM_SYMS is not set +# CONFIG_READABLE_ASM is not set +# CONFIG_UNUSED_SYMBOLS is not set +# CONFIG_DEBUG_FS is not set +# CONFIG_HEADERS_CHECK is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_DEBUG_KERNEL=y +# CONFIG_DEBUG_SHIRQ is not set +# CONFIG_LOCKUP_DETECTOR is not set +# CONFIG_HARDLOCKUP_DETECTOR is not set +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 +# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set +CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 +# CONFIG_SCHED_DEBUG is not set +# CONFIG_SCHEDSTATS is not set +# CONFIG_TIMER_STATS is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_DEBUG_SLAB is not set +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_RT_MUTEX_TESTER is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_PROVE_LOCKING is not set +# CONFIG_SPARSE_RCU_POINTER is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_DEBUG_KOBJECT is not set +CONFIG_DEBUG_BUGVERBOSE=y +CONFIG_DEBUG_INFO=y +# CONFIG_DEBUG_INFO_REDUCED is not set +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_VIRTUAL is not set +# CONFIG_DEBUG_WRITECOUNT is not set +CONFIG_DEBUG_MEMORY_INIT=y +# CONFIG_DEBUG_LIST is not set +# CONFIG_TEST_LIST_SORT is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +# CONFIG_DEBUG_CREDENTIALS is not set +CONFIG_ARCH_WANT_FRAME_POINTERS=y +CONFIG_FRAME_POINTER=y +# CONFIG_BOOT_PRINTK_DELAY is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_TRACE is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# CONFIG_FAULT_INJECTION is not set +# CONFIG_LATENCYTOP is not set +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_USER_STACKTRACE_SUPPORT=y +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y +CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACING_SUPPORT=y +CONFIG_FTRACE=y +# CONFIG_FUNCTION_TRACER is not set +# CONFIG_IRQSOFF_TRACER is not set +# CONFIG_SCHED_TRACER is not set +# CONFIG_ENABLE_DEFAULT_TRACERS is not set +# CONFIG_FTRACE_SYSCALLS is not set +CONFIG_BRANCH_PROFILE_NONE=y +# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set +# CONFIG_PROFILE_ALL_BRANCHES is not set +# CONFIG_STACK_TRACER is not set +# CONFIG_BLK_DEV_IO_TRACE is not set +# CONFIG_UPROBE_EVENT is not set +# CONFIG_PROBE_EVENTS is not set +# CONFIG_MMIOTRACE is not set +# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_SAMPLES is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_HAVE_ARCH_KMEMCHECK=y +# CONFIG_TEST_KSTRTOX is not set +# CONFIG_STRICT_DEVMEM is not set +CONFIG_X86_VERBOSE_BOOTUP=y +CONFIG_EARLY_PRINTK=y +# CONFIG_EARLY_PRINTK_DBGP is not set +# CONFIG_DEBUG_STACKOVERFLOW is not set +# CONFIG_X86_PTDUMP is not set +CONFIG_DEBUG_RODATA=y +CONFIG_DEBUG_RODATA_TEST=y +# CONFIG_IOMMU_DEBUG is not set +# CONFIG_IOMMU_STRESS is not set +CONFIG_HAVE_MMIOTRACE_SUPPORT=y +CONFIG_IO_DELAY_TYPE_0X80=0 +CONFIG_IO_DELAY_TYPE_0XED=1 +CONFIG_IO_DELAY_TYPE_UDELAY=2 +CONFIG_IO_DELAY_TYPE_NONE=3 +CONFIG_IO_DELAY_0X80=y +# CONFIG_IO_DELAY_0XED is not set +# CONFIG_IO_DELAY_UDELAY is not set +# CONFIG_IO_DELAY_NONE is not set +CONFIG_DEFAULT_IO_DELAY_TYPE=0 +# CONFIG_CPA_DEBUG is not set +# CONFIG_OPTIMIZE_INLINING is not set +# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set +# CONFIG_DEBUG_NMI_SELFTEST is not set + +# +# Security options +# +# CONFIG_KEYS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +# CONFIG_SECURITYFS is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_DEFAULT_SECURITY="" +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_BLKCIPHER=y +CONFIG_CRYPTO_BLKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_PCOMP=y +CONFIG_CRYPTO_PCOMP2=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +CONFIG_CRYPTO_USER=y +CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +CONFIG_CRYPTO_GF128MUL=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_WORKQUEUE=y +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_AUTHENC=y + +# +# Authenticated Encryption with Associated Data +# +CONFIG_CRYPTO_CCM=y +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_SEQIV=y + +# +# Block modes +# +CONFIG_CRYPTO_CBC=y +CONFIG_CRYPTO_CTR=y +# CONFIG_CRYPTO_CTS is not set +CONFIG_CRYPTO_ECB=y +CONFIG_CRYPTO_LRW=y +CONFIG_CRYPTO_PCBC=y +CONFIG_CRYPTO_XTS=y + +# +# Hash modes +# +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_XCBC=y +# CONFIG_CRYPTO_VMAC is not set + +# +# Digest +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_CRC32C_INTEL is not set +CONFIG_CRYPTO_GHASH=y +CONFIG_CRYPTO_MD4=y +CONFIG_CRYPTO_MD5=y +CONFIG_CRYPTO_MICHAEL_MIC=y +CONFIG_CRYPTO_RMD128=y +CONFIG_CRYPTO_RMD160=y +CONFIG_CRYPTO_RMD256=y +CONFIG_CRYPTO_RMD320=y +CONFIG_CRYPTO_SHA1=y +# CONFIG_CRYPTO_SHA1_SSSE3 is not set +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y +CONFIG_CRYPTO_TGR192=y +CONFIG_CRYPTO_WP512=y +# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set + +# +# Ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_X86_64 is not set +# CONFIG_CRYPTO_AES_NI_INTEL is not set +CONFIG_CRYPTO_ANUBIS=y +CONFIG_CRYPTO_ARC4=y +CONFIG_CRYPTO_BLOWFISH=y +CONFIG_CRYPTO_BLOWFISH_COMMON=y +# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set +CONFIG_CRYPTO_CAMELLIA=y +# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set +CONFIG_CRYPTO_CAST5=y +CONFIG_CRYPTO_CAST6=y +CONFIG_CRYPTO_DES=y +CONFIG_CRYPTO_FCRYPT=y +CONFIG_CRYPTO_KHAZAD=y +CONFIG_CRYPTO_SALSA20=y +# CONFIG_CRYPTO_SALSA20_X86_64 is not set +CONFIG_CRYPTO_SEED=y +CONFIG_CRYPTO_SERPENT=y +# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set +CONFIG_CRYPTO_TEA=y +CONFIG_CRYPTO_TWOFISH=y +CONFIG_CRYPTO_TWOFISH_COMMON=y +# CONFIG_CRYPTO_TWOFISH_X86_64 is not set +# CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_ZLIB=y +# CONFIG_CRYPTO_LZO is not set + +# +# Random Number Generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y +# CONFIG_CRYPTO_HW is not set +CONFIG_HAVE_KVM=y +CONFIG_VIRTUALIZATION=y +# CONFIG_KVM is not set +# CONFIG_VHOST_NET is not set +# CONFIG_BINARY_PRINTF is not set + +# +# Library routines +# +CONFIG_BITREVERSE=y +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +CONFIG_GENERIC_FIND_FIRST_BIT=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IOMAP=y +CONFIG_GENERIC_IO=y +CONFIG_CRC_CCITT=y +CONFIG_CRC16=y +# CONFIG_CRC_T10DIF is not set +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +CONFIG_CRC7=y +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +# CONFIG_XZ_DEC is not set +# CONFIG_XZ_DEC_BCJ is not set +CONFIG_TEXTSEARCH=y +CONFIG_TEXTSEARCH_KMP=y +CONFIG_TEXTSEARCH_BM=y +CONFIG_TEXTSEARCH_FSM=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT=y +CONFIG_HAS_DMA=y +CONFIG_DQL=y +CONFIG_NLATTR=y +# CONFIG_AVERAGE is not set +# CONFIG_CORDIC is not set +# CONFIG_DDR is not set diff --git a/testing/config/kernel/config-3.6 b/testing/config/kernel/config-3.6 new file mode 100644 index 000000000..8755bf772 --- /dev/null +++ b/testing/config/kernel/config-3.6 @@ -0,0 +1,1830 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/x86_64 3.6.11 Kernel Configuration +# +CONFIG_64BIT=y +# CONFIG_X86_32 is not set +CONFIG_X86_64=y +CONFIG_X86=y +CONFIG_INSTRUCTION_DECODER=y +CONFIG_OUTPUT_FORMAT="elf64-x86-64" +CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig" +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_HAVE_LATENCYTOP_SUPPORT=y +CONFIG_MMU=y +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_NEED_SG_DMA_LENGTH=y +CONFIG_GENERIC_ISA_DMA=y +CONFIG_GENERIC_BUG=y +CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_ARCH_MAY_HAVE_PC_FDC=y +# CONFIG_RWSEM_GENERIC_SPINLOCK is not set +CONFIG_RWSEM_XCHGADD_ALGORITHM=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HAS_DEFAULT_IDLE=y +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_ARCH_HAS_CPU_AUTOPROBE=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_ZONE_DMA32=y +CONFIG_AUDIT_ARCH=y +CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11" +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" +CONFIG_HAVE_IRQ_WORK=y +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_EXTABLE_SORT=y + +# +# General setup +# +CONFIG_EXPERIMENTAL=y +CONFIG_BROKEN_ON_SMP=y +CONFIG_INIT_ENV_ARG_LIMIT=32 +CONFIG_CROSS_COMPILE="" +CONFIG_LOCALVERSION="" +CONFIG_LOCALVERSION_AUTO=y +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_BZIP2=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_BZIP2 is not set +# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_XZ is not set +# CONFIG_KERNEL_LZO is not set +CONFIG_DEFAULT_HOSTNAME="(none)" +CONFIG_SWAP=y +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y +CONFIG_BSD_PROCESS_ACCT=y +# CONFIG_BSD_PROCESS_ACCT_V3 is not set +# CONFIG_FHANDLE is not set +# CONFIG_TASKSTATS is not set +# CONFIG_AUDIT is not set +CONFIG_HAVE_GENERIC_HARDIRQS=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_HARDIRQS=y +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +CONFIG_CLOCKSOURCE_WATCHDOG=y +CONFIG_ARCH_CLOCKSOURCE_DATA=y +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_GENERIC_CLOCKEVENTS_BUILD=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CMOS_UPDATE=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y + +# +# RCU Subsystem +# +CONFIG_TINY_RCU=y +# CONFIG_PREEMPT_RCU is not set +# CONFIG_TREE_RCU_TRACE is not set +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_LOG_BUF_SHIFT=14 +CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y +# CONFIG_CGROUPS is not set +# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_NAMESPACES=y +# CONFIG_UTS_NS is not set +# CONFIG_IPC_NS is not set +# CONFIG_PID_NS is not set +# CONFIG_NET_NS is not set +# CONFIG_SCHED_AUTOGROUP is not set +# CONFIG_SYSFS_DEPRECATED is not set +# CONFIG_RELAY is not set +# CONFIG_BLK_DEV_INITRD is not set +CONFIG_CC_OPTIMIZE_FOR_SIZE=y +CONFIG_SYSCTL=y +CONFIG_ANON_INODES=y +# CONFIG_EXPERT is not set +# CONFIG_SYSCTL_SYSCALL is not set +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_ALL is not set +CONFIG_HOTPLUG=y +CONFIG_PRINTK=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_PCSPKR_PLATFORM=y +CONFIG_HAVE_PCSPKR_PLATFORM=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +CONFIG_VM_EVENT_COUNTERS=y +CONFIG_PCI_QUIRKS=y +CONFIG_COMPAT_BRK=y +CONFIG_SLAB=y +# CONFIG_SLUB is not set +# CONFIG_PROFILING is not set +CONFIG_HAVE_OPROFILE=y +CONFIG_OPROFILE_NMI_TIMER=y +# CONFIG_JUMP_LABEL is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_OPTPROBES=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_ATTRS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_DMA_API_DEBUG=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y +CONFIG_HAVE_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_PERF_EVENTS_NMI=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y + +# +# GCOV-based kernel profiling +# +# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set +CONFIG_SLABINFO=y +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +# CONFIG_MODULES is not set +CONFIG_BLOCK=y +# CONFIG_BLK_DEV_BSG is not set +# CONFIG_BLK_DEV_BSGLIB is not set +# CONFIG_BLK_DEV_INTEGRITY is not set + +# +# Partition Types +# +# CONFIG_PARTITION_ADVANCED is not set +CONFIG_MSDOS_PARTITION=y + +# +# IO Schedulers +# +CONFIG_IOSCHED_NOOP=y +CONFIG_IOSCHED_DEADLINE=y +CONFIG_IOSCHED_CFQ=y +# CONFIG_DEFAULT_DEADLINE is not set +CONFIG_DEFAULT_CFQ=y +# CONFIG_DEFAULT_NOOP is not set +CONFIG_DEFAULT_IOSCHED="cfq" +# CONFIG_INLINE_SPIN_TRYLOCK is not set +# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK is not set +# CONFIG_INLINE_SPIN_LOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK_IRQ is not set +# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set +# CONFIG_INLINE_SPIN_UNLOCK_BH is not set +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_READ_TRYLOCK is not set +# CONFIG_INLINE_READ_LOCK is not set +# CONFIG_INLINE_READ_LOCK_BH is not set +# CONFIG_INLINE_READ_LOCK_IRQ is not set +# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set +CONFIG_INLINE_READ_UNLOCK=y +# CONFIG_INLINE_READ_UNLOCK_BH is not set +CONFIG_INLINE_READ_UNLOCK_IRQ=y +# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_WRITE_TRYLOCK is not set +# CONFIG_INLINE_WRITE_LOCK is not set +# CONFIG_INLINE_WRITE_LOCK_BH is not set +# CONFIG_INLINE_WRITE_LOCK_IRQ is not set +# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set +CONFIG_INLINE_WRITE_UNLOCK=y +# CONFIG_INLINE_WRITE_UNLOCK_BH is not set +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set +# CONFIG_MUTEX_SPIN_ON_OWNER is not set +CONFIG_FREEZER=y + +# +# Processor type and features +# +CONFIG_ZONE_DMA=y +# CONFIG_SMP is not set +CONFIG_X86_MPPARSE=y +CONFIG_X86_EXTENDED_PLATFORM=y +CONFIG_SCHED_OMIT_FRAME_POINTER=y +CONFIG_PARAVIRT_GUEST=y +# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set +# CONFIG_XEN is not set +# CONFIG_XEN_PRIVILEGED_GUEST is not set +CONFIG_KVM_CLOCK=y +CONFIG_KVM_GUEST=y +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_CLOCK=y +# CONFIG_PARAVIRT_DEBUG is not set +CONFIG_NO_BOOTMEM=y +# CONFIG_MEMTEST is not set +# CONFIG_MK8 is not set +# CONFIG_MPSC is not set +CONFIG_MCORE2=y +# CONFIG_MATOM is not set +# CONFIG_GENERIC_CPU is not set +CONFIG_X86_INTERNODE_CACHE_SHIFT=6 +CONFIG_X86_CMPXCHG=y +CONFIG_X86_L1_CACHE_SHIFT=6 +CONFIG_X86_XADD=y +CONFIG_X86_WP_WORKS_OK=y +CONFIG_X86_INTEL_USERCOPY=y +CONFIG_X86_USE_PPRO_CHECKSUM=y +CONFIG_X86_P6_NOP=y +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=64 +CONFIG_X86_DEBUGCTLMSR=y +CONFIG_CPU_SUP_INTEL=y +CONFIG_CPU_SUP_AMD=y +CONFIG_CPU_SUP_CENTAUR=y +CONFIG_HPET_TIMER=y +CONFIG_DMI=y +CONFIG_GART_IOMMU=y +# CONFIG_CALGARY_IOMMU is not set +CONFIG_SWIOTLB=y +CONFIG_IOMMU_HELPER=y +CONFIG_NR_CPUS=1 +# CONFIG_IRQ_TIME_ACCOUNTING is not set +CONFIG_PREEMPT_NONE=y +# CONFIG_PREEMPT_VOLUNTARY is not set +# CONFIG_PREEMPT is not set +CONFIG_X86_LOCAL_APIC=y +CONFIG_X86_IO_APIC=y +# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set +# CONFIG_X86_MCE is not set +# CONFIG_I8K is not set +# CONFIG_MICROCODE is not set +# CONFIG_X86_MSR is not set +# CONFIG_X86_CPUID is not set +CONFIG_ARCH_PHYS_ADDR_T_64BIT=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +CONFIG_DIRECT_GBPAGES=y +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_DEFAULT=y +CONFIG_ARCH_SELECT_MEMORY_MODEL=y +CONFIG_ARCH_MEMORY_PROBE=y +CONFIG_ARCH_PROC_KCORE_TEXT=y +CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_SPARSEMEM_MANUAL=y +CONFIG_SPARSEMEM=y +CONFIG_HAVE_MEMORY_PRESENT=y +CONFIG_SPARSEMEM_EXTREME=y +CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y +CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y +CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_HAVE_MEMBLOCK=y +CONFIG_HAVE_MEMBLOCK_NODE_MAP=y +CONFIG_ARCH_DISCARD_MEMBLOCK=y +CONFIG_MEMORY_ISOLATION=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTPLUG_SPARSE=y +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_PAGEFLAGS_EXTENDED=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +# CONFIG_COMPACTION is not set +CONFIG_MIGRATION=y +CONFIG_PHYS_ADDR_T_64BIT=y +CONFIG_ZONE_DMA_FLAG=1 +CONFIG_BOUNCE=y +CONFIG_VIRT_TO_BUS=y +# CONFIG_KSM is not set +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +# CONFIG_TRANSPARENT_HUGEPAGE is not set +CONFIG_CROSS_MEMORY_ATTACH=y +CONFIG_NEED_PER_CPU_KM=y +# CONFIG_CLEANCACHE is not set +# CONFIG_FRONTSWAP is not set +# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set +CONFIG_X86_RESERVE_LOW=64 +CONFIG_MTRR=y +CONFIG_MTRR_SANITIZER=y +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 +CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 +CONFIG_X86_PAT=y +CONFIG_ARCH_USES_PG_UNCACHED=y +CONFIG_ARCH_RANDOM=y +# CONFIG_EFI is not set +CONFIG_SECCOMP=y +# CONFIG_CC_STACKPROTECTOR is not set +# CONFIG_HZ_100 is not set +CONFIG_HZ_250=y +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 +CONFIG_SCHED_HRTICK=y +# CONFIG_KEXEC is not set +# CONFIG_CRASH_DUMP is not set +CONFIG_PHYSICAL_START=0x1000000 +CONFIG_RELOCATABLE=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +# CONFIG_CMDLINE_BOOL is not set +CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y +CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y + +# +# Power management and ACPI options +# +CONFIG_SUSPEND=y +CONFIG_SUSPEND_FREEZER=y +# CONFIG_HIBERNATION is not set +CONFIG_PM_SLEEP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +# CONFIG_PM_RUNTIME is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_ACPI=y +CONFIG_ACPI_SLEEP=y +# CONFIG_ACPI_PROCFS is not set +# CONFIG_ACPI_PROCFS_POWER is not set +# CONFIG_ACPI_EC_DEBUGFS is not set +CONFIG_ACPI_PROC_EVENT=y +CONFIG_ACPI_AC=y +CONFIG_ACPI_BATTERY=y +CONFIG_ACPI_BUTTON=y +CONFIG_ACPI_FAN=y +# CONFIG_ACPI_DOCK is not set +CONFIG_ACPI_PROCESSOR=y +# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set +CONFIG_ACPI_THERMAL=y +# CONFIG_ACPI_CUSTOM_DSDT is not set +CONFIG_ACPI_BLACKLIST_YEAR=0 +# CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_PCI_SLOT is not set +CONFIG_X86_PM_TIMER=y +# CONFIG_ACPI_CONTAINER is not set +# CONFIG_ACPI_HOTPLUG_MEMORY is not set +# CONFIG_ACPI_SBS is not set +# CONFIG_ACPI_HED is not set +# CONFIG_ACPI_BGRT is not set +# CONFIG_ACPI_APEI is not set +# CONFIG_SFI is not set + +# +# CPU Frequency scaling +# +# CONFIG_CPU_FREQ is not set +CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_GOV_LADDER=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set +# CONFIG_INTEL_IDLE is not set + +# +# Memory power savings +# +# CONFIG_I7300_IDLE is not set + +# +# Bus options (PCI etc.) +# +CONFIG_PCI=y +CONFIG_PCI_DIRECT=y +# CONFIG_PCI_MMCONFIG is not set +CONFIG_PCI_DOMAINS=y +# CONFIG_PCI_CNB20LE_QUIRK is not set +# CONFIG_PCIEPORTBUS is not set +CONFIG_ARCH_SUPPORTS_MSI=y +CONFIG_PCI_MSI=y +# CONFIG_PCI_DEBUG is not set +# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set +# CONFIG_PCI_STUB is not set +CONFIG_HT_IRQ=y +# CONFIG_PCI_IOV is not set +# CONFIG_PCI_PRI is not set +# CONFIG_PCI_PASID is not set +# CONFIG_PCI_IOAPIC is not set +CONFIG_PCI_LABEL=y +CONFIG_ISA_DMA_API=y +CONFIG_AMD_NB=y +# CONFIG_PCCARD is not set +# CONFIG_HOTPLUG_PCI is not set +# CONFIG_RAPIDIO is not set + +# +# Executable file formats / Emulations +# +CONFIG_BINFMT_ELF=y +CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +# CONFIG_HAVE_AOUT is not set +# CONFIG_BINFMT_MISC is not set +# CONFIG_IA32_EMULATION is not set +# CONFIG_COMPAT_FOR_U64_ALIGNMENT is not set +CONFIG_HAVE_TEXT_POKE_SMP=y +CONFIG_X86_DEV_DMA_OPS=y +CONFIG_NET=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_UNIX=y +# CONFIG_UNIX_DIAG is not set +CONFIG_XFRM=y +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_USER=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_IPCOMP=y +CONFIG_NET_KEY=y +CONFIG_NET_KEY_MIGRATE=y +CONFIG_INET=y +# CONFIG_IP_MULTICAST is not set +CONFIG_IP_ADVANCED_ROUTER=y +# CONFIG_IP_FIB_TRIE_STATS is not set +CONFIG_IP_MULTIPLE_TABLES=y +# CONFIG_IP_ROUTE_MULTIPATH is not set +# CONFIG_IP_ROUTE_VERBOSE is not set +CONFIG_IP_ROUTE_CLASSID=y +# CONFIG_IP_PNP is not set +# CONFIG_NET_IPIP is not set +# CONFIG_NET_IPGRE_DEMUX is not set +# CONFIG_ARPD is not set +# CONFIG_SYN_COOKIES is not set +# CONFIG_NET_IPVTI is not set +CONFIG_INET_AH=y +CONFIG_INET_ESP=y +CONFIG_INET_IPCOMP=y +CONFIG_INET_XFRM_TUNNEL=y +CONFIG_INET_TUNNEL=y +CONFIG_INET_XFRM_MODE_TRANSPORT=y +CONFIG_INET_XFRM_MODE_TUNNEL=y +CONFIG_INET_XFRM_MODE_BEET=y +# CONFIG_INET_LRO is not set +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +# CONFIG_INET_UDP_DIAG is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +CONFIG_IPV6=y +# CONFIG_IPV6_PRIVACY is not set +# CONFIG_IPV6_ROUTER_PREF is not set +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_INET6_AH=y +CONFIG_INET6_ESP=y +CONFIG_INET6_IPCOMP=y +CONFIG_IPV6_MIP6=y +CONFIG_INET6_XFRM_TUNNEL=y +CONFIG_INET6_TUNNEL=y +CONFIG_INET6_XFRM_MODE_TRANSPORT=y +CONFIG_INET6_XFRM_MODE_TUNNEL=y +CONFIG_INET6_XFRM_MODE_BEET=y +# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set +# CONFIG_IPV6_SIT is not set +# CONFIG_IPV6_TUNNEL is not set +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_SUBTREES=y +# CONFIG_IPV6_MROUTE is not set +# CONFIG_NETWORK_SECMARK is not set +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +CONFIG_NETFILTER=y +# CONFIG_NETFILTER_DEBUG is not set +CONFIG_NETFILTER_ADVANCED=y + +# +# Core Netfilter Configuration +# +CONFIG_NETFILTER_NETLINK=y +# CONFIG_NETFILTER_NETLINK_ACCT is not set +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_CONNTRACK_MARK=y +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_EVENTS=y +# CONFIG_NF_CONNTRACK_TIMEOUT is not set +# CONFIG_NF_CONNTRACK_TIMESTAMP is not set +# CONFIG_NF_CT_PROTO_DCCP is not set +# CONFIG_NF_CT_PROTO_SCTP is not set +CONFIG_NF_CT_PROTO_UDPLITE=y +# CONFIG_NF_CONNTRACK_AMANDA is not set +# CONFIG_NF_CONNTRACK_FTP is not set +# CONFIG_NF_CONNTRACK_H323 is not set +# CONFIG_NF_CONNTRACK_IRC is not set +# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set +# CONFIG_NF_CONNTRACK_SNMP is not set +# CONFIG_NF_CONNTRACK_PPTP is not set +CONFIG_NF_CONNTRACK_SANE=y +# CONFIG_NF_CONNTRACK_SIP is not set +# CONFIG_NF_CONNTRACK_TFTP is not set +CONFIG_NF_CT_NETLINK=y +# CONFIG_NF_CT_NETLINK_TIMEOUT is not set +# CONFIG_NETFILTER_NETLINK_QUEUE_CT is not set +# CONFIG_NETFILTER_TPROXY is not set +CONFIG_NETFILTER_XTABLES=y + +# +# Xtables combined modules +# +CONFIG_NETFILTER_XT_MARK=y +CONFIG_NETFILTER_XT_CONNMARK=y +CONFIG_NETFILTER_XT_SET=y + +# +# Xtables targets +# +# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +# CONFIG_NETFILTER_XT_TARGET_CT is not set +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_HL=y +# CONFIG_NETFILTER_XT_TARGET_HMARK is not set +# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_NOTRACK=y +# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set +# CONFIG_NETFILTER_XT_TARGET_TEE is not set +CONFIG_NETFILTER_XT_TARGET_TRACE=y +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set + +# +# Xtables matches +# +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +# CONFIG_NETFILTER_XT_MATCH_CPU is not set +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ECN=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_HL=y +# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set +# CONFIG_NETFILTER_XT_MATCH_OSF is not set +# CONFIG_NETFILTER_XT_MATCH_OWNER is not set +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set +CONFIG_NETFILTER_XT_MATCH_REALM=y +# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +# CONFIG_NETFILTER_XT_MATCH_TIME is not set +CONFIG_NETFILTER_XT_MATCH_U32=y +CONFIG_IP_SET=y +CONFIG_IP_SET_MAX=256 +CONFIG_IP_SET_BITMAP_IP=y +CONFIG_IP_SET_BITMAP_IPMAC=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETPORT=y +# CONFIG_IP_SET_HASH_NETIFACE is not set +CONFIG_IP_SET_LIST_SET=y +# CONFIG_IP_VS is not set + +# +# IP: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_CONNTRACK_IPV4=y +CONFIG_NF_CONNTRACK_PROC_COMPAT=y +CONFIG_IP_NF_QUEUE=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +# CONFIG_IP_NF_MATCH_RPFILTER is not set +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_TARGET_REJECT=y +CONFIG_IP_NF_TARGET_ULOG=y +CONFIG_NF_NAT=y +CONFIG_NF_NAT_NEEDED=y +CONFIG_IP_NF_TARGET_MASQUERADE=y +CONFIG_IP_NF_TARGET_NETMAP=y +CONFIG_IP_NF_TARGET_REDIRECT=y +CONFIG_NF_NAT_PROTO_UDPLITE=y +# CONFIG_NF_NAT_FTP is not set +# CONFIG_NF_NAT_IRC is not set +# CONFIG_NF_NAT_TFTP is not set +# CONFIG_NF_NAT_AMANDA is not set +# CONFIG_NF_NAT_PPTP is not set +# CONFIG_NF_NAT_H323 is not set +# CONFIG_NF_NAT_SIP is not set +CONFIG_IP_NF_MANGLE=y +CONFIG_IP_NF_TARGET_CLUSTERIP=y +CONFIG_IP_NF_TARGET_ECN=y +CONFIG_IP_NF_TARGET_TTL=y +CONFIG_IP_NF_RAW=y +CONFIG_IP_NF_ARPTABLES=y +CONFIG_IP_NF_ARPFILTER=y +CONFIG_IP_NF_ARP_MANGLE=y + +# +# IPv6: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV6=y +CONFIG_NF_CONNTRACK_IPV6=y +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +# CONFIG_IP6_NF_MATCH_RPFILTER is not set +CONFIG_IP6_NF_MATCH_RT=y +CONFIG_IP6_NF_TARGET_HL=y +CONFIG_IP6_NF_FILTER=y +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_RAW=y +# CONFIG_IP_DCCP is not set +# CONFIG_IP_SCTP is not set +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +CONFIG_L2TP=y +# CONFIG_L2TP_V3 is not set +# CONFIG_BRIDGE is not set +# CONFIG_NET_DSA is not set +# CONFIG_VLAN_8021Q is not set +# CONFIG_DECNET is not set +# CONFIG_LLC2 is not set +# CONFIG_IPX is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_WAN_ROUTER is not set +# CONFIG_PHONET is not set +# CONFIG_IEEE802154 is not set +# CONFIG_NET_SCHED is not set +# CONFIG_DCB is not set +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +CONFIG_BQL=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_IRDA is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +CONFIG_FIB_RULES=y +CONFIG_WIRELESS=y +# CONFIG_CFG80211 is not set +# CONFIG_LIB80211 is not set + +# +# CFG80211 needs to be enabled for MAC80211 +# +# CONFIG_WIMAX is not set +# CONFIG_RFKILL is not set +CONFIG_NET_9P=y +CONFIG_NET_9P_VIRTIO=y +# CONFIG_NET_9P_DEBUG is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +CONFIG_HAVE_BPF_JIT=y + +# +# Device Drivers +# + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +# CONFIG_DEVTMPFS is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y +CONFIG_FW_LOADER=y +CONFIG_FIRMWARE_IN_KERNEL=y +CONFIG_EXTRA_FIRMWARE="" +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_SYS_HYPERVISOR is not set +# CONFIG_GENERIC_CPU_DEVICES is not set +# CONFIG_DMA_SHARED_BUFFER is not set +# CONFIG_CONNECTOR is not set +# CONFIG_MTD is not set +# CONFIG_PARPORT is not set +CONFIG_PNP=y +CONFIG_PNP_DEBUG_MESSAGES=y + +# +# Protocols +# +CONFIG_PNPACPI=y +CONFIG_BLK_DEV=y +# CONFIG_BLK_DEV_FD is not set +# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +# CONFIG_BLK_CPQ_DA is not set +# CONFIG_BLK_CPQ_CISS_DA is not set +# CONFIG_BLK_DEV_DAC960 is not set +# CONFIG_BLK_DEV_UMEM is not set +# CONFIG_BLK_DEV_COW_COMMON is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +# CONFIG_BLK_DEV_CRYPTOLOOP is not set + +# +# DRBD disabled because PROC_FS, INET or CONNECTOR not selected +# +CONFIG_BLK_DEV_NBD=y +# CONFIG_BLK_DEV_NVME is not set +# CONFIG_BLK_DEV_SX8 is not set +# CONFIG_BLK_DEV_RAM is not set +# CONFIG_CDROM_PKTCDVD is not set +# CONFIG_ATA_OVER_ETH is not set +CONFIG_VIRTIO_BLK=y +# CONFIG_BLK_DEV_HD is not set +# CONFIG_BLK_DEV_RBD is not set + +# +# Misc devices +# +# CONFIG_SENSORS_LIS3LV02D is not set +# CONFIG_IBM_ASM is not set +# CONFIG_PHANTOM is not set +# CONFIG_INTEL_MID_PTI is not set +# CONFIG_SGI_IOC4 is not set +# CONFIG_TIFM_CORE is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_HP_ILO is not set +# CONFIG_VMWARE_BALLOON is not set +# CONFIG_PCH_PHUB is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_93CX6 is not set +# CONFIG_CB710_CORE is not set + +# +# Texas Instruments shared transport line discipline +# + +# +# Altera FPGA firmware download module +# +CONFIG_HAVE_IDE=y +# CONFIG_IDE is not set + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +# CONFIG_SCSI is not set +# CONFIG_SCSI_DMA is not set +# CONFIG_SCSI_NETLINK is not set +# CONFIG_ATA is not set +# CONFIG_MD is not set +# CONFIG_FUSION is not set + +# +# IEEE 1394 (FireWire) support +# +# CONFIG_FIREWIRE is not set +# CONFIG_FIREWIRE_NOSY is not set +# CONFIG_I2O is not set +# CONFIG_MACINTOSH_DRIVERS is not set +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +CONFIG_DUMMY=y +# CONFIG_EQUALIZER is not set +# CONFIG_MII is not set +# CONFIG_NET_TEAM is not set +# CONFIG_MACVLAN is not set +# CONFIG_NETCONSOLE is not set +# CONFIG_NETPOLL is not set +# CONFIG_NET_POLL_CONTROLLER is not set +CONFIG_TUN=y +# CONFIG_VETH is not set +CONFIG_VIRTIO_NET=y +# CONFIG_ARCNET is not set + +# +# CAIF transport drivers +# +CONFIG_ETHERNET=y +CONFIG_NET_VENDOR_3COM=y +# CONFIG_VORTEX is not set +# CONFIG_TYPHOON is not set +CONFIG_NET_VENDOR_ADAPTEC=y +# CONFIG_ADAPTEC_STARFIRE is not set +CONFIG_NET_VENDOR_ALTEON=y +# CONFIG_ACENIC is not set +CONFIG_NET_VENDOR_AMD=y +# CONFIG_AMD8111_ETH is not set +# CONFIG_PCNET32 is not set +CONFIG_NET_VENDOR_ATHEROS=y +# CONFIG_ATL2 is not set +# CONFIG_ATL1 is not set +# CONFIG_ATL1E is not set +# CONFIG_ATL1C is not set +CONFIG_NET_VENDOR_BROADCOM=y +# CONFIG_B44 is not set +# CONFIG_BNX2 is not set +# CONFIG_CNIC is not set +# CONFIG_TIGON3 is not set +# CONFIG_BNX2X is not set +CONFIG_NET_VENDOR_BROCADE=y +# CONFIG_BNA is not set +# CONFIG_NET_CALXEDA_XGMAC is not set +CONFIG_NET_VENDOR_CHELSIO=y +# CONFIG_CHELSIO_T1 is not set +# CONFIG_CHELSIO_T3 is not set +# CONFIG_CHELSIO_T4 is not set +# CONFIG_CHELSIO_T4VF is not set +CONFIG_NET_VENDOR_CISCO=y +# CONFIG_ENIC is not set +# CONFIG_DNET is not set +CONFIG_NET_VENDOR_DEC=y +# CONFIG_NET_TULIP is not set +CONFIG_NET_VENDOR_DLINK=y +# CONFIG_DL2K is not set +# CONFIG_SUNDANCE is not set +CONFIG_NET_VENDOR_EMULEX=y +# CONFIG_BE2NET is not set +CONFIG_NET_VENDOR_EXAR=y +# CONFIG_S2IO is not set +# CONFIG_VXGE is not set +CONFIG_NET_VENDOR_HP=y +# CONFIG_HP100 is not set +CONFIG_NET_VENDOR_INTEL=y +# CONFIG_E100 is not set +# CONFIG_E1000 is not set +# CONFIG_E1000E is not set +# CONFIG_IGB is not set +# CONFIG_IGBVF is not set +# CONFIG_IXGB is not set +# CONFIG_IXGBE is not set +# CONFIG_IXGBEVF is not set +CONFIG_NET_VENDOR_I825XX=y +# CONFIG_ZNET is not set +# CONFIG_IP1000 is not set +# CONFIG_JME is not set +CONFIG_NET_VENDOR_MARVELL=y +# CONFIG_SKGE is not set +# CONFIG_SKY2 is not set +CONFIG_NET_VENDOR_MELLANOX=y +# CONFIG_MLX4_EN is not set +# CONFIG_MLX4_CORE is not set +CONFIG_NET_VENDOR_MICREL=y +# CONFIG_KS8851_MLL is not set +# CONFIG_KSZ884X_PCI is not set +CONFIG_NET_VENDOR_MYRI=y +# CONFIG_MYRI10GE is not set +# CONFIG_FEALNX is not set +CONFIG_NET_VENDOR_NATSEMI=y +# CONFIG_NATSEMI is not set +# CONFIG_NS83820 is not set +CONFIG_NET_VENDOR_8390=y +# CONFIG_NE2K_PCI is not set +CONFIG_NET_VENDOR_NVIDIA=y +# CONFIG_FORCEDETH is not set +CONFIG_NET_VENDOR_OKI=y +# CONFIG_PCH_GBE is not set +# CONFIG_ETHOC is not set +CONFIG_NET_PACKET_ENGINE=y +# CONFIG_HAMACHI is not set +# CONFIG_YELLOWFIN is not set +CONFIG_NET_VENDOR_QLOGIC=y +# CONFIG_QLA3XXX is not set +# CONFIG_QLCNIC is not set +# CONFIG_QLGE is not set +# CONFIG_NETXEN_NIC is not set +CONFIG_NET_VENDOR_REALTEK=y +# CONFIG_8139CP is not set +# CONFIG_8139TOO is not set +# CONFIG_R8169 is not set +CONFIG_NET_VENDOR_RDC=y +# CONFIG_R6040 is not set +CONFIG_NET_VENDOR_SEEQ=y +# CONFIG_SEEQ8005 is not set +CONFIG_NET_VENDOR_SILAN=y +# CONFIG_SC92031 is not set +CONFIG_NET_VENDOR_SIS=y +# CONFIG_SIS900 is not set +# CONFIG_SIS190 is not set +# CONFIG_SFC is not set +CONFIG_NET_VENDOR_SMSC=y +# CONFIG_EPIC100 is not set +# CONFIG_SMSC9420 is not set +CONFIG_NET_VENDOR_STMICRO=y +# CONFIG_STMMAC_ETH is not set +CONFIG_NET_VENDOR_SUN=y +# CONFIG_HAPPYMEAL is not set +# CONFIG_SUNGEM is not set +# CONFIG_CASSINI is not set +# CONFIG_NIU is not set +CONFIG_NET_VENDOR_TEHUTI=y +# CONFIG_TEHUTI is not set +CONFIG_NET_VENDOR_TI=y +# CONFIG_TLAN is not set +CONFIG_NET_VENDOR_VIA=y +# CONFIG_VIA_RHINE is not set +# CONFIG_VIA_VELOCITY is not set +CONFIG_NET_VENDOR_WIZNET=y +# CONFIG_WIZNET_W5100 is not set +# CONFIG_WIZNET_W5300 is not set +# CONFIG_FDDI is not set +# CONFIG_HIPPI is not set +# CONFIG_NET_SB1000 is not set +# CONFIG_PHYLIB is not set +# CONFIG_PPP is not set +# CONFIG_SLIP is not set +CONFIG_WLAN=y +# CONFIG_AIRO is not set +# CONFIG_ATMEL is not set +# CONFIG_PRISM54 is not set +# CONFIG_HOSTAP is not set +# CONFIG_WL_TI is not set + +# +# Enable WiMAX (Networking options) to see the WiMAX drivers +# +# CONFIG_WAN is not set +# CONFIG_VMXNET3 is not set +# CONFIG_ISDN is not set + +# +# Input device support +# +CONFIG_INPUT=y +# CONFIG_INPUT_FF_MEMLESS is not set +# CONFIG_INPUT_POLLDEV is not set +# CONFIG_INPUT_SPARSEKMAP is not set +# CONFIG_INPUT_MATRIXKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_MOUSEDEV_PSAUX=y +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +# CONFIG_INPUT_JOYDEV is not set +# CONFIG_INPUT_EVDEV is not set +# CONFIG_INPUT_EVBUG is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +CONFIG_KEYBOARD_ATKBD=y +# CONFIG_KEYBOARD_LKKBD is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_OMAP4 is not set +# CONFIG_KEYBOARD_XTKBD is not set +CONFIG_INPUT_MOUSE=y +CONFIG_MOUSE_PS2=y +CONFIG_MOUSE_PS2_ALPS=y +CONFIG_MOUSE_PS2_LOGIPS2PP=y +CONFIG_MOUSE_PS2_SYNAPTICS=y +CONFIG_MOUSE_PS2_LIFEBOOK=y +CONFIG_MOUSE_PS2_TRACKPOINT=y +# CONFIG_MOUSE_PS2_ELANTECH is not set +# CONFIG_MOUSE_PS2_SENTELIC is not set +# CONFIG_MOUSE_PS2_TOUCHKIT is not set +# CONFIG_MOUSE_SERIAL is not set +# CONFIG_MOUSE_APPLETOUCH is not set +# CONFIG_MOUSE_BCM5974 is not set +# CONFIG_MOUSE_VSXXXAA is not set +# CONFIG_MOUSE_SYNAPTICS_USB is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +# CONFIG_INPUT_TOUCHSCREEN is not set +# CONFIG_INPUT_MISC is not set + +# +# Hardware I/O ports +# +CONFIG_SERIO=y +CONFIG_SERIO_I8042=y +CONFIG_SERIO_SERPORT=y +# CONFIG_SERIO_CT82C710 is not set +# CONFIG_SERIO_PCIPS2 is not set +CONFIG_SERIO_LIBPS2=y +# CONFIG_SERIO_RAW is not set +# CONFIG_SERIO_ALTERA_PS2 is not set +# CONFIG_SERIO_PS2MULT is not set +# CONFIG_GAMEPORT is not set + +# +# Character devices +# +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_VT_CONSOLE_SLEEP=y +CONFIG_HW_CONSOLE=y +# CONFIG_VT_HW_CONSOLE_BINDING is not set +CONFIG_UNIX98_PTYS=y +# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set +CONFIG_LEGACY_PTYS=y +CONFIG_LEGACY_PTY_COUNT=256 +# CONFIG_SERIAL_NONSTANDARD is not set +# CONFIG_NOZOMI is not set +# CONFIG_N_GSM is not set +# CONFIG_TRACE_SINK is not set +CONFIG_DEVKMEM=y + +# +# Serial drivers +# +# CONFIG_SERIAL_8250 is not set +CONFIG_FIX_EARLYCON_MEM=y + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_MFD_HSU is not set +# CONFIG_SERIAL_JSM is not set +# CONFIG_SERIAL_TIMBERDALE is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +# CONFIG_SERIAL_PCH_UART is not set +# CONFIG_SERIAL_XILINX_PS_UART is not set +CONFIG_HVC_DRIVER=y +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_IPMI_HANDLER is not set +# CONFIG_HW_RANDOM is not set +# CONFIG_NVRAM is not set +# CONFIG_RTC is not set +# CONFIG_GEN_RTC is not set +# CONFIG_R3964 is not set +# CONFIG_APPLICOM is not set +# CONFIG_MWAVE is not set +# CONFIG_RAW_DRIVER is not set +# CONFIG_HPET is not set +# CONFIG_HANGCHECK_TIMER is not set +# CONFIG_TCG_TPM is not set +# CONFIG_TELCLOCK is not set +CONFIG_DEVPORT=y +# CONFIG_I2C is not set +# CONFIG_SPI is not set +# CONFIG_HSI is not set + +# +# PPS support +# +# CONFIG_PPS is not set + +# +# PPS generators support +# + +# +# PTP clock support +# + +# +# Enable Device Drivers -> PPS to see the PTP clock options. +# +CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y +# CONFIG_GPIOLIB is not set +# CONFIG_W1 is not set +CONFIG_POWER_SUPPLY=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_PDA_POWER is not set +# CONFIG_TEST_POWER is not set +# CONFIG_BATTERY_DS2780 is not set +# CONFIG_BATTERY_DS2781 is not set +# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_CHARGER_MAX8903 is not set +# CONFIG_POWER_AVS is not set +CONFIG_HWMON=y +# CONFIG_HWMON_VID is not set +# CONFIG_HWMON_DEBUG_CHIP is not set + +# +# Native drivers +# +# CONFIG_SENSORS_ABITUGURU is not set +# CONFIG_SENSORS_ABITUGURU3 is not set +# CONFIG_SENSORS_K8TEMP is not set +# CONFIG_SENSORS_K10TEMP is not set +# CONFIG_SENSORS_FAM15H_POWER is not set +# CONFIG_SENSORS_I5K_AMB is not set +# CONFIG_SENSORS_F71805F is not set +# CONFIG_SENSORS_F71882FG is not set +# CONFIG_SENSORS_CORETEMP is not set +# CONFIG_SENSORS_IT87 is not set +# CONFIG_SENSORS_NTC_THERMISTOR is not set +# CONFIG_SENSORS_PC87360 is not set +# CONFIG_SENSORS_PC87427 is not set +# CONFIG_SENSORS_SIS5595 is not set +# CONFIG_SENSORS_SMSC47M1 is not set +# CONFIG_SENSORS_SMSC47B397 is not set +# CONFIG_SENSORS_SCH56XX_COMMON is not set +# CONFIG_SENSORS_VIA_CPUTEMP is not set +# CONFIG_SENSORS_VIA686A is not set +# CONFIG_SENSORS_VT1211 is not set +# CONFIG_SENSORS_VT8231 is not set +# CONFIG_SENSORS_W83627HF is not set +# CONFIG_SENSORS_W83627EHF is not set +# CONFIG_SENSORS_APPLESMC is not set + +# +# ACPI drivers +# +# CONFIG_SENSORS_ACPI_POWER is not set +# CONFIG_SENSORS_ATK0110 is not set +CONFIG_THERMAL=y +CONFIG_THERMAL_HWMON=y +# CONFIG_WATCHDOG is not set +CONFIG_SSB_POSSIBLE=y + +# +# Sonics Silicon Backplane +# +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y + +# +# Broadcom specific AMBA +# +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_CORE is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_MFD_TMIO is not set +# CONFIG_ABX500_CORE is not set +# CONFIG_MFD_CS5535 is not set +# CONFIG_LPC_SCH is not set +# CONFIG_LPC_ICH is not set +# CONFIG_MFD_RDC321X is not set +# CONFIG_MFD_JANZ_CMODIO is not set +# CONFIG_MFD_VX855 is not set +# CONFIG_REGULATOR is not set +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +# CONFIG_AGP is not set +CONFIG_VGA_ARB=y +CONFIG_VGA_ARB_MAX_GPUS=16 +# CONFIG_VGA_SWITCHEROO is not set +# CONFIG_DRM is not set +# CONFIG_STUB_POULSBO is not set +# CONFIG_VGASTATE is not set +# CONFIG_VIDEO_OUTPUT_CONTROL is not set +# CONFIG_FB is not set +# CONFIG_EXYNOS_VIDEO is not set +# CONFIG_BACKLIGHT_LCD_SUPPORT is not set + +# +# Console display driver support +# +CONFIG_VGA_CONSOLE=y +# CONFIG_VGACON_SOFT_SCROLLBACK is not set +CONFIG_DUMMY_CONSOLE=y +CONFIG_SOUND=y +# CONFIG_SOUND_OSS_CORE is not set +# CONFIG_SND is not set +# CONFIG_SOUND_PRIME is not set + +# +# HID support +# +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +# CONFIG_HIDRAW is not set +# CONFIG_UHID is not set +CONFIG_HID_GENERIC=y + +# +# Special HID drivers +# +CONFIG_USB_ARCH_HAS_OHCI=y +CONFIG_USB_ARCH_HAS_EHCI=y +CONFIG_USB_ARCH_HAS_XHCI=y +CONFIG_USB_SUPPORT=y +CONFIG_USB_ARCH_HAS_HCD=y +# CONFIG_USB is not set + +# +# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may +# +# CONFIG_USB_GADGET is not set + +# +# OTG and related infrastructure +# +# CONFIG_UWB is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_INFINIBAND is not set +# CONFIG_EDAC is not set +# CONFIG_RTC_CLASS is not set +# CONFIG_DMADEVICES is not set +# CONFIG_AUXDISPLAY is not set +# CONFIG_UIO is not set +CONFIG_VIRTIO=y +CONFIG_VIRTIO_RING=y + +# +# Virtio drivers +# +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_BALLOON=y +CONFIG_VIRTIO_MMIO=y +# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set + +# +# Microsoft Hyper-V guest support +# +# CONFIG_HYPERV is not set +# CONFIG_STAGING is not set +CONFIG_X86_PLATFORM_DEVICES=y +# CONFIG_ACERHDF is not set +# CONFIG_ASUS_LAPTOP is not set +# CONFIG_FUJITSU_TABLET is not set +# CONFIG_HP_ACCEL is not set +# CONFIG_THINKPAD_ACPI is not set +# CONFIG_SENSORS_HDAPS is not set +# CONFIG_INTEL_MENLOW is not set +# CONFIG_ACPI_WMI is not set +# CONFIG_TOPSTAR_LAPTOP is not set +# CONFIG_TOSHIBA_BT_RFKILL is not set +# CONFIG_ACPI_CMPC is not set +# CONFIG_INTEL_IPS is not set +# CONFIG_IBM_RTL is not set +# CONFIG_XO15_EBOOK is not set +# CONFIG_SAMSUNG_Q10 is not set + +# +# Hardware Spinlock drivers +# +CONFIG_CLKEVT_I8253=y +CONFIG_I8253_LOCK=y +CONFIG_CLKBLD_I8253=y +CONFIG_IOMMU_SUPPORT=y +# CONFIG_AMD_IOMMU is not set +# CONFIG_INTEL_IOMMU is not set +# CONFIG_IRQ_REMAP is not set + +# +# Remoteproc drivers (EXPERIMENTAL) +# + +# +# Rpmsg drivers (EXPERIMENTAL) +# +# CONFIG_VIRT_DRIVERS is not set +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_VME_BUS is not set +# CONFIG_PWM is not set + +# +# Firmware Drivers +# +# CONFIG_EDD is not set +CONFIG_FIRMWARE_MEMMAP=y +# CONFIG_DELL_RBU is not set +# CONFIG_DCDBAS is not set +CONFIG_DMIID=y +# CONFIG_DMI_SYSFS is not set +# CONFIG_ISCSI_IBFT_FIND is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +CONFIG_EXT2_FS=y +# CONFIG_EXT2_FS_XATTR is not set +# CONFIG_EXT2_FS_XIP is not set +CONFIG_EXT3_FS=y +# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set +# CONFIG_EXT3_FS_XATTR is not set +# CONFIG_EXT4_FS is not set +CONFIG_JBD=y +CONFIG_REISERFS_FS=y +# CONFIG_REISERFS_CHECK is not set +# CONFIG_REISERFS_PROC_INFO is not set +# CONFIG_REISERFS_FS_XATTR is not set +# CONFIG_JFS_FS is not set +# CONFIG_XFS_FS is not set +# CONFIG_GFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +CONFIG_FS_POSIX_ACL=y +CONFIG_FILE_LOCKING=y +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +# CONFIG_FANOTIFY is not set +CONFIG_QUOTA=y +# CONFIG_QUOTA_NETLINK_INTERFACE is not set +CONFIG_PRINT_QUOTA_WARNING=y +# CONFIG_QUOTA_DEBUG is not set +# CONFIG_QFMT_V1 is not set +# CONFIG_QFMT_V2 is not set +CONFIG_QUOTACTL=y +CONFIG_AUTOFS4_FS=y +# CONFIG_FUSE_FS is not set + +# +# Caches +# +# CONFIG_FSCACHE is not set + +# +# CD-ROM/DVD Filesystems +# +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +# CONFIG_ZISOFS is not set +# CONFIG_UDF_FS is not set + +# +# DOS/FAT/NT Filesystems +# +# CONFIG_MSDOS_FS is not set +# CONFIG_VFAT_FS is not set +# CONFIG_NTFS_FS is not set + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +# CONFIG_TMPFS_POSIX_ACL is not set +# CONFIG_TMPFS_XATTR is not set +# CONFIG_HUGETLBFS is not set +# CONFIG_HUGETLB_PAGE is not set +# CONFIG_CONFIGFS_FS is not set +CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ADFS_FS is not set +# CONFIG_AFFS_FS is not set +# CONFIG_HFS_FS is not set +# CONFIG_HFSPLUS_FS is not set +# CONFIG_BEFS_FS is not set +# CONFIG_BFS_FS is not set +# CONFIG_EFS_FS is not set +# CONFIG_LOGFS is not set +# CONFIG_CRAMFS is not set +# CONFIG_SQUASHFS is not set +# CONFIG_VXFS_FS is not set +# CONFIG_MINIX_FS is not set +# CONFIG_OMFS_FS is not set +# CONFIG_HPFS_FS is not set +# CONFIG_QNX4FS_FS is not set +# CONFIG_QNX6FS_FS is not set +# CONFIG_ROMFS_FS is not set +# CONFIG_PSTORE is not set +# CONFIG_SYSV_FS is not set +# CONFIG_UFS_FS is not set +CONFIG_NETWORK_FILESYSTEMS=y +# CONFIG_NFS_FS is not set +# CONFIG_NFSD is not set +# CONFIG_CEPH_FS is not set +# CONFIG_CIFS is not set +# CONFIG_NCP_FS is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_9P_FS=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="iso8859-1" +# CONFIG_NLS_CODEPAGE_437 is not set +# CONFIG_NLS_CODEPAGE_737 is not set +# CONFIG_NLS_CODEPAGE_775 is not set +# CONFIG_NLS_CODEPAGE_850 is not set +# CONFIG_NLS_CODEPAGE_852 is not set +# CONFIG_NLS_CODEPAGE_855 is not set +# CONFIG_NLS_CODEPAGE_857 is not set +# CONFIG_NLS_CODEPAGE_860 is not set +# CONFIG_NLS_CODEPAGE_861 is not set +# CONFIG_NLS_CODEPAGE_862 is not set +# CONFIG_NLS_CODEPAGE_863 is not set +# CONFIG_NLS_CODEPAGE_864 is not set +# CONFIG_NLS_CODEPAGE_865 is not set +# CONFIG_NLS_CODEPAGE_866 is not set +# CONFIG_NLS_CODEPAGE_869 is not set +# CONFIG_NLS_CODEPAGE_936 is not set +# CONFIG_NLS_CODEPAGE_950 is not set +# CONFIG_NLS_CODEPAGE_932 is not set +# CONFIG_NLS_CODEPAGE_949 is not set +# CONFIG_NLS_CODEPAGE_874 is not set +# CONFIG_NLS_ISO8859_8 is not set +# CONFIG_NLS_CODEPAGE_1250 is not set +# CONFIG_NLS_CODEPAGE_1251 is not set +# CONFIG_NLS_ASCII is not set +# CONFIG_NLS_ISO8859_1 is not set +# CONFIG_NLS_ISO8859_2 is not set +# CONFIG_NLS_ISO8859_3 is not set +# CONFIG_NLS_ISO8859_4 is not set +# CONFIG_NLS_ISO8859_5 is not set +# CONFIG_NLS_ISO8859_6 is not set +# CONFIG_NLS_ISO8859_7 is not set +# CONFIG_NLS_ISO8859_9 is not set +# CONFIG_NLS_ISO8859_13 is not set +# CONFIG_NLS_ISO8859_14 is not set +# CONFIG_NLS_ISO8859_15 is not set +# CONFIG_NLS_KOI8_R is not set +# CONFIG_NLS_KOI8_U is not set +# CONFIG_NLS_MAC_ROMAN is not set +# CONFIG_NLS_MAC_CELTIC is not set +# CONFIG_NLS_MAC_CENTEURO is not set +# CONFIG_NLS_MAC_CROATIAN is not set +# CONFIG_NLS_MAC_CYRILLIC is not set +# CONFIG_NLS_MAC_GAELIC is not set +# CONFIG_NLS_MAC_GREEK is not set +# CONFIG_NLS_MAC_ICELAND is not set +# CONFIG_NLS_MAC_INUIT is not set +# CONFIG_NLS_MAC_ROMANIAN is not set +# CONFIG_NLS_MAC_TURKISH is not set +# CONFIG_NLS_UTF8 is not set + +# +# Kernel hacking +# +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +# CONFIG_PRINTK_TIME is not set +CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4 +CONFIG_ENABLE_WARN_DEPRECATED=y +CONFIG_ENABLE_MUST_CHECK=y +CONFIG_FRAME_WARN=1024 +# CONFIG_MAGIC_SYSRQ is not set +# CONFIG_STRIP_ASM_SYMS is not set +# CONFIG_READABLE_ASM is not set +# CONFIG_UNUSED_SYMBOLS is not set +# CONFIG_DEBUG_FS is not set +# CONFIG_HEADERS_CHECK is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_DEBUG_KERNEL=y +# CONFIG_DEBUG_SHIRQ is not set +# CONFIG_LOCKUP_DETECTOR is not set +# CONFIG_HARDLOCKUP_DETECTOR is not set +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 +# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set +CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 +# CONFIG_SCHED_DEBUG is not set +# CONFIG_SCHEDSTATS is not set +# CONFIG_TIMER_STATS is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_DEBUG_SLAB is not set +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_RT_MUTEX_TESTER is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_PROVE_LOCKING is not set +# CONFIG_SPARSE_RCU_POINTER is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_DEBUG_KOBJECT is not set +CONFIG_DEBUG_BUGVERBOSE=y +CONFIG_DEBUG_INFO=y +# CONFIG_DEBUG_INFO_REDUCED is not set +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_VIRTUAL is not set +# CONFIG_DEBUG_WRITECOUNT is not set +CONFIG_DEBUG_MEMORY_INIT=y +# CONFIG_DEBUG_LIST is not set +# CONFIG_TEST_LIST_SORT is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +# CONFIG_DEBUG_CREDENTIALS is not set +CONFIG_ARCH_WANT_FRAME_POINTERS=y +CONFIG_FRAME_POINTER=y +# CONFIG_BOOT_PRINTK_DELAY is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_TRACE is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# CONFIG_NOTIFIER_ERROR_INJECTION is not set +# CONFIG_FAULT_INJECTION is not set +# CONFIG_LATENCYTOP is not set +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_USER_STACKTRACE_SUPPORT=y +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y +CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACING_SUPPORT=y +CONFIG_FTRACE=y +# CONFIG_FUNCTION_TRACER is not set +# CONFIG_IRQSOFF_TRACER is not set +# CONFIG_SCHED_TRACER is not set +# CONFIG_ENABLE_DEFAULT_TRACERS is not set +# CONFIG_FTRACE_SYSCALLS is not set +CONFIG_BRANCH_PROFILE_NONE=y +# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set +# CONFIG_PROFILE_ALL_BRANCHES is not set +# CONFIG_STACK_TRACER is not set +# CONFIG_BLK_DEV_IO_TRACE is not set +# CONFIG_UPROBE_EVENT is not set +# CONFIG_PROBE_EVENTS is not set +# CONFIG_MMIOTRACE is not set +# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_SAMPLES is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_HAVE_ARCH_KMEMCHECK=y +# CONFIG_TEST_KSTRTOX is not set +# CONFIG_STRICT_DEVMEM is not set +CONFIG_X86_VERBOSE_BOOTUP=y +CONFIG_EARLY_PRINTK=y +# CONFIG_EARLY_PRINTK_DBGP is not set +# CONFIG_DEBUG_STACKOVERFLOW is not set +# CONFIG_X86_PTDUMP is not set +CONFIG_DEBUG_RODATA=y +CONFIG_DEBUG_RODATA_TEST=y +# CONFIG_DEBUG_TLBFLUSH is not set +# CONFIG_IOMMU_DEBUG is not set +# CONFIG_IOMMU_STRESS is not set +CONFIG_HAVE_MMIOTRACE_SUPPORT=y +CONFIG_IO_DELAY_TYPE_0X80=0 +CONFIG_IO_DELAY_TYPE_0XED=1 +CONFIG_IO_DELAY_TYPE_UDELAY=2 +CONFIG_IO_DELAY_TYPE_NONE=3 +CONFIG_IO_DELAY_0X80=y +# CONFIG_IO_DELAY_0XED is not set +# CONFIG_IO_DELAY_UDELAY is not set +# CONFIG_IO_DELAY_NONE is not set +CONFIG_DEFAULT_IO_DELAY_TYPE=0 +# CONFIG_CPA_DEBUG is not set +# CONFIG_OPTIMIZE_INLINING is not set +# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set +# CONFIG_DEBUG_NMI_SELFTEST is not set + +# +# Security options +# +# CONFIG_KEYS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +# CONFIG_SECURITYFS is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_DEFAULT_SECURITY="" +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_BLKCIPHER=y +CONFIG_CRYPTO_BLKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_PCOMP=y +CONFIG_CRYPTO_PCOMP2=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +CONFIG_CRYPTO_USER=y +CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +CONFIG_CRYPTO_GF128MUL=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_WORKQUEUE=y +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_AUTHENC=y +CONFIG_CRYPTO_ABLK_HELPER_X86=y +CONFIG_CRYPTO_GLUE_HELPER_X86=y + +# +# Authenticated Encryption with Associated Data +# +CONFIG_CRYPTO_CCM=y +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_SEQIV=y + +# +# Block modes +# +CONFIG_CRYPTO_CBC=y +CONFIG_CRYPTO_CTR=y +# CONFIG_CRYPTO_CTS is not set +CONFIG_CRYPTO_ECB=y +CONFIG_CRYPTO_LRW=y +CONFIG_CRYPTO_PCBC=y +CONFIG_CRYPTO_XTS=y + +# +# Hash modes +# +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_XCBC=y +# CONFIG_CRYPTO_VMAC is not set + +# +# Digest +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_CRC32C_INTEL is not set +CONFIG_CRYPTO_GHASH=y +CONFIG_CRYPTO_MD4=y +CONFIG_CRYPTO_MD5=y +CONFIG_CRYPTO_MICHAEL_MIC=y +CONFIG_CRYPTO_RMD128=y +CONFIG_CRYPTO_RMD160=y +CONFIG_CRYPTO_RMD256=y +CONFIG_CRYPTO_RMD320=y +CONFIG_CRYPTO_SHA1=y +# CONFIG_CRYPTO_SHA1_SSSE3 is not set +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y +CONFIG_CRYPTO_TGR192=y +CONFIG_CRYPTO_WP512=y +# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set + +# +# Ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_X86_64 is not set +# CONFIG_CRYPTO_AES_NI_INTEL is not set +CONFIG_CRYPTO_ANUBIS=y +CONFIG_CRYPTO_ARC4=y +CONFIG_CRYPTO_BLOWFISH=y +CONFIG_CRYPTO_BLOWFISH_COMMON=y +# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set +CONFIG_CRYPTO_CAMELLIA=y +# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set +CONFIG_CRYPTO_CAST5=y +CONFIG_CRYPTO_CAST6=y +CONFIG_CRYPTO_DES=y +CONFIG_CRYPTO_FCRYPT=y +CONFIG_CRYPTO_KHAZAD=y +CONFIG_CRYPTO_SALSA20=y +# CONFIG_CRYPTO_SALSA20_X86_64 is not set +CONFIG_CRYPTO_SEED=y +CONFIG_CRYPTO_SERPENT=y +# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set +CONFIG_CRYPTO_SERPENT_AVX_X86_64=y +CONFIG_CRYPTO_TEA=y +CONFIG_CRYPTO_TWOFISH=y +CONFIG_CRYPTO_TWOFISH_COMMON=y +CONFIG_CRYPTO_TWOFISH_X86_64=y +CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y +CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_ZLIB=y +# CONFIG_CRYPTO_LZO is not set + +# +# Random Number Generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y +# CONFIG_CRYPTO_HW is not set +CONFIG_HAVE_KVM=y +CONFIG_VIRTUALIZATION=y +# CONFIG_KVM is not set +# CONFIG_VHOST_NET is not set +# CONFIG_BINARY_PRINTF is not set + +# +# Library routines +# +CONFIG_BITREVERSE=y +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +CONFIG_GENERIC_FIND_FIRST_BIT=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IOMAP=y +CONFIG_GENERIC_IO=y +CONFIG_CRC_CCITT=y +CONFIG_CRC16=y +# CONFIG_CRC_T10DIF is not set +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +CONFIG_CRC7=y +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +# CONFIG_XZ_DEC is not set +# CONFIG_XZ_DEC_BCJ is not set +CONFIG_TEXTSEARCH=y +CONFIG_TEXTSEARCH_KMP=y +CONFIG_TEXTSEARCH_BM=y +CONFIG_TEXTSEARCH_FSM=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT=y +CONFIG_HAS_DMA=y +CONFIG_DQL=y +CONFIG_NLATTR=y +CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y +# CONFIG_AVERAGE is not set +# CONFIG_CORDIC is not set +# CONFIG_DDR is not set diff --git a/testing/config/kvm/alice.xml b/testing/config/kvm/alice.xml new file mode 100644 index 000000000..6ca78f861 --- /dev/null +++ b/testing/config/kvm/alice.xml @@ -0,0 +1,70 @@ +<domain type='kvm'> + <name>alice</name> + <uuid>1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/alice.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:9a:e2:de'/> + <source network='vnet2'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <interface type='network'> + <mac address='52:54:00:3b:0c:d7'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/bob.xml b/testing/config/kvm/bob.xml new file mode 100644 index 000000000..d9a9b4c05 --- /dev/null +++ b/testing/config/kvm/bob.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>bob</name> + <uuid>72728516-377f-f5be-ea1d-b1f1e851538f</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/bob.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:40:85:6b'/> + <source network='vnet3'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/carol.xml b/testing/config/kvm/carol.xml new file mode 100644 index 000000000..fbdabe2e4 --- /dev/null +++ b/testing/config/kvm/carol.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>carol</name> + <uuid>6bc2eef5-7faf-cde0-5f27-6fc29f93bc3d</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/carol.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:ae:f1:f8'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/dave.xml b/testing/config/kvm/dave.xml new file mode 100644 index 000000000..bfebe9b60 --- /dev/null +++ b/testing/config/kvm/dave.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>dave</name> + <uuid>05f1debe-4e38-4f3d-10a0-c07fbb70d816</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/dave.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:b9:15:a9'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/moon.xml b/testing/config/kvm/moon.xml new file mode 100644 index 000000000..e019fcea5 --- /dev/null +++ b/testing/config/kvm/moon.xml @@ -0,0 +1,70 @@ +<domain type='kvm'> + <name>moon</name> + <uuid>b5e00ad3-1c81-3b2a-7f66-cdf8727b3c65</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/moon.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:43:e3:35'/> + <source network='vnet2'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </interface> + <interface type='network'> + <mac address='52:54:00:c7:b8:b0'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/sun.xml b/testing/config/kvm/sun.xml new file mode 100644 index 000000000..5ed1a47ea --- /dev/null +++ b/testing/config/kvm/sun.xml @@ -0,0 +1,70 @@ +<domain type='kvm'> + <name>sun</name> + <uuid>35341843-346c-a63a-786b-9df0fd5e6264</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/sun.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:77:43:ea'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <interface type='network'> + <mac address='52:54:00:0f:97:db'/> + <source network='vnet3'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/venus.xml b/testing/config/kvm/venus.xml new file mode 100644 index 000000000..77a333655 --- /dev/null +++ b/testing/config/kvm/venus.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>venus</name> + <uuid>f0838df9-7cc0-84f5-6c14-2d16ab002e8d</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/venus.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:69:d3:80'/> + <source network='vnet2'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/vnet1.xml b/testing/config/kvm/vnet1.xml new file mode 100644 index 000000000..f9d979be1 --- /dev/null +++ b/testing/config/kvm/vnet1.xml @@ -0,0 +1,11 @@ +<network> + <name>vnet1</name> + <uuid>1d6ac7c7-60d9-56c1-a7df-210d3d0cc6d1</uuid> + <forward dev='lo' mode='route'> + <interface dev='lo'/> + </forward> + <bridge name='virbr1' stp='on' delay='0' /> + <mac address='52:54:00:97:F9:FD'/> + <ip address='192.168.0.254' netmask='255.255.255.0'> + </ip> +</network> diff --git a/testing/config/kvm/vnet2.xml b/testing/config/kvm/vnet2.xml new file mode 100644 index 000000000..7d125bfc6 --- /dev/null +++ b/testing/config/kvm/vnet2.xml @@ -0,0 +1,11 @@ +<network> + <name>vnet2</name> + <uuid>b5147a7d-e184-5c9e-3838-4621796ba95c</uuid> + <forward dev='lo' mode='route'> + <interface dev='lo'/> + </forward> + <bridge name='virbr2' stp='on' delay='0' /> + <mac address='52:54:00:05:F3:34'/> + <ip address='10.1.0.254' netmask='255.255.0.0'> + </ip> +</network> diff --git a/testing/config/kvm/vnet3.xml b/testing/config/kvm/vnet3.xml new file mode 100644 index 000000000..1da06c448 --- /dev/null +++ b/testing/config/kvm/vnet3.xml @@ -0,0 +1,11 @@ +<network> + <name>vnet3</name> + <uuid>5c537abc-c116-90e9-a0ef-886340d4c356</uuid> + <forward dev='lo' mode='route'> + <interface dev='lo'/> + </forward> + <bridge name='virbr3' stp='on' delay='0' /> + <mac address='52:54:00:62:4C:69'/> + <ip address='10.2.0.254' netmask='255.255.0.0'> + </ip> +</network> diff --git a/testing/config/kvm/winnetou.xml b/testing/config/kvm/winnetou.xml new file mode 100644 index 000000000..99d5deb99 --- /dev/null +++ b/testing/config/kvm/winnetou.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>winnetou</name> + <uuid>b1d3d2f7-e20b-ab95-277e-66d4cac33cc3</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/winnetou.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:4b:23:fa'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/do-tests.in b/testing/do-tests index 82e027078..fafbe6e89 100755 --- a/testing/do-tests.in +++ b/testing/do-tests @@ -14,23 +14,16 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. -DIR=`dirname $0` +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf +. $DIR/scripts/function.sh -source $DIR/scripts/function.sh - -[ -f $DIR/testing.conf ] || die "Configuration file 'testing.conf' not found" [ -d $DIR/hosts ] || die "Directory 'hosts' not found" [ -d $DIR/tests ] || die "Directory 'tests' not found" +[ -d $BUILDDIR ] || + die "Directory '$BUILDDIR' does not exist, please run make-testing first" -source $DIR/testing.conf - - -############################################################################## -# test if UMLs have been built at all -# - -[ -d $BUILDDIR ] || die "Directory '$BUILDDIR' does not exist. Please run 'make-testing'first." - +ln -sfT $DIR $TESTDIR/testing ############################################################################## # take care of new path and file variables @@ -38,15 +31,15 @@ source $DIR/testing.conf [ -d $TESTRESULTSDIR ] || mkdir $TESTRESULTSDIR -TESTDATE=`date +%Y%m%d-%H%M` +TESTDATE=`date +%Y%m%d-%H%M-%S` TODAYDIR=$TESTRESULTSDIR/$TESTDATE mkdir $TODAYDIR TESTRESULTSHTML=$TODAYDIR/all.html INDEX=$TODAYDIR/index.html -DEFAULTTESTSDIR=$UMLTESTDIR/testing/tests +DEFAULTTESTSDIR=$TESTDIR/testing/tests -SOURCEIP_ROUTING_TABLE=@routing_table@ +SOURCEIP_ROUTING_TABLE=220 testnumber="0" failed_cnt="0" @@ -105,8 +98,9 @@ done # for host in $STRONGSWANHOSTS do - ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` & + ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` >/dev/null 2>&1 & eval ssh_pid_$host="`echo $!`" + do_on_exit kill `eval echo \\\$ssh_pid_$host` done @@ -114,30 +108,27 @@ done # create header for the results html file # -KERNEL_VERSION=`basename $KERNEL .tar.bz2` -IPSEC_VERSION=`basename $STRONGSWAN .tar.bz2` - ENVIRONMENT_HEADER=$(cat <<@EOF - <table border="0" cellspacing="2"> + <table border="0" cellspacing="2" cellpadding="2"> <tr valign="top"> - <td><b>Host:</b></td> + <td><b>Host</b></td> <td colspan="3">`uname -a`</td> </tr> <tr valign="top"> - <td><b>UML kernel: </b></td> - <td colspan="3">$KERNEL_VERSION</td> + <td><b>Guest kernel</b></td> + <td colspan="3">$KERNELVERSION</td> </tr> <tr valign="top"> - <td><b>IPsec:</b></td> - <td colspan="3">$IPSEC_VERSION</td> + <td><b>strongSwan</b></td> + <td colspan="3">$SWANVERSION</td> </tr> <tr valign="top"> - <td><b>Date:</b></td> + <td><b>Date</b></td> <td colspan="3">$TESTDATE</td> </tr> <tr> <td width="100"> </td> - <td width="200"> </td> + <td width="300"> </td> <td width=" 50"> </td> <td > </td> </tr> @@ -147,20 +138,20 @@ ENVIRONMENT_HEADER=$(cat <<@EOF cat > $INDEX <<@EOF <html> <head> - <title>strongSwan UML Tests</title> + <title>strongSwan KVM Tests</title> </head> <body> - <h2>strongSwan UML Tests</h2> + <h2>strongSwan KVM Tests</h2> $ENVIRONMENT_HEADER @EOF cat > $TESTRESULTSHTML <<@EOF <html> <head> - <title>strongSwan UML Tests - All Tests</title> + <title>strongSwan KVM Tests - All Tests</title> </head> <body> - <div><a href="index.html">strongSwan UML Tests</a> / All Tests</div> + <div><a href="index.html">strongSwan KVM Tests</a> / All Tests</div> <h2>All Tests</h2> $ENVIRONMENT_HEADER <tr align="left"> @@ -170,10 +161,10 @@ cat > $TESTRESULTSHTML <<@EOF </tr> @EOF -cecho "UML kernel: $KERNEL_VERSION" -cecho "IPsec: $IPSEC_VERSION" -cecho "Date: $TESTDATE" -cecho "" +echo "Guest kernel : $KERNELVERSION" +echo "strongSwan : $SWANVERSION" +echo "Date : $TESTDATE" +echo ############################################################################## @@ -183,10 +174,6 @@ cecho "" if [ $# -gt 0 ] then TESTS=$* -elif [ $SELECTEDTESTSONLY = "yes" ] -then - # set internal field seperator - TESTS=$SELECTEDTESTS else # set internal field seperator TESTS="`ls $DEFAULTTESTSDIR`" @@ -208,7 +195,7 @@ do mkdir $TODAYDIR/$SUBDIR if [ $testnumber == 0 ] then - FIRST="<b>Category:</b" + FIRST="<b>Category</b>" else FIRST=" " fi @@ -225,24 +212,24 @@ do <title>strongSwan $SUBDIR Tests</title> </head> <body> - <div><a href="../index.html">strongSwan UML Tests</a> / $SUBDIR</div> + <div><a href="../index.html">strongSwan KVM Tests</a> / $SUBDIR</div> <h2>strongSwan $SUBDIR Tests</h2> - <table border="0" cellspacing="2"> + <table border="0" cellspacing="2" cellpadding="2"> <tr valign="top"> - <td><b>UML kernel: </b></td> - <td colspan="3">$KERNEL_VERSION</td> + <td><b>Guest kernel</b></td> + <td colspan="3">$KERNELVERSION</td> </tr> <tr valign="top"> - <td><b>IPsec:</b></td> - <td colspan="3">$IPSEC_VERSION</td> + <td><b>strongSwan</b></td> + <td colspan="3">$SWANVERSION</td> </tr> <tr valign="top"> - <td><b>Date:</b></td> + <td><b>Date</b></td> <td colspan="3">$TESTDATE</td> </tr> <tr> <td width="100"> </td> - <td width="200"> </td> + <td width="300"> </td> <td width=" 50"> </td> <td > </td> </tr> @@ -258,11 +245,11 @@ do do let "testnumber += 1" testname=$SUBDIR/$name - cecho-n " $testnumber $testname.." + log_action " $testnumber $testname:" if [ ! -d $DEFAULTTESTSDIR/${testname} ] then - cecho "is missing..skipped" + echo "is missing..skipped" continue fi @@ -390,7 +377,7 @@ do # execute pre-test commands # - cecho-n "pre.." + echo -n "pre.." echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1 eval `awk -F "::" '{ @@ -419,7 +406,7 @@ do # get and evaluate test results # - cecho-n "test.." + echo -n "test.." echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1 STATUS="passed" @@ -476,7 +463,7 @@ do <body> <table border="0" cellpadding="0" cellspacing="0" width="600"> <tr><td> - <div><a href="../../index.html">strongSwan UML Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div> + <div><a href="../../index.html">strongSwan KVM Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div> <h2>Test $testname</h2> <h3>Description</h3> @EOF @@ -487,7 +474,7 @@ do <ul> <li><a href="console.log">console.log</a></li> </ul> - <img src="../../images/$DIAGRAM" alt="$UMLHOSTS"> + <img src="../../images/$DIAGRAM" alt="$VIRTHOSTS"> @EOF for host in $IPSECHOSTS @@ -507,7 +494,7 @@ do done scp $SSHCONF $HOSTLOGIN:/etc/ipsec.d/ipsec.sql \ - $TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1 + $TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1 ssh $SSHCONF $HOSTLOGIN ip -s xfrm policy \ > $TESTRESULTDIR/${host}.ip.policy 2>/dev/null @@ -558,15 +545,18 @@ do for file in clients.conf eap.conf radiusd.conf proxy.conf users do - scp $SSHCONF $HOSTLOGIN:/etc/raddb/$file \ + scp $SSHCONF $HOSTLOGIN:/etc/freeradius/$file \ $TESTRESULTDIR/${host}.$file > /dev/null 2>&1 done scp $SSHCONF $HOSTLOGIN:/etc/strongswan.conf \ $TESTRESULTDIR/${host}.strongswan.conf > /dev/null 2>&1 - scp $SSHCONF $HOSTLOGIN:/var/log/radius/radius.log \ - $TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1 + scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \ + $TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1 + + ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \ + >> $TESTRESULTDIR/${host}.daemon.log chmod a+r $TESTRESULTDIR/* cat >> $TESTRESULTDIR/index.html <<@EOF @@ -600,6 +590,28 @@ do done cat >> $TESTRESULTDIR/index.html <<@EOF + <h3>tcpdump</h3> + <ul> +@EOF + + for host in $TCPDUMPHOSTS + do + eval HOSTLOGIN=root@\$ipv4_${host} + + scp $SSHCONF $HOSTLOGIN:/tmp/tcpdump.log \ + $TESTRESULTDIR/${host}.tcpdump.log > /dev/null 2>&1 + + cat >> $TESTRESULTDIR/index.html <<@EOF + <li><a href="$host.tcpdump.log">$host tcpdump.log</a></li> +@EOF + + done + + cat >> $TESTRESULTDIR/index.html <<@EOF + </ul> +@EOF + + cat >> $TESTRESULTDIR/index.html <<@EOF </td></tr> </table> </body> @@ -611,7 +623,7 @@ do # execute post-test commands # - cecho-n "post.." + echo -n "post" echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1 eval `awk -F "::" '{ @@ -649,18 +661,6 @@ do ########################################################################## - # get a copy of /var/log/daemon.log - # - - for host in $RADIUSHOSTS - do - eval HOSTLOGIN=root@\$ipv4_${host} - ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \ - >> $TESTRESULTDIR/${host}.daemon.log - done - - - ########################################################################## # stop tcpdump if necessary # @@ -688,11 +688,11 @@ do if [ $STATUS = "passed" ] then - COLOR="green" - cecho "\033[1;32m$STATUS" + COLOR="green" + log_status 0 else - COLOR="red" - cecho "$STATUS" + COLOR="red" + log_status 1 fi cat >> $TESTRESULTSHTML << @EOF @@ -737,10 +737,10 @@ cat >> $TESTRESULTSHTML << @EOF <td> </td><td> </td><td> </td><td> </td> </tr> <tr> - <td><b>Passed:</b></td><td><b><font color="green">$passed_cnt</font></b></td><td> </td><td> </td> + <td><b>Passed</b></td><td><b><font color="green">$passed_cnt</font></b></td><td> </td><td> </td> </tr> <tr> - <td><b>Failed:</b></td><td><b><font color="red">$failed_cnt</font></b></td><td> </td><td> </td> + <td><b>Failed</b></td><td><b><font color="red">$failed_cnt</font></b></td><td> </td><td> </td> </tr> </table> </body> @@ -757,7 +757,7 @@ cat >> $INDEX << @EOF <td> </td> </tr> <tr> - <td><b>Failed:</b></td> + <td><b>Failed</b></td> <td> </td> <td align="right"><b><font color="red">$failed_cnt</font></b></td> <td> </td> @@ -767,33 +767,25 @@ cat >> $INDEX << @EOF </html> @EOF -cecho "" -cecho "\033[1;32mPassed: $passed_cnt" -cecho "Failed: $failed_cnt" -cecho "" +echo +echo_ok "Passed : $passed_cnt" +echo_failed "Failed : $failed_cnt" +echo ############################################################################## # copy the test results to the apache server # -HTDOCS="/var/www/localhost/htdocs" +HTDOCS="/var/www" -cecho-n "Copying test results to winnetou.." ssh $SSHCONF root@${ipv4_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1 scp $SSHCONF -r $TODAYDIR root@${ipv4_winnetou}:$HTDOCS/testresults > /dev/null 2>&1 ssh $SSHCONF root@${ipv4_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1 -cgecho "done" -cecho "" -cecho "The results are available in $TODAYDIR" -cecho "or via the link http://$ipv4_winnetou/testresults/$TESTDATE" - - -########################################################################## -# close ssh sessions -# -for host in $STRONGSWANHOSTS -do - kill `eval echo \\\$ssh_pid_$host` -done +echo +echo "The results are available in $TODAYDIR" +echo "or via the link http://$ipv4_winnetou/testresults/$TESTDATE" +ENDDATE=`date +%Y%m%d-%H%M` +echo +echo "Finished : $ENDDATE" diff --git a/testing/hosts/alice/etc/conf.d/hostname b/testing/hosts/alice/etc/conf.d/hostname deleted file mode 100644 index 2012e0451..000000000 --- a/testing/hosts/alice/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=alice diff --git a/testing/hosts/alice/etc/conf.d/net b/testing/hosts/alice/etc/conf.d/net deleted file mode 100644 index 41e8887c4..000000000 --- a/testing/hosts/alice/etc/conf.d/net +++ /dev/null @@ -1,12 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0" - "PH_IP6_ALICE/16" ) -config_eth1=( "PH_IP_ALICE1 broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_ALICE1/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via PH_IP_MOON1" ) diff --git a/testing/hosts/alice/etc/freeradius/clients.conf b/testing/hosts/alice/etc/freeradius/clients.conf new file mode 100644 index 000000000..5fb47a2ad --- /dev/null +++ b/testing/hosts/alice/etc/freeradius/clients.conf @@ -0,0 +1,4 @@ +client 10.1.0.1 { + secret = gv6URkSs + shortname = moon +} diff --git a/testing/hosts/alice/etc/freeradius/dictionary b/testing/hosts/alice/etc/freeradius/dictionary new file mode 100644 index 000000000..59a874b3e --- /dev/null +++ b/testing/hosts/alice/etc/freeradius/dictionary @@ -0,0 +1,32 @@ +# +# This is the master dictionary file, which references the +# pre-defined dictionary files included with the server. +# +# Any new/changed attributes MUST be placed in this file, as +# the pre-defined dictionaries SHOULD NOT be edited. +# +# $Id$ +# + +# +# The filename given here should be an absolute path. +# +$INCLUDE /usr/local/share/freeradius/dictionary + +# +# Place additional attributes or $INCLUDEs here. They will +# over-ride the definitions in the pre-defined dictionaries. +# +# See the 'man' page for 'dictionary' for information on +# the format of the dictionary files. + +# +# If you want to add entries to the dictionary file, +# which are NOT going to be placed in a RADIUS packet, +# add them here. The numbers you pick should be between +# 3000 and 4000. +# + +#ATTRIBUTE My-Local-String 3000 string +#ATTRIBUTE My-Local-IPAddr 3001 ipaddr +#ATTRIBUTE My-Local-Integer 3002 integer diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/hosts/alice/etc/freeradius/radiusd.conf index 1143a0473..e4f721738 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf +++ b/testing/hosts/alice/etc/freeradius/radiusd.conf @@ -5,16 +5,16 @@ exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb +logdir = ${localstatedir}/log/freeradius +raddbdir = ${sysconfdir}/freeradius radacctdir = ${logdir}/radacct # name of the running server. See also the "-n" command-line option. -name = radiusd +name = freeradius # Location of config and logfiles. confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd +run_dir = ${localstatedir}/run # Should likely be ${localstatedir}/lib/radiusd db_dir = ${raddbdir} @@ -37,7 +37,7 @@ max_requests = 1024 # listen: Make the server listen on a particular IP address, and send listen { type = auth - ipaddr = PH_IP_ALICE + ipaddr = 10.1.0.10 port = 0 } @@ -46,7 +46,7 @@ listen { # listen { type = acct - ipaddr = PH_IP_ALICE + ipaddr = 10.1.0.10 port = 0 } @@ -66,9 +66,9 @@ log { file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes + auth = yes + auth_badpass = yes + auth_goodpass = yes } # The program to execute to do concurrency checks. diff --git a/testing/hosts/alice/etc/hostname b/testing/hosts/alice/etc/hostname new file mode 100644 index 000000000..c9fc40bfb --- /dev/null +++ b/testing/hosts/alice/etc/hostname @@ -0,0 +1 @@ +alice diff --git a/testing/hosts/alice/etc/init.d/iptables b/testing/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 1097ac5a4..000000000 --- a/testing/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/alice/etc/init.d/net.eth0 b/testing/hosts/alice/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/alice/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/alice/etc/init.d/net.eth1 b/testing/hosts/alice/etc/init.d/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/alice/etc/init.d/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/alice/etc/init.d/radiusd b/testing/hosts/alice/etc/init.d/radiusd deleted file mode 100755 index 8334385f9..000000000 --- a/testing/hosts/alice/etc/init.d/radiusd +++ /dev/null @@ -1,64 +0,0 @@ -#!/sbin/runscript - -opts="${opts} reload" - -depend() { - need net - use dns -} - -checkconfig() { - # set the location of log files - if ! cd /var/log/radius ; then - eerror "Failed to change current directory to /var/log/radius" - return 1 - fi - - if [ ! -d /var/run/radiusd ] && ! mkdir /var/run/radiusd ; then - eerror "Failed to create /var/run/radiusd" - return 1 - fi - - if [ ! -f /etc/raddb/radiusd.conf ] ; then - eerror "No /etc/raddb/radiusd.conf file exists!" - return 1 - fi - - RADIUSD_OPTS="-xx" - RADIUSD_USER=`grep '^ *user *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3` - RADIUSD_GROUP=`grep '^ *group *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3` - if [ -n "${RADIUSD_USER}" ] && ! getent passwd ${RADIUSD_USER} > /dev/null ; then - eerror "${RADIUSD_USER} user missing!" - return 1 - fi - if [ -n "${RADIUSD_GROUP}" ] && ! getent group ${RADIUSD_GROUP} > /dev/null ; then - eerror "${RADIUSD_GROUP} group missing!" - return 1 - fi - - # radius.log is created before privileges are dropped - need to set proper permissions on it - [ -f radius.log ] || touch radius.log || return 1 - - chown -R "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" . /var/run/radiusd && \ - chmod -R u+rwX,g+rX . /var/run/radiusd || return 1 -} - -start() { - checkconfig || return 1 - - ebegin "Starting radiusd" - start-stop-daemon --start --quiet --exec /usr/sbin/radiusd -- ${RADIUSD_OPTS} >/dev/null - eend $? -} - -stop () { - ebegin "Stopping radiusd" - start-stop-daemon --stop --quiet --pidfile=/var/run/radiusd/radiusd.pid - eend $? -} - -reload () { - ebegin "Reloading radiusd" - kill -HUP `</var/run/radiusd/radiusd.pid` - eend $? -} diff --git a/testing/hosts/alice/etc/ipsec.conf b/testing/hosts/alice/etc/ipsec.conf index 0671537e9..6d8aa629d 100755..100644 --- a/testing/hosts/alice/etc/ipsec.conf +++ b/testing/hosts/alice/etc/ipsec.conf @@ -13,7 +13,7 @@ conn nat-t leftcert=aliceCert.pem leftid=alice@strongswan.org leftfirewall=yes - right=PH_IP_SUN + right=192.168.0.2 rightid=@sun.strongswan.org rightsubnet=10.2.0.0/16 auto=add diff --git a/testing/hosts/alice/etc/network/interfaces b/testing/hosts/alice/etc/network/interfaces new file mode 100644 index 000000000..6fcbaa597 --- /dev/null +++ b/testing/hosts/alice/etc/network/interfaces @@ -0,0 +1,20 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 10.1.0.10 + netmask 255.255.0.0 + broadcast 10.1.255.255 + gateway 10.1.0.1 +iface eth0 inet6 static + address fec1::10 + netmask 16 + +iface eth1 inet static + address 192.168.0.50 + netmask 255.255.255.0 + broadcast 192.168.0.255 +iface eth1 inet6 static + address fec0::5 + netmask 16 diff --git a/testing/hosts/alice/etc/runlevels/default/net.eth0 b/testing/hosts/alice/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/alice/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/bob/etc/conf.d/hostname b/testing/hosts/bob/etc/conf.d/hostname deleted file mode 100644 index bbf5a2ea6..000000000 --- a/testing/hosts/bob/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=bob diff --git a/testing/hosts/bob/etc/conf.d/net b/testing/hosts/bob/etc/conf.d/net deleted file mode 100644 index bd0b3a5ce..000000000 --- a/testing/hosts/bob/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_BOB broadcast 10.2.255.255 netmask 255.255.0.0" - "PH_IP6_BOB/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via PH_IP_SUN1" ) diff --git a/testing/hosts/bob/etc/hostname b/testing/hosts/bob/etc/hostname new file mode 100644 index 000000000..696fb6baa --- /dev/null +++ b/testing/hosts/bob/etc/hostname @@ -0,0 +1 @@ +bob diff --git a/testing/hosts/bob/etc/init.d/iptables b/testing/hosts/bob/etc/init.d/iptables deleted file mode 100755 index 7b8756b81..000000000 --- a/testing/hosts/bob/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/bob/etc/init.d/net.eth0 b/testing/hosts/bob/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/bob/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/bob/etc/ipsec.conf b/testing/hosts/bob/etc/ipsec.conf index 5896c3436..5896c3436 100755..100644 --- a/testing/hosts/bob/etc/ipsec.conf +++ b/testing/hosts/bob/etc/ipsec.conf diff --git a/testing/hosts/bob/etc/network/interfaces b/testing/hosts/bob/etc/network/interfaces new file mode 100644 index 000000000..eca4f8fe7 --- /dev/null +++ b/testing/hosts/bob/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 10.2.0.10 + netmask 255.255.0.0 + broadcast 10.2.255.255 + gateway 10.2.0.1 +iface eth0 inet6 static + address fec2::10 + netmask 16 diff --git a/testing/hosts/bob/etc/runlevels/default/net.eth0 b/testing/hosts/bob/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/bob/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/carol/etc/conf.d/hostname b/testing/hosts/carol/etc/conf.d/hostname deleted file mode 100644 index d5101b924..000000000 --- a/testing/hosts/carol/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=carol diff --git a/testing/hosts/carol/etc/conf.d/net b/testing/hosts/carol/etc/conf.d/net deleted file mode 100644 index f7f685942..000000000 --- a/testing/hosts/carol/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_CAROL broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_CAROL/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/carol/etc/hostname b/testing/hosts/carol/etc/hostname new file mode 100644 index 000000000..da4b06358 --- /dev/null +++ b/testing/hosts/carol/etc/hostname @@ -0,0 +1 @@ +carol diff --git a/testing/hosts/carol/etc/init.d/iptables b/testing/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 6ff11a424..000000000 --- a/testing/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/carol/etc/init.d/net.eth0 b/testing/hosts/carol/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/carol/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/carol/etc/ipsec.conf b/testing/hosts/carol/etc/ipsec.conf index 0848ee716..d2d481b68 100755..100644 --- a/testing/hosts/carol/etc/ipsec.conf +++ b/testing/hosts/carol/etc/ipsec.conf @@ -9,11 +9,11 @@ conn %default keyingtries=1 conn home - left=PH_IP_CAROL + left=192.168.0.100 leftcert=carolCert.pem leftid=carol@strongswan.org leftfirewall=yes - right=PH_IP_MOON + right=192.168.0.1 rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add diff --git a/testing/hosts/carol/etc/network/interfaces b/testing/hosts/carol/etc/network/interfaces new file mode 100644 index 000000000..67bc73359 --- /dev/null +++ b/testing/hosts/carol/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.100 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::10 + netmask 16 diff --git a/testing/hosts/carol/etc/runlevels/default/net.eth0 b/testing/hosts/carol/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/carol/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/dave/etc/conf.d/hostname b/testing/hosts/dave/etc/conf.d/hostname deleted file mode 100644 index c3fabf331..000000000 --- a/testing/hosts/dave/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=dave diff --git a/testing/hosts/dave/etc/conf.d/net b/testing/hosts/dave/etc/conf.d/net deleted file mode 100644 index 2b902525a..000000000 --- a/testing/hosts/dave/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_DAVE broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_DAVE/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/dave/etc/hostname b/testing/hosts/dave/etc/hostname new file mode 100644 index 000000000..9fcf7b10e --- /dev/null +++ b/testing/hosts/dave/etc/hostname @@ -0,0 +1 @@ +dave diff --git a/testing/hosts/dave/etc/init.d/iptables b/testing/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 6ff11a424..000000000 --- a/testing/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/dave/etc/init.d/net.eth0 b/testing/hosts/dave/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/dave/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/dave/etc/ipsec.conf b/testing/hosts/dave/etc/ipsec.conf index 96502581e..5c546e260 100755..100644 --- a/testing/hosts/dave/etc/ipsec.conf +++ b/testing/hosts/dave/etc/ipsec.conf @@ -9,11 +9,11 @@ conn %default keyingtries=1 conn home - left=PH_IP_DAVE + left=192.168.0.200 leftcert=daveCert.pem leftid=dave@strongswan.org leftfirewall=yes - right=PH_IP_MOON + right=192.168.0.1 rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add diff --git a/testing/hosts/dave/etc/network/interfaces b/testing/hosts/dave/etc/network/interfaces new file mode 100644 index 000000000..59e526751 --- /dev/null +++ b/testing/hosts/dave/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.200 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::20 + netmask 16 diff --git a/testing/hosts/dave/etc/runlevels/default/net.eth0 b/testing/hosts/dave/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/dave/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/default/etc/default/slapd b/testing/hosts/default/etc/default/slapd new file mode 100644 index 000000000..a4a0a6e2a --- /dev/null +++ b/testing/hosts/default/etc/default/slapd @@ -0,0 +1,45 @@ +# Default location of the slapd.conf file or slapd.d cn=config directory. If +# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to +# /etc/ldap/slapd.conf). +SLAPD_CONF=/etc/ldap/slapd.conf + +# System account to run the slapd server under. If empty the server +# will run as root. +SLAPD_USER="openldap" + +# System group to run the slapd server under. If empty the server will +# run in the primary group of its user. +SLAPD_GROUP="openldap" + +# Path to the pid file of the slapd server. If not set the init.d script +# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by +# default) +SLAPD_PIDFILE= + +# slapd normally serves ldap only on all TCP-ports 389. slapd can also +# service requests on TCP-port 636 (ldaps) and requests via unix +# sockets. +# Example usage: +# SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///" +SLAPD_SERVICES="ldap:///" + +# If SLAPD_NO_START is set, the init script will not start or restart +# slapd (but stop will still work). Uncomment this if you are +# starting slapd via some other means or if you don't want slapd normally +# started at boot. +#SLAPD_NO_START=1 + +# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists, +# the init script will not start or restart slapd (but stop will still +# work). Use this for temporarily disabling startup of slapd (when doing +# maintenance, for example, or through a configuration management system) +# when you don't want to edit a configuration file. +SLAPD_SENTINEL_FILE=/etc/ldap/noslapd + +# For Kerberos authentication (via SASL), slapd by default uses the system +# keytab file (/etc/krb5.keytab). To use a different keytab file, +# uncomment this line and change the path. +#export KRB5_KTNAME=/etc/krb5.keytab + +# Additional options to pass to slapd +SLAPD_OPTIONS="" diff --git a/testing/hosts/default/etc/fstab b/testing/hosts/default/etc/fstab new file mode 100644 index 000000000..12747232e --- /dev/null +++ b/testing/hosts/default/etc/fstab @@ -0,0 +1 @@ +/hostshare /root/shared 9p trans=virtio,version=9p2000.L 0 0 diff --git a/testing/hosts/default/etc/ip6tables.flush b/testing/hosts/default/etc/ip6tables.flush new file mode 100644 index 000000000..c3f5a9254 --- /dev/null +++ b/testing/hosts/default/etc/ip6tables.flush @@ -0,0 +1,15 @@ +*filter + +-F + +-P INPUT ACCEPT +-P OUTPUT ACCEPT +-P FORWARD ACCEPT + +COMMIT + +*mangle + +-F + +COMMIT diff --git a/testing/hosts/default/etc/ip6tables.rules b/testing/hosts/default/etc/ip6tables.rules new file mode 100644 index 000000000..6a2c6af8e --- /dev/null +++ b/testing/hosts/default/etc/ip6tables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow last UDP fragment +-A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# allow crl and certficate fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/hosts/default/etc/iptables.drop b/testing/hosts/default/etc/iptables.drop new file mode 100644 index 000000000..445c45669 --- /dev/null +++ b/testing/hosts/default/etc/iptables.drop @@ -0,0 +1,12 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT diff --git a/testing/hosts/default/etc/iptables.flush b/testing/hosts/default/etc/iptables.flush new file mode 100644 index 000000000..b3ab63c51 --- /dev/null +++ b/testing/hosts/default/etc/iptables.flush @@ -0,0 +1,21 @@ +*filter + +-F + +-P INPUT ACCEPT +-P OUTPUT ACCEPT +-P FORWARD ACCEPT + +COMMIT + +*nat + +-F + +COMMIT + +*mangle + +-F + +COMMIT diff --git a/testing/hosts/default/etc/iptables.rules b/testing/hosts/default/etc/iptables.rules new file mode 100644 index 000000000..c3f036cf9 --- /dev/null +++ b/testing/hosts/default/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT + +COMMIT diff --git a/testing/hosts/default/etc/profile.d/coredumps.sh b/testing/hosts/default/etc/profile.d/coredumps.sh new file mode 100644 index 000000000..ea44c0ef6 --- /dev/null +++ b/testing/hosts/default/etc/profile.d/coredumps.sh @@ -0,0 +1,5 @@ +#!/bin/sh -e + +ulimit -c unlimited >/dev/null 2>&1 +install -m 1777 -d /var/local/dumps >/dev/null 2>&1 +echo "/var/local/dumps/core.%e.%p" > /proc/sys/kernel/core_pattern diff --git a/testing/hosts/default/etc/rsyslog.conf b/testing/hosts/default/etc/rsyslog.conf new file mode 100644 index 000000000..9f76da36e --- /dev/null +++ b/testing/hosts/default/etc/rsyslog.conf @@ -0,0 +1,125 @@ +# /etc/rsyslog.conf Configuration file for rsyslog. +# +# For more information see +# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html + + +################# +#### MODULES #### +################# + +$ModLoad imuxsock # provides support for local system logging +$ModLoad imklog # provides kernel logging support +#$ModLoad immark # provides --MARK-- message capability + +# Don't drop messages +$SystemLogRateLimitInterval 0 +$RepeatedMsgReduction off + +# provides UDP syslog reception +#$ModLoad imudp +#$UDPServerRun 514 + +# provides TCP syslog reception +#$ModLoad imtcp +#$InputTCPServerRun 514 + + +########################### +#### GLOBAL DIRECTIVES #### +########################### + +# +# Use traditional timestamp format. +# To enable high precision timestamps, comment out the following line. +# +$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat + +# +# Set the default permissions for all log files. +# +$FileOwner root +$FileGroup adm +$FileCreateMode 0640 +$DirCreateMode 0755 +$Umask 0022 + +# +# Where to place spool and state files +# +$WorkDirectory /var/spool/rsyslog + +# +# Include all config files in /etc/rsyslog.d/ +# +$IncludeConfig /etc/rsyslog.d/*.conf + + +############### +#### RULES #### +############### + +# +# First some standard log files. Log by facility. +# +auth,authpriv.* /var/log/auth.log +*.*;auth,authpriv.none -/var/log/syslog +#cron.* /var/log/cron.log +daemon.* /var/log/daemon.log +kern.* -/var/log/kern.log +lpr.* -/var/log/lpr.log +mail.* -/var/log/mail.log +user.* -/var/log/user.log + +# +# Logging for the mail system. Split it up so that +# it is easy to write scripts to parse these files. +# +mail.info -/var/log/mail.info +mail.warn -/var/log/mail.warn +mail.err /var/log/mail.err + +# +# Logging for INN news system. +# +news.crit /var/log/news/news.crit +news.err /var/log/news/news.err +news.notice -/var/log/news/news.notice + +# +# Some "catch-all" log files. +# +*.=debug;\ + auth,authpriv.none;\ + news.none;mail.none -/var/log/debug +*.=info;*.=notice;*.=warn;\ + auth,authpriv.none;\ + cron,daemon.none;\ + mail,news.none -/var/log/messages + +# +# Emergencies are sent to everybody logged in. +# +*.emerg :omusrmsg:* + +# +# I like to have messages displayed on the console, but only on a virtual +# console I usually leave idle. +# +#daemon,mail.*;\ +# news.=crit;news.=err;news.=notice;\ +# *.=debug;*.=info;\ +# *.=notice;*.=warn /dev/tty8 + +# The named pipe /dev/xconsole is for the `xconsole' utility. To use it, +# you must invoke `xconsole' with the `-file' option: +# +# $ xconsole -file /dev/xconsole [...] +# +# NOTE: adjust the list below, or you'll go crazy if you have a reasonably +# busy site.. +# +daemon.*;mail.*;\ + news.err;\ + *.=debug;*.=info;\ + *.=notice;*.=warn |/dev/xconsole diff --git a/testing/hosts/default/etc/security/limits.conf b/testing/hosts/default/etc/security/limits.conf new file mode 100644 index 000000000..2658b3236 --- /dev/null +++ b/testing/hosts/default/etc/security/limits.conf @@ -0,0 +1,58 @@ +# /etc/security/limits.conf +# +#Each line describes a limit for a user in the form: +# +#<domain> <type> <item> <value> +# +#Where: +#<domain> can be: +# - an user name +# - a group name, with @group syntax +# - the wildcard *, for default entry +# - the wildcard %, can be also used with %group syntax, +# for maxlogin limit +# - NOTE: group and wildcard limits are not applied to root. +# To apply a limit to the root user, <domain> must be +# the literal username root. +# +#<type> can have the two values: +# - "soft" for enforcing the soft limits +# - "hard" for enforcing hard limits +# +#<item> can be one of the following: +# - core - limits the core file size (KB) +# - data - max data size (KB) +# - fsize - maximum filesize (KB) +# - memlock - max locked-in-memory address space (KB) +# - nofile - max number of open files +# - rss - max resident set size (KB) +# - stack - max stack size (KB) +# - cpu - max CPU time (MIN) +# - nproc - max number of processes +# - as - address space limit (KB) +# - maxlogins - max number of logins for this user +# - maxsyslogins - max number of logins on the system +# - priority - the priority to run user process with +# - locks - max number of file locks the user can hold +# - sigpending - max number of pending signals +# - msgqueue - max memory used by POSIX message queues (bytes) +# - nice - max nice priority allowed to raise to values: [-20, 19] +# - rtprio - max realtime priority +# - chroot - change root to directory (Debian-specific) +# +#<domain> <type> <item> <value> +# + +#* soft core 0 +#root hard core 100000 +#* hard rss 10000 +#@student hard nproc 20 +#@faculty soft nproc 20 +#@faculty hard nproc 50 +#ftp hard nproc 0 +#ftp - chroot /ftp +#@student - maxlogins 4 + +* soft core unlimited + +# End of file diff --git a/testing/hosts/default/etc/ssh/sshd_config b/testing/hosts/default/etc/ssh/sshd_config new file mode 100644 index 000000000..07b7e78e5 --- /dev/null +++ b/testing/hosts/default/etc/ssh/sshd_config @@ -0,0 +1,13 @@ +Port 22 +Protocol 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +UsePrivilegeSeparation no +PermitRootLogin yes +StrictModes no +PubkeyAuthentication no +PermitEmptyPasswords yes +PrintMotd no +PrintLastLog no +UsePAM no diff --git a/testing/hosts/default/etc/sysctl.conf b/testing/hosts/default/etc/sysctl.conf new file mode 100644 index 000000000..43010d52e --- /dev/null +++ b/testing/hosts/default/etc/sysctl.conf @@ -0,0 +1,62 @@ +# +# /etc/sysctl.conf - Configuration file for setting system variables +# See /etc/sysctl.d/ for additonal system variables +# See sysctl.conf (5) for information. +# + +#kernel.domainname = example.com + +# Uncomment the following to stop low-level messages on console +#kernel.printk = 3 4 1 3 + +##############################################################3 +# Functions previously found in netbase +# + +# Uncomment the next two lines to enable Spoof protection (reverse-path filter) +# Turn on Source Address Verification in all interfaces to +# prevent some spoofing attacks +#net.ipv4.conf.default.rp_filter=1 +#net.ipv4.conf.all.rp_filter=1 + +# Uncomment the next line to enable TCP/IP SYN cookies +# See http://lwn.net/Articles/277146/ +# Note: This may impact IPv6 TCP sessions too +#net.ipv4.tcp_syncookies=1 + +# Uncomment the next line to enable packet forwarding for IPv4 +net.ipv4.ip_forward=1 + +# Uncomment the next line to enable packet forwarding for IPv6 +# Enabling this option disables Stateless Address Autoconfiguration +# based on Router Advertisements for this host +net.ipv6.conf.all.forwarding=1 + + +################################################################### +# Additional settings - these settings can improve the network +# security of the host and prevent against some network attacks +# including spoofing attacks and man in the middle attacks through +# redirection. Some network environments, however, require that these +# settings are disabled so review and enable them as needed. +# +# Do not accept ICMP redirects (prevent MITM attacks) +#net.ipv4.conf.all.accept_redirects = 0 +#net.ipv6.conf.all.accept_redirects = 0 +# _or_ +# Accept ICMP redirects only for gateways listed in our default +# gateway list (enabled by default) +# net.ipv4.conf.all.secure_redirects = 1 +# +# Do not send ICMP redirects (we are not a router) +#net.ipv4.conf.all.send_redirects = 0 +# +# Do not accept IP source route packets (we are not a router) +#net.ipv4.conf.all.accept_source_route = 0 +#net.ipv6.conf.all.accept_source_route = 0 +# +# Log Martian Packets +#net.ipv4.conf.all.log_martians = 1 + +# Enable coredump for suid binaries +fs.suid_dumpable = 1 diff --git a/testing/hosts/default/root/.ssh/config b/testing/hosts/default/root/.ssh/config new file mode 100644 index 000000000..aa102a144 --- /dev/null +++ b/testing/hosts/default/root/.ssh/config @@ -0,0 +1,3 @@ +Host * + StrictHostKeyChecking no + UserKnownHostsFile /dev/null diff --git a/testing/hosts/default/usr/local/bin/expect-connection b/testing/hosts/default/usr/local/bin/expect-connection new file mode 100755 index 000000000..10a709255 --- /dev/null +++ b/testing/hosts/default/usr/local/bin/expect-connection @@ -0,0 +1,27 @@ +#!/bin/bash +# +# Wait until a given IPsec connection becomes available +# +# Params: +# $1 - connection name +# $2 - maximum time to wait in seconds, default is 5 seconds + +if [[ $# -lt 1 || $# -gt 2 ]] +then + echo "invalid arguments" + exit 1 +fi + +secs=$2 +[ ! $secs ] && secs=5 + +let steps=$secs*10 +for i in `seq 1 $steps` +do + ipsec statusall 2>&1 | grep ^[[:space:]]*$1: >/dev/null + [ $? -eq 0 ] && exit 0 + sleep 0.1 +done + +echo "Connection '$1' not available after $secs second(s)" +exit 1 diff --git a/testing/hosts/moon/etc/conf.d/hostname b/testing/hosts/moon/etc/conf.d/hostname deleted file mode 100644 index 78e695337..000000000 --- a/testing/hosts/moon/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=moon diff --git a/testing/hosts/moon/etc/conf.d/net b/testing/hosts/moon/etc/conf.d/net deleted file mode 100644 index 7f09fd8a5..000000000 --- a/testing/hosts/moon/etc/conf.d/net +++ /dev/null @@ -1,12 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_MOON broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_MOON/16" ) -config_eth1=( "PH_IP_MOON1 broadcast 10.1.255.255 netmask 255.255.0.0" - "PH_IP6_MOON1/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/moon/etc/hostname b/testing/hosts/moon/etc/hostname new file mode 100644 index 000000000..605185ef1 --- /dev/null +++ b/testing/hosts/moon/etc/hostname @@ -0,0 +1 @@ +moon diff --git a/testing/hosts/moon/etc/init.d/iptables b/testing/hosts/moon/etc/init.d/iptables deleted file mode 100755 index f5fa80b26..000000000 --- a/testing/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/moon/etc/init.d/net.eth0 b/testing/hosts/moon/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/moon/etc/init.d/net.eth1 b/testing/hosts/moon/etc/init.d/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/init.d/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/moon/etc/ipsec.conf b/testing/hosts/moon/etc/ipsec.conf index 6ee481e49..623e75d0a 100755..100644 --- a/testing/hosts/moon/etc/ipsec.conf +++ b/testing/hosts/moon/etc/ipsec.conf @@ -7,20 +7,20 @@ conn %default keylife=20m rekeymargin=3m keyingtries=1 - left=PH_IP_MOON + left=192.168.0.1 leftcert=moonCert.pem leftid=@moon.strongswan.org leftfirewall=yes conn net-net leftsubnet=10.1.0.0/16 - right=PH_IP_SUN + right=192.168.0.2 rightsubnet=10.2.0.0/16 rightid=@sun.strongswan.org auto=add - + conn host-host - right=PH_IP_SUN + right=192.168.0.2 rightid=@sun.strongswan.org auto=add diff --git a/testing/hosts/moon/etc/network/interfaces b/testing/hosts/moon/etc/network/interfaces new file mode 100644 index 000000000..fde2f102f --- /dev/null +++ b/testing/hosts/moon/etc/network/interfaces @@ -0,0 +1,21 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.1 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::1 + netmask 16 + +auto eth1 +iface eth1 inet static + address 10.1.0.1 + netmask 255.255.0.0 + broadcast 10.1.255.255 +iface eth1 inet6 static + address fec1::1 + netmask 16 diff --git a/testing/hosts/moon/etc/rc.local b/testing/hosts/moon/etc/rc.local new file mode 100755 index 000000000..8649a2bcb --- /dev/null +++ b/testing/hosts/moon/etc/rc.local @@ -0,0 +1,20 @@ +#!/bin/sh -e +# +# rc.local +# +# This script is executed at the end of each multiuser runlevel. +# Make sure that the script will "exit 0" on success or any other +# value on error. +# +# In order to enable or disable this script just change the execution +# bits. +# + +# Disable checksum offloading on eth1 because it does not currently work with +# libvirt and isc-dhcp-server running on venus, see [1] +# [1] - https://bugs.mageia.org/show_bug.cgi?id=1243 + +ethtool --offload eth1 tx off >/dev/null 2>&1 +ethtool --offload eth1 rx off >/dev/null 2>&1 + +exit 0 diff --git a/testing/hosts/moon/etc/runlevels/default/net.eth0 b/testing/hosts/moon/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/moon/etc/runlevels/default/net.eth1 b/testing/hosts/moon/etc/runlevels/default/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/runlevels/default/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/ssh_host_rsa_key.pub b/testing/hosts/ssh_host_rsa_key.pub deleted file mode 100644 index a5f71de4e..000000000 --- a/testing/hosts/ssh_host_rsa_key.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsxKfTm05po6leGD8C+M0eAR5EE4s1pQXc0D/dVlqrmfZ65h5BFQY9lnwpCvapV6OVqKWx8ICmeIH3OhaPxPPNKlU81f3d0xgh8BRJpWh459DYkRVa5f7ax5eeFE1lelj9s1d0seUl/IZolpJ8Wmt9TN1hwJ0mrkwN4670rb3urc= diff --git a/testing/hosts/sun/etc/conf.d/hostname b/testing/hosts/sun/etc/conf.d/hostname deleted file mode 100644 index bc042b68b..000000000 --- a/testing/hosts/sun/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=sun diff --git a/testing/hosts/sun/etc/conf.d/net b/testing/hosts/sun/etc/conf.d/net deleted file mode 100644 index 4a6370ab7..000000000 --- a/testing/hosts/sun/etc/conf.d/net +++ /dev/null @@ -1,14 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_SUN broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_SUN/16" ) -config_eth1=( "PH_IP_SUN1 broadcast 10.2.255.255 netmask 255.255.0.0" - "PH_IP6_SUN1/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) - - diff --git a/testing/hosts/sun/etc/hostname b/testing/hosts/sun/etc/hostname new file mode 100644 index 000000000..692699759 --- /dev/null +++ b/testing/hosts/sun/etc/hostname @@ -0,0 +1 @@ +sun diff --git a/testing/hosts/sun/etc/init.d/iptables b/testing/hosts/sun/etc/init.d/iptables deleted file mode 100755 index aeaf472fb..000000000 --- a/testing/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/sun/etc/init.d/net.eth0 b/testing/hosts/sun/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/sun/etc/init.d/net.eth1 b/testing/hosts/sun/etc/init.d/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/init.d/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/sun/etc/ipsec.conf b/testing/hosts/sun/etc/ipsec.conf index 277928ec1..2f979f122 100755..100644 --- a/testing/hosts/sun/etc/ipsec.conf +++ b/testing/hosts/sun/etc/ipsec.conf @@ -7,20 +7,20 @@ conn %default keylife=20m rekeymargin=3m keyingtries=1 - left=PH_IP_SUN + left=192.168.0.2 leftcert=sunCert.pem leftid=@sun.strongswan.org leftfirewall=yes conn net-net leftsubnet=10.2.0.0/16 - right=PH_IP_MOON + right=192.168.0.1 rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add conn host-host - right=PH_IP_MOON + right=192.168.0.1 rightid=@moon.strongswan.org auto=add diff --git a/testing/hosts/sun/etc/network/interfaces b/testing/hosts/sun/etc/network/interfaces new file mode 100644 index 000000000..841735af1 --- /dev/null +++ b/testing/hosts/sun/etc/network/interfaces @@ -0,0 +1,21 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.2 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::2 + netmask 16 + +auto eth1 +iface eth1 inet static + address 10.2.0.1 + netmask 255.255.0.0 + broadcast 10.2.255.255 +iface eth1 inet6 static + address fec2::1 + netmask 16 diff --git a/testing/hosts/sun/etc/runlevels/default/net.eth0 b/testing/hosts/sun/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/sun/etc/runlevels/default/net.eth1 b/testing/hosts/sun/etc/runlevels/default/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/runlevels/default/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/venus/etc/conf.d/hostname b/testing/hosts/venus/etc/conf.d/hostname deleted file mode 100644 index c9e3dd1d4..000000000 --- a/testing/hosts/venus/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=venus diff --git a/testing/hosts/venus/etc/conf.d/net b/testing/hosts/venus/etc/conf.d/net deleted file mode 100644 index 43ec97807..000000000 --- a/testing/hosts/venus/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_VENUS broadcast 10.1.255.255 netmask 255.255.0.0" - "PH_IP6_VENUS/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via PH_IP_MOON1" ) diff --git a/testing/hosts/venus/etc/hostname b/testing/hosts/venus/etc/hostname new file mode 100644 index 000000000..acf16d8be --- /dev/null +++ b/testing/hosts/venus/etc/hostname @@ -0,0 +1 @@ +venus diff --git a/testing/hosts/venus/etc/init.d/iptables b/testing/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 1097ac5a4..000000000 --- a/testing/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/venus/etc/init.d/net.eth0 b/testing/hosts/venus/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/venus/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/venus/etc/ipsec.conf b/testing/hosts/venus/etc/ipsec.conf index dd6a82f89..e4604cb44 100755..100644 --- a/testing/hosts/venus/etc/ipsec.conf +++ b/testing/hosts/venus/etc/ipsec.conf @@ -13,7 +13,7 @@ conn nat-t leftcert=venusCert.pem leftid=@venus.strongswan.org leftfirewall=yes - right=PH_IP_SUN + right=192.168.0.2 rightid=@sun.strongswan.org rightsubnet=10.2.0.0/16 auto=add diff --git a/testing/hosts/venus/etc/network/interfaces b/testing/hosts/venus/etc/network/interfaces new file mode 100644 index 000000000..9cbae6041 --- /dev/null +++ b/testing/hosts/venus/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 10.1.0.20 + netmask 255.255.0.0 + broadcast 10.1.255.255 + gateway 10.1.0.1 +iface eth0 inet6 static + address fec1::20 + netmask 16 diff --git a/testing/hosts/venus/etc/runlevels/default/net.eth0 b/testing/hosts/venus/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/venus/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text b/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text new file mode 100644 index 000000000..6f5f3011c --- /dev/null +++ b/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text @@ -0,0 +1 @@ +AddType text/plain .iptables .log .sql diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt b/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt deleted file mode 100644 index 0de3b268d..000000000 --- a/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt +++ /dev/null @@ -1,22 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ -MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS -b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE -BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u -Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y -X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f -FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc -4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/ -7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5 -gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr -K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud -DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw -ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD -VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg -Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/ -lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n -+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE -UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy -0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy -gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8= ------END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt b/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt deleted file mode 100644 index 956c217d9..000000000 --- a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt +++ /dev/null @@ -1,24 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEFTCCAv2gAwIBAgIBDjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ -MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS -b290IENBMB4XDTA1MDYwODE5MTcxNFoXDTEwMDYwNzE5MTcxNFowSjELMAkGA1UE -BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xIDAeBgNVBAMTF3dpbm5l -dG91LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC -AQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqXuh16Ahe3S5vZ -F56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/u7BlyqpBUtLa -r14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRBK2gQGBUULo26 -sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqVjlKyqG7vdggk -wW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3MuOP3FNHIRMd2H -AcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABo4IBCTCCAQUwCQYDVR0TBAIwADALBgNV -HQ8EBAMCA6gwHQYDVR0OBBYEFEMS0mbhrA4zDvmfKf4MntUNxkH4MG0GA1UdIwRm -MGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcG -A1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290 -IENBggEAMCIGA1UdEQQbMBmCF3dpbm5ldG91LnN0cm9uZ3N3YW4ub3JnMDkGA1Ud -HwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dh -bi5jcmwwDQYJKoZIhvcNAQEEBQADggEBACO4+j1Mwt/lbkopeSJst46uFh7OtegG -6IWNE30i3l3FIn9slSwAOMtmZR0hAF8sExvk61EPlzCR/d9trSJ5+gyjPkeF/enw -p61rxPMT13Grzomi9gYlk6Q/0zLmE9uYWEY69Q0bEIUcfdZfwB+F7kesa946JNMc -yHfVEhKtvzmns9ueG0S/8E+6MPDeJv+JHQ++SdWSvOVg6JNxXDGusnim2fjM2Aln -JmqA6iU4IaPl9DUCuXlLOVv/YhwhviNEbF94upyHq8xjOZdzPbKroHXg/2yvalAw -4aXc/ZsnFxqsq3i6a2Fj1Y4J7gYsNO/HwA0xvKz3loOTqHaJqO/qeow= ------END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key b/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key deleted file mode 100644 index 727027188..000000000 --- a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqX -uh16Ahe3S5vZF56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/ -u7BlyqpBUtLar14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRB -K2gQGBUULo26sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqV -jlKyqG7vdggkwW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3Mu -OP3FNHIRMd2HAcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABAoIBACYiWrCgl8B/c4Lz -Uay4Tlm8hvQ/zQJjY3v93EXwbB21hBV8qrYlt9zGfHqj+5q2vsbB9c0pzdO2VDba -EWueS2fUIWhglEG5VCebrztNCldx2O7jo9bMk8iBt+oLNaJunSK7ACeYHHGcE7dF -KZh1eyd7z4+SMBWZqmhO5ZisasQoHCusVGepcyyMGQNkc3XKJ6resGAsOqrOoq7Q -C4vO5Kkbnk8nnEGmQ/ldD8LwIyq1hzVLDiiqWXZgh6S5l4BEo7Dy3KYrZoZfVcZK -GMVhAI2+uA1ZqY9twpwryT6VZ3eK4DXF/COQntiBW5pLOpaqTOnKqiVmZFwfbo3u -cq8n5jkCgYEA5zgzRLifbM0q34c2HX8pTegh+BH7MGCxtcoU2uRPaXiGkqQObHI9 -aItrgUQp+pAmKSBnEWJKgKsOh2Uf5ogjIeNuruGG/AXw/Pw2ORHNueenhDuhu69T -E2I4yxT3PPYbdzJ4ylBElfgm9WTrv7Wi7wSSfgQ6rEFdWukXa5vvsqMCgYEA1K+q -m1Jv9MGVIVc6MxhuOOj2Ym+qcWt/Pjvg78rR8SRsKwHlGTuv1rdWUSXYDr3f2Nf7 -6DdbJtaSx5f8gY/UG34yGZx5FFbYV03vcCYBaLXsi/b6H7vb/VW74Y5g6bXqnprv -4mcdVU7xfyNFgdbLPAP9sYVLijPYDwm0Qq3cz/8CgYBKSJz4BBR8AQI4JBl3qoXb -mKtpJmW76iTN0amXlWgJ64XYkMptftpJvxj/w6V08WDBL77NL/XdlpcpWozAJJac -6ZOCrcQPLd15eZH2Dck5Y7pG2l2gjbgz7wdt/0NbG3pBdj6mSNlwEPR7PDwdMD6z -aZWi1LsA4lMaxO4YTVXZ3wKBgQCoFhTNH/+e/YawjNFQJFSn4WUnMn0Pmhc7xfLl -T/NPkqtx6dN3d7ZmCQrMow33yJOqOje5tFXzgc0KtNE4S8Uj3T4XA5SlQGVFyjAa -/85JRM2naA8RGVSpCCKuBeoNilnb8zL2SOvjyboN8oAyNuDzk2vh6ihjFsoASHkP -4XwLXQKBgQC0k6rzt/plIwEiP56XXOqwOxJj6kuE/hx1zGIiGT6lWiOsih20Ym2T -kYegVFvuDIWmSIAxGONWyee1lfnJbEuaHRixWQTnHUpqrU0FSnZTubnR3q/faZat -hrvLDdpa0ydAKoMEn3qUPSrh3CdBfi3KTQAQn2Mlk7bGHh9ICWi3vA== ------END RSA PRIVATE KEY----- diff --git a/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf b/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf deleted file mode 100644 index 72b7e0ea4..000000000 --- a/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf +++ /dev/null @@ -1,61 +0,0 @@ -# DefaultType: the default MIME type the server will use for a document -# if it cannot otherwise determine one, such as from filename extensions. -# If your server contains mostly text or HTML documents, "text/plain" is -# a good value. If most of your content is binary, such as applications -# or images, you may want to use "application/octet-stream" instead to -# keep browsers from trying to display binary files as though they are -# text. -DefaultType text/plain - -<IfModule mime_module> -# TypesConfig points to the file containing the list of mappings from -# filename extension to MIME-type. -TypesConfig /etc/mime.types - -# AddType allows you to add to or override the MIME configuration -# file specified in TypesConfig for specific file types. -#AddType application/x-gzip .tgz - -# AddEncoding allows you to have certain browsers uncompress -# information on the fly. Note: Not all browsers support this. -#AddEncoding x-compress .Z -#AddEncoding x-gzip .gz .tgz - -# If the AddEncoding directives above are commented-out, then you -# probably should define those extensions to indicate media types: -AddType application/x-compress .Z -AddType application/x-gzip .gz .tgz - -# AddHandler allows you to map certain file extensions to "handlers": -# actions unrelated to filetype. These can be either built into the server -# or added with the Action directive (see below) - -# To use CGI scripts outside of ScriptAliased directories: -# (You will also need to add "ExecCGI" to the "Options" directive.) -AddHandler cgi-script .cgi - -# For files that include their own HTTP headers: -#AddHandler send-as-is asis - -# For server-parsed imagemap files: -#AddHandler imap-file map - -# For type maps (negotiated resources): -AddHandler type-map var - -# Filters allow you to process content before it is sent to the client. -# -# To parse .shtml files for server-side includes (SSI): -# (You will also need to add "Includes" to the "Options" directive.) -#AddType text/html .shtml -#AddOutputFilter INCLUDES .shtml -</IfModule> - -<IfModule mime_magic_module> -# The mod_mime_magic module allows the server to use various hints from the -# contents of the file itself to determine its type. The MIMEMagicFile -# directive tells the module where the hint definitions are located. -MIMEMagicFile /etc/apache2/magic -</IfModule> - -# vim: ts=4 filetype=apache diff --git a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf b/testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost index 9a32412db..b76080e37 100644 --- a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf +++ b/testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost @@ -2,6 +2,8 @@ Listen 8880 +AddHandler cgi-script .cgi + <VirtualHost *:8880> ServerAdmin root@strongswan.org DocumentRoot /etc/openssl/ocsp diff --git a/testing/hosts/winnetou/etc/conf.d/hostname b/testing/hosts/winnetou/etc/conf.d/hostname deleted file mode 100644 index 1bfa5acbd..000000000 --- a/testing/hosts/winnetou/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=winnetou diff --git a/testing/hosts/winnetou/etc/conf.d/net b/testing/hosts/winnetou/etc/conf.d/net deleted file mode 100644 index 7fbc37014..000000000 --- a/testing/hosts/winnetou/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_WINNETOU broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_WINNETOU/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/winnetou/etc/conf.d/slapd b/testing/hosts/winnetou/etc/conf.d/slapd deleted file mode 100644 index 8d9ac4787..000000000 --- a/testing/hosts/winnetou/etc/conf.d/slapd +++ /dev/null @@ -1,8 +0,0 @@ -# conf.d file for the openldap-2.1 series -# -# To enable both the standard unciphered server and the ssl encrypted -# one uncomment this line or set any other server starting options -# you may desire. -# -# OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'" -OPTS="-4" diff --git a/testing/hosts/winnetou/etc/init.d/apache2 b/testing/hosts/winnetou/etc/init.d/apache2 deleted file mode 100755 index 5f72d3090..000000000 --- a/testing/hosts/winnetou/etc/init.d/apache2 +++ /dev/null @@ -1,121 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2007 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="configtest fullstatus graceful gracefulstop modules reload" - -depend() { - need net - use mysql dns logger netmount postgresql - after sshd -} - -configtest() { - ebegin "Checking Apache Configuration" - checkconfig - eend $? -} - -checkconfig() { - SERVERROOT="${SERVERROOT:-/usr/lib/apache2}" - if [ ! -d ${SERVERROOT} ]; then - eerror "SERVERROOT does not exist: ${SERVERROOT}" - return 1 - fi - - CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}" - [ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}" - if [ ! -r "${CONFIGFILE}" ]; then - eerror "Unable to read configuration file: ${CONFIGFILE}" - return 1 - fi - - APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}" - APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}" - [ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}" - - APACHE2="/usr/sbin/apache2" - - ${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1 - ret=$? - if [ $ret -ne 0 ]; then - eerror "Apache2 has detected a syntax error in your configuration files:" - ${APACHE2} ${APACHE2_OPTS} -t - fi - - return $ret -} - -start() { - checkconfig || return 1 - ebegin "Starting apache2" - [ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache - - start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start - eend $? -} - -stop() { - checkconfig || return 1 - ebegin "Stopping apache2" - start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -reload() { - RELOAD_TYPE="${RELOAD_TYPE:-graceful}" - - checkconfig || return 1 - if [ "${RELOAD_TYPE}" = "restart" ]; then - ebegin "Restarting apache2" - start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - elif [ "${RELOAD_TYPE}" = "graceful" ]; then - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - else - eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2" - fi -} - -graceful() { - checkconfig || return 1 - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -gracefulstop() { - checkconfig || return 1 - - # zap! - if service_started "${myservice}"; then - mark_service_stopped "${myservice}" - fi - - ebegin "Gracefully stopping apache2" - # 28 is SIGWINCH - start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -modules() { - checkconfig || return 1 - - ${APACHE2} ${APACHE2_OPTS} -M 2>&1 -} - -status() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } ' -} - -fullstatus() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} -} diff --git a/testing/hosts/winnetou/etc/init.d/net.eth0 b/testing/hosts/winnetou/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/winnetou/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/winnetou/etc/init.d/slapd b/testing/hosts/winnetou/etc/init.d/slapd deleted file mode 100755 index d4c070b33..000000000 --- a/testing/hosts/winnetou/etc/init.d/slapd +++ /dev/null @@ -1,25 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/strongswan/testing/hosts/winnetou/etc/init.d/slapd,v 1.2 2005/05/31 14:04:43 as Exp $ - -depend() { - need net -} - -start() { - ebegin "Starting ldap-server" - eval start-stop-daemon --start --quiet --pidfile /var/run/openldap/slapd.pid --exec /usr/lib/openldap/slapd -- -u ldap -g ldap "${OPTS}" - eend $? - if [ ! -e /var/lib/openldap-data/objectClass.bdb ] - then - sleep 5 - ldapadd -x -D "cn=Manager, o=Linux strongSwan, c=CH" -w tuxmux -f /etc/openldap/ldif.txt - fi -} - -stop() { - ebegin "Stopping ldap-server" - start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/slapd.pid - eend $? -} diff --git a/testing/hosts/winnetou/etc/openldap/ldif.txt b/testing/hosts/winnetou/etc/ldap/ldif.txt index 3eca4d6c6..d06621adb 100644 --- a/testing/hosts/winnetou/etc/openldap/ldif.txt +++ b/testing/hosts/winnetou/etc/ldap/ldif.txt @@ -28,7 +28,7 @@ cACertificate;binary:< file:///etc/openssl/research/researchCert.der dn: ou=Sales, o=Linux strongSwan, c=CH objectclass: organizationalUnit -ou: Sales +ou: Sales dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH objectClass: organizationalRole @@ -37,4 +37,3 @@ objectClass: certificationAuthority authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl cACertificate;binary:< file:///etc/openssl/sales/salesCert.der - diff --git a/testing/hosts/winnetou/etc/ldap/slapd.conf b/testing/hosts/winnetou/etc/ldap/slapd.conf new file mode 100644 index 000000000..103d4573f --- /dev/null +++ b/testing/hosts/winnetou/etc/ldap/slapd.conf @@ -0,0 +1,23 @@ +# +# See slapd.conf(5) for details on configuration options. +# This file should NOT be world readable. +# + +moduleload back_bdb.la + +include /etc/ldap/schema/core.schema + +pidfile /var/run/openldap/slapd.pid +argsfile /var/run/openldap/slapd.args + +####################################################################### +# BDB database definitions +####################################################################### + +database bdb +suffix "o=Linux strongSwan,c=CH" +rootdn "cn=Manager,o=Linux strongSwan,c=CH" +checkpoint 32 30 +rootpw tuxmux +directory /var/lib/ldap +index objectClass eq diff --git a/testing/hosts/winnetou/etc/network/interfaces b/testing/hosts/winnetou/etc/network/interfaces new file mode 100644 index 000000000..7bfb6a9f2 --- /dev/null +++ b/testing/hosts/winnetou/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.150 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::15 + netmask 16 diff --git a/testing/hosts/winnetou/etc/openldap/slapd.conf b/testing/hosts/winnetou/etc/openldap/slapd.conf deleted file mode 100644 index 5a99f955d..000000000 --- a/testing/hosts/winnetou/etc/openldap/slapd.conf +++ /dev/null @@ -1,68 +0,0 @@ -# -# See slapd.conf(5) for details on configuration options. -# This file should NOT be world readable. -# -include /etc/openldap/schema/core.schema - -# Define global ACLs to disable default read access. - -# Do not enable referrals until AFTER you have a working directory -# service AND an understanding of referrals. -#referral ldap://root.openldap.org - -pidfile /var/run/openldap/slapd.pid -argsfile /var/run/openldap/slapd.args - -# Load dynamic backend modules: -# modulepath /usr/lib/openldap/openldap -# moduleload back_bdb.la -# moduleload back_ldap.la -# moduleload back_ldbm.la -# moduleload back_passwd.la -# moduleload back_shell.la - -# Sample security restrictions -# Require integrity protection (prevent hijacking) -# Require 112-bit (3DES or better) encryption for updates -# Require 63-bit encryption for simple bind -# security ssf=1 update_ssf=112 simple_bind=64 - -# Sample access control policy: -# Root DSE: allow anyone to read it -# Subschema (sub)entry DSE: allow anyone to read it -# Other DSEs: -# Allow self write access -# Allow authenticated users read access -# Allow anonymous users to authenticate -# Directives needed to implement policy: -# access to dn.base="" by * read -# access to dn.base="cn=Subschema" by * read -# access to * -# by self write -# by users read -# by anonymous auth -# -# if no access controls are present, the default policy -# allows anyone and everyone to read anything but restricts -# updates to rootdn. (e.g., "access to * by * read") -# -# rootdn can always read and write EVERYTHING! - -####################################################################### -# BDB database definitions -####################################################################### - -database bdb -suffix "o=Linux strongSwan,c=CH" -rootdn "cn=Manager,o=Linux strongSwan,c=CH" -checkpoint 32 30 # <kbyte> <min> -# Cleartext passwords, especially for the rootdn, should -# be avoid. See slappasswd(8) and slapd.conf(5) for details. -# Use of strong authentication encouraged. -rootpw tuxmux -# The database directory MUST exist prior to running slapd AND -# should only be accessible by the slapd and slap tools. -# Mode 700 recommended. -directory /var/lib/openldap-data -# Indices to maintain -index objectClass eq diff --git a/testing/hosts/winnetou/etc/openssl/generate-crl b/testing/hosts/winnetou/etc/openssl/generate-crl index 60e53a0a4..839816bf5 100755 --- a/testing/hosts/winnetou/etc/openssl/generate-crl +++ b/testing/hosts/winnetou/etc/openssl/generate-crl @@ -16,30 +16,32 @@ export COMMON_NAME=strongSwan +ROOT=/var/www + cd /etc/openssl openssl ca -gencrl -crldays 30 -config /etc/openssl/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan.crl -cp strongswan.crl /var/www/localhost/htdocs/ -cp strongswanCert.pem /var/www/localhost/htdocs/ -cp index.html /var/www/localhost/htdocs/ +cp strongswan.crl ${ROOT} +cp strongswanCert.pem ${ROOT} +cp index.html ${ROOT} cd /etc/openssl/research openssl ca -gencrl -crldays 15 -config /etc/openssl/research/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out research.crl -cp research.crl /var/www/localhost/htdocs/ +cp research.crl ${ROOT} cd /etc/openssl/sales openssl ca -gencrl -crldays 15 -config /etc/openssl/sales/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out sales.crl -cp sales.crl /var/www/localhost/htdocs/ +cp sales.crl ${ROOT} cd /etc/openssl/ecdsa openssl ca -gencrl -crldays 15 -config /etc/openssl/ecdsa/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan_ec.crl -cp strongswan_ec.crl /var/www/localhost/htdocs/ +cp strongswan_ec.crl ${ROOT} cd /etc/openssl/monster openssl ca -gencrl -crldays 15 -config /etc/openssl/monster/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan-monster.crl -cp strongswan-monster.crl /var/www/localhost/htdocs/ +cp strongswan-monster.crl ${ROOT} cd /etc/openssl/rfc3779 openssl ca -gencrl -crldays 15 -config /etc/openssl/rfc3779/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan_rfc3779.crl -cp strongswan_rfc3779.crl /var/www/localhost/htdocs/ +cp strongswan_rfc3779.crl ${ROOT} diff --git a/testing/hosts/winnetou/etc/openssl/index.html b/testing/hosts/winnetou/etc/openssl/index.html index 1641768ae..8cbb2c482 100644 --- a/testing/hosts/winnetou/etc/openssl/index.html +++ b/testing/hosts/winnetou/etc/openssl/index.html @@ -20,10 +20,10 @@ </li> </ul> - <h2>strongSwan UML Testing Environment</h2> + <h2>strongSwan Testing Environment</h2> <ul> <li> - <a href="testresults/">UML Test Results</a> + <a href="testresults/">Test Results</a> </li> </ul> <a href="images/umlArchitecture_large.png" target="_blank"> diff --git a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index cb585ed08..a62fe16bd 100755 --- a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi index c193e8779..32405f81c 100755 --- a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi +++ b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl/research echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi index c53cb9a76..74a2aebc2 100755 --- a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi +++ b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl/sales echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/hosts/winnetou/etc/runlevels/default/apache2 b/testing/hosts/winnetou/etc/runlevels/default/apache2 deleted file mode 100755 index 5f72d3090..000000000 --- a/testing/hosts/winnetou/etc/runlevels/default/apache2 +++ /dev/null @@ -1,121 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2007 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="configtest fullstatus graceful gracefulstop modules reload" - -depend() { - need net - use mysql dns logger netmount postgresql - after sshd -} - -configtest() { - ebegin "Checking Apache Configuration" - checkconfig - eend $? -} - -checkconfig() { - SERVERROOT="${SERVERROOT:-/usr/lib/apache2}" - if [ ! -d ${SERVERROOT} ]; then - eerror "SERVERROOT does not exist: ${SERVERROOT}" - return 1 - fi - - CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}" - [ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}" - if [ ! -r "${CONFIGFILE}" ]; then - eerror "Unable to read configuration file: ${CONFIGFILE}" - return 1 - fi - - APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}" - APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}" - [ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}" - - APACHE2="/usr/sbin/apache2" - - ${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1 - ret=$? - if [ $ret -ne 0 ]; then - eerror "Apache2 has detected a syntax error in your configuration files:" - ${APACHE2} ${APACHE2_OPTS} -t - fi - - return $ret -} - -start() { - checkconfig || return 1 - ebegin "Starting apache2" - [ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache - - start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start - eend $? -} - -stop() { - checkconfig || return 1 - ebegin "Stopping apache2" - start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -reload() { - RELOAD_TYPE="${RELOAD_TYPE:-graceful}" - - checkconfig || return 1 - if [ "${RELOAD_TYPE}" = "restart" ]; then - ebegin "Restarting apache2" - start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - elif [ "${RELOAD_TYPE}" = "graceful" ]; then - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - else - eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2" - fi -} - -graceful() { - checkconfig || return 1 - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -gracefulstop() { - checkconfig || return 1 - - # zap! - if service_started "${myservice}"; then - mark_service_stopped "${myservice}" - fi - - ebegin "Gracefully stopping apache2" - # 28 is SIGWINCH - start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -modules() { - checkconfig || return 1 - - ${APACHE2} ${APACHE2_OPTS} -M 2>&1 -} - -status() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } ' -} - -fullstatus() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} -} diff --git a/testing/hosts/winnetou/etc/runlevels/default/net.eth0 b/testing/hosts/winnetou/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/winnetou/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/make-testing b/testing/make-testing index 7cd3324e0..84ac20bf2 100755 --- a/testing/make-testing +++ b/testing/make-testing @@ -1,87 +1,27 @@ #!/bin/bash -# Create the strongSwan UML testing environment -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -DIR=`dirname $0` +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf -source $DIR/scripts/function.sh +rm -f $LOGFILE +mkdir -p $BUILDDIR -[ -f $DIR/testing.conf ] || die "!! Configuration file 'testing.conf' not found." - -source $DIR/testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -########################################################################## -# build the UML kernel based on a vanilla kernel form kernel.org -# and a matching UML patch from user-mode-linux.sourceforge.net -# -if [ $ENABLE_BUILD_UMLKERNEL = "yes" ] -then - cecho "Building uml kernel (scripts/build-umlkernel)" - $DIR/scripts/build-umlkernel -fi - -########################################################################## -# Adding the ssh RSA public keys to ~/.ssh/known_hosts -# -if [ $ENABLE_BUILD_SSHKEYS = "yes" ] -then - cecho "Adding ssh public keys of the uml instances (scripts/build-sshkeys)" - $DIR/scripts/build-sshkeys -fi - -########################################################################## -# copy the default UML host configurations to $BUILDDIR -# and assign actual IP addresses to the UML hosts -# -if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ] +if [ $ENABLE_BUILD_BASEIMAGE = "yes" ] then - cecho "Building host configurations (scripts/build-hostconfig)" - $DIR/scripts/build-hostconfig + $DIR/scripts/build-baseimage || exit 1 fi -########################################################################## -# build a generic UML root file system based on a Gentoo root file system. -# compile and install a specified strongSwan release into the file system. -# -if [ $ENABLE_BUILD_UMLROOTFS = "yes" ] +if [ $ENABLE_BUILD_ROOTIMAGE = "yes" ] then - cecho "Building uml root file system with strongSwan (scripts/build-umlrootfs)" - $DIR/scripts/build-umlrootfs + $DIR/scripts/build-rootimage || exit 1 fi -########################################################################## -# Creating the root filesystems for the specified UML instances -# -if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ] +if [ $ENABLE_BUILD_GUESTKERNEL = "yes" ] then - cecho "Building uml host root file systems (scripts/build-umlhostfs)" - $DIR/scripts/build-umlhostfs $HOSTS + $DIR/scripts/build-guestkernel || exit 1 fi -########################################################################## -# Start up the UML switches and designated UML instances -# -if [ $ENABLE_START_TESTING = "yes" ] +if [ $ENABLE_BUILD_GUESTIMAGES = "yes" ] then - cecho "Starting the uml switches and instances (start-testing)" - $DIR/start-testing $HOSTS + $DIR/scripts/build-guestimages $HOSTS || exit 1 fi diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage new file mode 100755 index 000000000..1355d7a05 --- /dev/null +++ b/testing/scripts/build-baseimage @@ -0,0 +1,79 @@ +#!/bin/bash + +echo "Building base image" + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +[ `id -u` -eq 0 ] || die "You must be root to run $0" + +check_commands debootstrap mkfs.ext3 partprobe qemu-img qemu-nbd sfdisk + +# package includes/excludes +INC=build-essential,gperf,libgmp-dev,libldap2-dev,libcurl4-openssl-dev,ethtool +INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc +INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libxerces-c2-dev,libltdl-dev +INC=$INC,liblog4cxx10-dev,libboost-thread-dev,libboost-system-dev,git-core +INC=$INC,less,acpid,acpi-support-base +SERVICES="apache2 dbus isc-dhcp-server slapd" +INC=$INC,${SERVICES// /,} +EXC=iptables + +CACHEDIR=$BUILDDIR/cache +APTCACHE=$LOOPDIR/var/cache/apt/archives + +mkdir -p $LOOPDIR +mkdir -p $CACHEDIR +mkdir -p $IMGDIR +rm -f $BASEIMG + +echo "`date`, building $BASEIMG" >>$LOGFILE + +load_qemu_nbd + +log_action "Creating base image $BASEIMG" +execute "qemu-img create -f $IMGEXT $BASEIMG ${BASEIMGSIZE}M" + +log_action "Connecting image to NBD device $NBDEV" +execute "qemu-nbd -c $NBDEV $BASEIMG" +do_on_exit qemu-nbd -d $NBDEV + +log_action "Partitioning disk" +sfdisk /dev/nbd0 -D -uM >>$LOGFILE 2>&1 << EOF +; +EOF +if [ $? != 0 ] +then + log_status 1 + exit 1 +else + log_status 0 +fi +partprobe $NBDEV + +log_action "Creating ext3 filesystem" +execute "mkfs.ext3 $NBDPARTITION" + +log_action "Mounting $NBDPARTITION to $LOOPDIR" +execute "mount $NBDPARTITION $LOOPDIR" +do_on_exit graceful_umount $LOOPDIR + +log_action "Using $CACHEDIR as archive for apt" +mkdir -p $APTCACHE +execute "mount -o bind $CACHEDIR $APTCACHE" +do_on_exit graceful_umount $APTCACHE + +log_action "Running debootstrap ($BASEIMGSUITE, $BASEIMGARCH)" +execute "debootstrap --arch=$BASEIMGARCH --include=$INC --exclude $EXC $BASEIMGSUITE $LOOPDIR $BASEIMGMIRROR" + +for service in $SERVICES +do + log_action "Stopping service $service" + execute_chroot "/etc/init.d/$service stop" + log_action "Disabling service $service" + execute_chroot "update-rc.d -f $service remove" +done + +log_action "Disabling root password" +execute_chroot "passwd -d root" diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages new file mode 100755 index 000000000..f5669040e --- /dev/null +++ b/testing/scripts/build-guestimages @@ -0,0 +1,65 @@ +#!/bin/bash +# create specific guest images +# +# Copyright (C) 2004 Eric Marchionni, Patrik Rayo +# Zuercher Hochschule Winterthur +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. + +echo "Creating guest images" + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +HOSTSDIR=$DIR/../hosts + +[ `id -u` -eq 0 ] || die "You must be root to run $0" +[ -f $ROOTIMG ] || die "Root image $ROOTIMG not found" +[ -f $HOSTDIR ] || die "Hosts directory $HOSTSDIR not found" + +check_commands partprobe qemu-img qemu-nbd + +load_qemu_nbd + +mkdir -p $IMGDIR +mkdir -p $LOOPDIR + +# just to be sure +do_on_exit qemu-nbd -d $NBDEV +do_on_exit umount $LOOPDIR + +for host in $STRONGSWANHOSTS +do + log_action "Creating guest image for $host" + execute "qemu-img create -b $ROOTIMG -f $IMGEXT $IMGDIR/$host.$IMGEXT" 0 + execute "qemu-nbd -c $NBDEV $IMGDIR/$host.$IMGEXT" 0 + partprobe $NBDEV + execute "mount $NBDPARTITION $LOOPDIR" 0 + execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0 + execute "cp -rf $HOSTSDIR/default/* $LOOPDIR" 0 + if [ "$host" = "winnetou" ] + then + execute "mkdir $LOOPDIR/var/log/apache2/ocsp" 0 + execute "cp -rf $DIR/../images $LOOPDIR/var/www/" 0 + execute_chroot "ln -s /etc/openssl/certs /var/www/certs" 0 + execute_chroot "/etc/openssl/generate-crl" 0 + execute_chroot "update-rc.d apache2 defaults" 0 + execute_chroot "update-rc.d slapd defaults" 0 + execute_chroot "rm -rf /var/lib/ldap/*" 0 + execute_chroot "slapadd -l /etc/ldap/ldif.txt -f /etc/ldap/slapd.conf" 0 + execute_chroot "chown -R openldap:openldap /var/lib/ldap" 0 + fi + sync + execute "umount $LOOPDIR" 0 + execute "qemu-nbd -d $NBDEV" 0 + log_status 0 +done diff --git a/testing/scripts/build-guestkernel b/testing/scripts/build-guestkernel new file mode 100755 index 000000000..66a9fe7a4 --- /dev/null +++ b/testing/scripts/build-guestkernel @@ -0,0 +1,49 @@ +#!/bin/bash + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +echo "Building guest kernel version $KERNELVERSION" + +[ -f "$KERNELCONFIG" ] || die "Kernel config $KERNELCONFIG not found" + +check_commands bunzip2 bzcat make wget + +cd $BUILDDIR + +if [ ! -f "$KERNELTARBALL" ] +then + url=ftp://ftp.kernel.org/pub/linux/kernel/v3.x/$KERNELTARBALL + log_action "Downloading $url" + execute "wget -q $url" +fi + +if [[ $KERNELPATCH && ! -f "$KERNELPATCH" ]] +then + url=http://download.strongswan.org/uml/$KERNELPATCH + log_action "Downloading $url" + execute "wget -q $url" +fi + +log_action "Unpacking kernel" +execute "tar xjf $KERNELTARBALL" + +KERNELDIR=$BUILDDIR/$KERNEL +cd $KERNELDIR + +if [ $KERNELPATCH ] +then + log_action "Applying kernel patch" + bzcat ../$KERNELPATCH | patch -p1 >>$LOGFILE 2>&1 + log_status $? + [ $? -eq 0 ] || exit 1 +fi + +execute "cp $KERNELCONFIG .config" 0 + +echo "Creating kernel configuration, you might get prompted for new parameters" +make oldconfig 2>&1 | tee -a $LOGFILE + +log_action "Compiling the kernel" +execute "make -j5" diff --git a/testing/scripts/build-hostconfig b/testing/scripts/build-hostconfig deleted file mode 100755 index 0ebbc5264..000000000 --- a/testing/scripts/build-hostconfig +++ /dev/null @@ -1,122 +0,0 @@ -#!/bin/bash -# build the hosts configuration directory with the actual IP addresses -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found" -[ -d $DIR/../hosts ] || die "!! Directory 'hosts' not found" - -source $DIR/../testing.conf - -if [ ! -d $BUILDDIR ] -then - cecho " * Creating directory '$BUILDDIR'" - mkdir $BUILDDIR -fi - -######################################## -# copy default host configs to $BUILDDIR -# - -HOSTCONFIGDIR=${BUILDDIR}/hosts - -if [ -d $HOSTCONFIGDIR ] -then - rm -r $HOSTCONFIGDIR -fi - -mkdir $HOSTCONFIGDIR -cp -rfp ${UMLTESTDIR}/testing/hosts $BUILDDIR - -cecho " * Copied default host config directory to '$HOSTCONFIGDIR'" - -######################################## -# assign IP for each host to hostname -# - -cecho-n " * Generate default config for.." - -HOSTIP=`ifconfig eth0 |grep inet |sed -e "s/.*inet addr://" -e "s/ Bcast.*//"` - -for host in $STRONGSWANHOSTS -do - cecho-n "${host}.." - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - eval ipv6_${host}="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - - [ "`eval echo \\\$ipv4_${host}`" != "$HOSTIP" ] || die "$host has the same IP as eth0 (Host)! Please change that." - - case $host in - moon) - eval ipv4_moon1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - [ "`eval echo \\\$ipv4_moon1`" != "$HOSTIP" ] || die "eth1 of $host has the same IP as eth0 (Host)! Please change that." - searchandreplace PH_IP_MOON1 $ipv4_moon1 $HOSTCONFIGDIR - searchandreplace PH_IP_MOON $ipv4_moon $HOSTCONFIGDIR - eval ipv6_moon1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_MOON1 $ipv6_moon1 $HOSTCONFIGDIR - searchandreplace PH_IP6_MOON $ipv6_moon $HOSTCONFIGDIR - ;; - sun) - eval ipv4_sun1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - [ "`eval echo \\\$ipv4_sun1`" != "$HOSTIP" ] || die "eth1 of $host has the same IP as eth0 (Host)! Please change that." - searchandreplace PH_IP_SUN1 $ipv4_sun1 $HOSTCONFIGDIR - searchandreplace PH_IP_SUN $ipv4_sun $HOSTCONFIGDIR - eval ipv6_sun1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_SUN1 $ipv6_sun1 $HOSTCONFIGDIR - searchandreplace PH_IP6_SUN $ipv6_sun $HOSTCONFIGDIR - ;; - alice) - eval ipv4_alice1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_ALICE1 $ipv4_alice1 $HOSTCONFIGDIR - searchandreplace PH_IP_ALICE $ipv4_alice $HOSTCONFIGDIR - eval ipv6_alice1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_ALICE1 $ipv6_alice1 $HOSTCONFIGDIR - searchandreplace PH_IP6_ALICE $ipv6_alice $HOSTCONFIGDIR - ;; - venus) - searchandreplace PH_IP_VENUS $ipv4_venus $HOSTCONFIGDIR - searchandreplace PH_IP6_VENUS $ipv6_venus $HOSTCONFIGDIR - ;; - bob) - searchandreplace PH_IP_BOB $ipv4_bob $HOSTCONFIGDIR - searchandreplace PH_IP6_BOB $ipv6_bob $HOSTCONFIGDIR - ;; - carol) - eval ipv4_carol1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_CAROL1 $ipv4_carol1 $HOSTCONFIGDIR - searchandreplace PH_IP_CAROL $ipv4_carol $HOSTCONFIGDIR - eval ipv6_carol1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_CAROL1 $ipv6_carol1 $HOSTCONFIGDIR - searchandreplace PH_IP6_CAROL $ipv6_carol $HOSTCONFIGDIR - ;; - dave) - eval ipv4_dave1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_DAVE1 $ipv4_dave1 $HOSTCONFIGDIR - searchandreplace PH_IP_DAVE $ipv4_dave $HOSTCONFIGDIR - eval ipv6_dave1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_DAVE1 $ipv6_dave1 $HOSTCONFIGDIR - searchandreplace PH_IP6_DAVE $ipv6_dave $HOSTCONFIGDIR - ;; - winnetou) - searchandreplace PH_IP_WINNETOU $ipv4_winnetou $HOSTCONFIGDIR - searchandreplace PH_IP6_WINNETOU $ipv6_winnetou $HOSTCONFIGDIR - ;; - esac -done - -cgecho "done" diff --git a/testing/scripts/build-rootimage b/testing/scripts/build-rootimage new file mode 100755 index 000000000..8e10ce5f3 --- /dev/null +++ b/testing/scripts/build-rootimage @@ -0,0 +1,67 @@ +#!/bin/bash +# Create guest root image +# +# Copyright (C) 2004 Eric Marchionni, Patrik Rayo +# Zuercher Hochschule Winterthur +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. + +echo "Building root image" + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +[ `id -u` -eq 0 ] || die "You must be root to run $0" +[ -f "$BASEIMG" ] || die "Base image $BASEIMG not found" + +check_commands partprobe qemu-img qemu-nbd + +load_qemu_nbd + +mkdir -p $LOOPDIR +mkdir -p $SHAREDDIR/compile +mkdir -p $IMGDIR + +log_action "Creating root image $ROOTIMG" +execute "qemu-img create -b $BASEIMG -f $IMGEXT $ROOTIMG" + +log_action "Connecting root image to NBD device $NBDEV" +execute "qemu-nbd -c $NBDEV $ROOTIMG" +do_on_exit qemu-nbd -d $NBDEV +partprobe $NBDEV + +log_action "Mounting $NBDPARTITION to $LOOPDIR" +execute "mount $NBDPARTITION $LOOPDIR" +do_on_exit umount $LOOPDIR + +log_action "Mounting proc filesystem to $LOOPDIR/proc" +execute "mount -t proc none $LOOPDIR/proc" +do_on_exit umount $LOOPDIR/proc + +mkdir -p $LOOPDIR/root/shared +log_action "Mounting $SHAREDDIR as /root/shared" +execute "mount -o bind $SHAREDDIR $LOOPDIR/root/shared" +do_on_exit umount $LOOPDIR/root/shared + +echo "Installing software from source" +RECPDIR=$DIR/recipes +RECIPES=`ls $RECPDIR/*.mk | xargs -n1 basename` +execute "cp -r $RECPDIR/patches $LOOPDIR/root/shared/compile" 0 +for r in $RECIPES +do + cp $RECPDIR/$r ${LOOPDIR}/root/shared/compile + log_action "Installing from recipe $r" + execute_chroot "make SWANVERSION=$SWANVERSION -C /root/shared/compile -f $r" +done + +log_action "Removing /etc/resolv.conf" +execute "rm -f $LOOPDIR/etc/resolv.conf" diff --git a/testing/scripts/build-sshkeys b/testing/scripts/build-sshkeys deleted file mode 100755 index 799078557..000000000 --- a/testing/scripts/build-sshkeys +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# build the hosts configuration directory with the actual IP addresses -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found" -[ -d $DIR/../hosts ] || die "!! Directory 'hosts' not found" - -source $DIR/../testing.conf - -if [ ! -d $BUILDDIR ] -then - cecho " * Creating directory '$BUILDDIR'" - mkdir $BUILDDIR -fi - -LOGFILE=${BUILDDIR}/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -if [ ! -d ~/.ssh ] -then - cecho-n " * Creating directory '~/.ssh'.." - mkdir ~/.ssh - cgecho "done" -fi - -if [ -f ~/.ssh/known_hosts ] -then - cecho-n " * Backing up ~/.ssh/known_hosts to '~/.ssh/known_hosts.before_uml'.." - cp -fp ~/.ssh/known_hosts ~/.ssh/known_hosts.before_uml - cgecho "done" -else - cecho-n " * Creating '~/.ssh/known_hosts'" - touch ~/.ssh/known_hosts - cgecho "done" -fi - -for host in $HOSTNAMEIPV4 -do - HOSTNAME=`echo $host | awk -F, '{ print $1 }'` - IP=`echo $host | awk -F, '{ print $2 }'` - if [ `grep "$IP " ~/.ssh/known_hosts | wc -l` != "0" ] - then - cecho "!! Warning: An entry exists for the following IP address: $IP" - else - cecho-n " * Adding uml host $HOSTNAME ($IP) to '~/.ssh/known_hosts'.." - echo "$HOSTNAME,$IP `cat $DIR/../hosts/ssh_host_rsa_key.pub`" >> ~/.ssh/known_hosts - cgecho "done" - fi -done - -##################################### -# preparing ssh for PK authentication -# - -cecho-n " * Checking for ssh rsa key '~/.ssh/id_rsa.pub'.." -if [ -f ~/.ssh/id_rsa.pub ] -then - cecho "already exists" -else - cecho "not found" - cecho-n " * Generating ssh rsa key pair.." - echo "" | ssh-keygen -N "" -t rsa -f ~/.ssh/id_rsa >> $LOGFILE 2>&1 - cgecho "done" -fi diff --git a/testing/scripts/build-umlhostfs b/testing/scripts/build-umlhostfs deleted file mode 100755 index 75feaa4ed..000000000 --- a/testing/scripts/build-umlhostfs +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# create UML host file systems -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found." - -source $DIR/../testing.conf - -cd $BUILDDIR/root-fs - -[ -f gentoo-fs ] || die "!! Root file system 'gentoo-fs' not found." - -if [ ! -d $BUILDDIR ] -then - cecho-n " * Directory '$BUILDDIR' does not exist..creating.." - mkdir $BUILDDIR - cgecho "done" -fi - -LOGFILE=${BUILDDIR}/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -LOOPDIR=loop - -if [ ! -d $LOOPDIR ] -then - mkdir $LOOPDIR -fi - -cecho-n " * Creating root filesystem for.." - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -for host in $HOSTS -do - cecho-n "$host.." - cp gentoo-fs gentoo-fs-$host - mount -o loop gentoo-fs-$host $LOOPDIR - cp -rf $BUILDDIR/hosts/${host}/etc $LOOPDIR - if [ "$host" = "winnetou" ] - then - mkdir $LOOPDIR/var/log/apache2/ocsp - cp -rf $UMLTESTDIR/testing/images $LOOPDIR/var/www/localhost/htdocs - chroot $LOOPDIR ln -s /etc/openssl/certs /var/www/localhost/htdocs/certs - chroot $LOOPDIR /etc/openssl/generate-crl >> $LOGFILE 2>&1 - fi - chroot $LOOPDIR /etc/init.d/depscan.sh --update >> $LOGFILE 2>&1 - umount $LOOPDIR -done - -cgecho "done" diff --git a/testing/scripts/build-umlkernel b/testing/scripts/build-umlkernel deleted file mode 100755 index b9f0d710d..000000000 --- a/testing/scripts/build-umlkernel +++ /dev/null @@ -1,130 +0,0 @@ -#!/bin/bash -# build an UML kernel based on a vanilla kernel and UML patch -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -cecho-n " * Looking for kernel at '$KERNEL'.." -if [ -f "${KERNEL}" ] -then - cecho "found it" - KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'` - cecho " * Kernel version is $KERNELVERSION" -else - cecho "none" - exit -fi - -if [ ${UMLPATCH} ] -then - cecho-n " * Looking for uml patch at '$UMLPATCH'.." - if [ -f "${UMLPATCH}" ] - then - cecho "found it" - else - cecho "none" - exit - fi -fi - -cecho-n " * Looking for kernel config at '$KERNELCONFIG'.." -if [ -f "${KERNEL}" ] -then - cecho "found it" -else - cecho "none" - exit -fi - -####################################################### -# unpack kernel and create symlink -# - -if [ ! -d $BUILDDIR ] -then - cecho " * Creating directory '$BUILDDIR'" - mkdir $BUILDDIR -fi - -cecho " * Changing to directory '$BUILDDIR'" -cd $BUILDDIR - -LOGFILE=${BUILDDIR}/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -cecho-n " * Unpacking kernel.." -tar xjf $KERNEL >> $LOGFILE 2>&1 -cgecho "done" - -KERNELDIR=${BUILDDIR}/linux-${KERNELVERSION} - -if [ -d $KERNELDIR ] -then - cecho " * Kernel directory is '$KERNELDIR'" - cecho " * Creating symlink 'linux'" - if [ -d linux ] - then - rm linux - fi - ln -s linux-${KERNELVERSION} linux -else - cecho "!! Kernel directory '$KERNELDIR' can not be found" - exit -fi - -####################################################### -# patch kernel -# - -cecho " * Changing to directory '$KERNELDIR'" -cd $KERNELDIR - -if [ $UMLPATCH ] -then - cecho-n " * Applying uml patch.." - bzcat $UMLPATCH | patch -p1 >> $LOGFILE 2>&1 - cgecho "done" -fi - -####################################################### -# copy our default .config to linux and build kernel -# - -cp $KERNELCONFIG .config - -cecho "!!" -cecho "!! Making .config for kernel. You might be prompted for new parameters!" -cecho "!!" -make oldconfig ARCH=um SUBARCH=i386 2>&1 | tee -a $LOGFILE - -cecho-n " * Now compiling uml kernel.." -make linux ARCH=um SUBARCH=i386 >> $LOGFILE 2>&1 -cgecho "done" - -cecho-n " * Copying uml kernel to '${BUILDDIR}/linux-uml-${KERNELVERSION}'.." -mv linux ${BUILDDIR}/linux-uml-${KERNELVERSION} -cgecho "done" diff --git a/testing/scripts/build-umlrootfs b/testing/scripts/build-umlrootfs deleted file mode 100755 index 92595222c..000000000 --- a/testing/scripts/build-umlrootfs +++ /dev/null @@ -1,451 +0,0 @@ -#!/bin/bash -# Create UML root filesystem -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -STRONGSWANVERSION=`basename $STRONGSWAN .tar.bz2` - -cecho-n " * Looking for strongSwan at '$STRONGSWAN'.." -if [ -f "$STRONGSWAN" ] -then - cecho "found it" - cecho " * strongSwan version is '$STRONGSWANVERSION'" -else - cecho "none" - exit -fi - -cecho-n " * Looking for gentoo root filesystem at '$ROOTFS'.." -if [ -f "$ROOTFS" ] -then - cecho "found it" -else - cecho "none" - exit -fi - -[ -d $BUILDDIR ] || die "!! Directory '$BUILDDIR' does not exist" - -HOSTCONFIGDIR=$BUILDDIR/hosts - -[ -d $HOSTCONFIGDIR ] || die "!! Directory '$HOSTCONFIGDIR' does not exist" - -LOGFILE=$BUILDDIR/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -ROOTFSDIR=$BUILDDIR/root-fs - -if [ ! -d $ROOTFSDIR ] -then - cecho-n " * Root file system directory '$ROOTFSDIR' does not exist..creating.." - mkdir $ROOTFSDIR - cgecho "done" -fi - -cd $ROOTFSDIR - -LOOPDIR=$ROOTFSDIR/loop - -if [ ! -d $LOOPDIR ] -then - mkdir $LOOPDIR -fi - -###################################################### -# creating reiser-based uml root filesystem -# - -cecho-n " * Building basic root filesystem (gentoo).." -dd if=/dev/zero of=gentoo-fs count=$ROOTFSSIZE bs=1M >> $LOGFILE 2>&1 -mkreiserfs -q -f gentoo-fs >> $LOGFILE 2>&1 -mount -o loop gentoo-fs $LOOPDIR >> $LOGFILE 2>&1 -tar xjpf $ROOTFS -C $LOOPDIR >> $LOGFILE 2>&1 -cgecho "done" - -###################################################### -# remove /etc/resolv.conf -# -cecho " * Removing /etc/resolv.conf" -rm -f $LOOPDIR/etc/resolv.conf - -###################################################### -# copying default /etc/hosts to the root filesystem -# -cecho " * Copying '$HOSTCONFIGDIR/default/etc/hosts' to the root filesystem" -cp -fp $HOSTCONFIGDIR/default/etc/hosts $LOOPDIR/etc/hosts - -##################################################### -# extracting strongSwan into the root filesystem -# -cecho " * Extracting strongSwan into the root filesystem" -tar xjf $STRONGSWAN -C $LOOPDIR/root >> $LOGFILE 2>&1 - -###################################################### -# setting up mountpoint for shared source tree -# -if [ "${SHAREDTREE+set}" = "set" ]; then - cecho " * setting up shared strongswan tree at '$SHAREDTREE'" - mkdir $LOOPDIR/root/strongswan-shared - echo "" >> $LOOPDIR/etc/fstab - echo "none /root/strongswan-shared hostfs $SHAREDTREE" >> $LOOPDIR/etc/fstab -fi - -###################################################### -# installing strongSwan and setting the local timezone -# - -INSTALLSHELL=${LOOPDIR}/install.sh - -cecho " * Preparing strongSwan installation script" -echo "ln -sf /usr/share/zoneinfo/${TZUML} /etc/localtime" >> $INSTALLSHELL - -echo "cd /root/${STRONGSWANVERSION}" >> $INSTALLSHELL -echo -n "./configure --sysconfdir=/etc" >> $INSTALLSHELL -echo -n " --with-random-device=/dev/urandom" >> $INSTALLSHELL -echo -n " --disable-load-warning" >> $INSTALLSHELL - -if [ "$USE_LIBCURL" = "yes" ] -then - echo -n " --enable-curl" >> $INSTALLSHELL -fi - -if [ "$USE_LDAP" = "yes" ] -then - echo -n " --enable-ldap" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_AKA" = "yes" ] -then - echo -n " --enable-eap-aka" >> $INSTALLSHELL - echo -n " --enable-eap-aka-3gpp2" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_SIM" = "yes" ] -then - echo -n " --enable-eap-sim" >> $INSTALLSHELL - echo -n " --enable-eap-sim-file" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_MD5" = "yes" ] -then - echo -n " --enable-eap-md5" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_MSCHAPV2" = "yes" ] -then - echo -n " --enable-md4" >> $INSTALLSHELL - echo -n " --enable-eap-mschapv2" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_IDENTITY" = "yes" ] -then - echo -n " --enable-eap-identity" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_RADIUS" = "yes" ] -then - echo -n " --enable-eap-radius" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_DYNAMIC" = "yes" ] -then - echo -n " --enable-eap-dynamic" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_TLS" = "yes" ] -then - echo -n " --enable-eap-tls" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_TTLS" = "yes" ] -then - echo -n " --enable-eap-ttls" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_PEAP" = "yes" ] -then - echo -n " --enable-eap-peap" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_TNC" = "yes" ] -then - echo -n " --enable-eap-tnc" >> $INSTALLSHELL -fi - -if [ "$USE_TNC_PDP" = "yes" ] -then - echo -n " --enable-tnc-pdp" >> $INSTALLSHELL -fi - -if [ "$USE_TNC_IMC" = "yes" ] -then - echo -n " --enable-tnc-imc" >> $INSTALLSHELL -fi - -if [ "$USE_TNC_IMV" = "yes" ] -then - echo -n " --enable-tnc-imv" >> $INSTALLSHELL -fi - -if [ "$USE_TNCCS_11" = "yes" ] -then - echo -n " --enable-tnccs-11" >> $INSTALLSHELL -fi - -if [ "$USE_TNCCS_20" = "yes" ] -then - echo -n " --enable-tnccs-20" >> $INSTALLSHELL -fi - -if [ "$USE_TNCCS_DYNAMIC" = "yes" ] -then - echo -n " --enable-tnccs-dynamic" >> $INSTALLSHELL -fi - -if [ "$USE_IMC_TEST" = "yes" ] -then - echo -n " --enable-imc-test" >> $INSTALLSHELL -fi - -if [ "$USE_IMV_TEST" = "yes" ] -then - echo -n " --enable-imv-test" >> $INSTALLSHELL -fi - -if [ "$USE_IMC_SCANNER" = "yes" ] -then - echo -n " --enable-imc-scanner" >> $INSTALLSHELL -fi - -if [ "$USE_IMV_SCANNER" = "yes" ] -then - echo -n " --enable-imv-scanner" >> $INSTALLSHELL -fi - -if [ "$USE_IMC_ATTESTATION" = "yes" ] -then - echo -n " --enable-imc-attestation" >> $INSTALLSHELL -fi - -if [ "$USE_IMV_ATTESTATION" = "yes" ] -then - echo -n " --enable-imv-attestation" >> $INSTALLSHELL -fi - -if [ "$USE_SQL" = "yes" ] -then - echo -n " --enable-sql --enable-sqlite" >> $INSTALLSHELL - fi - -if [ "$USE_MEDIATION" = "yes" ] -then - echo -n " --enable-mediation" >> $INSTALLSHELL -fi - -if [ "$USE_OPENSSL" = "yes" ] -then - echo -n " --enable-openssl" >> $INSTALLSHELL -fi - -if [ "$USE_BLOWFISH" = "yes" ] -then - echo -n " --enable-blowfish" >> $INSTALLSHELL -fi - -if [ "$USE_KERNEL_PFKEY" = "yes" ] -then - echo -n " --enable-kernel-pfkey" >> $INSTALLSHELL -fi - -if [ "$USE_INTEGRITY_TEST" = "yes" ] -then - echo -n " --enable-integrity-test" >> $INSTALLSHELL -fi - -if [ "$USE_LEAK_DETECTIVE" = "yes" ] -then - echo -n " --enable-leak-detective" >> $INSTALLSHELL -fi - -if [ "$USE_LOAD_TESTER" = "yes" ] -then - echo -n " --enable-load-tester" >> $INSTALLSHELL -fi - -if [ "$USE_TEST_VECTORS" = "yes" ] -then - echo -n " --enable-test-vectors" >> $INSTALLSHELL -fi - -if [ "$USE_GCRYPT" = "yes" ] -then - echo -n " --enable-gcrypt" >> $INSTALLSHELL -fi - -if [ "$USE_SOCKET_DEFAULT" = "yes" ] -then - echo -n " --enable-socket-default" >> $INSTALLSHELL -fi - -if [ "$USE_SOCKET_DYNAMIC" = "yes" ] -then - echo -n " --enable-socket-dynamic" >> $INSTALLSHELL -fi - -if [ "$USE_DHCP" = "yes" ] -then - echo -n " --enable-dhcp" >> $INSTALLSHELL -fi - -if [ "$USE_FARP" = "yes" ] -then - echo -n " --enable-farp" >> $INSTALLSHELL -fi - -if [ "$USE_ADDRBLOCK" = "yes" ] -then - echo -n " --enable-addrblock" >> $INSTALLSHELL -fi - -if [ "$USE_CTR" = "yes" ] -then - echo -n " --enable-ctr" >> $INSTALLSHELL -fi - -if [ "$USE_CCM" = "yes" ] -then - echo -n " --enable-ccm" >> $INSTALLSHELL -fi - -if [ "$USE_GCM" = "yes" ] -then - echo -n " --enable-gcm" >> $INSTALLSHELL -fi - -if [ "$USE_CMAC" = "yes" ] -then - echo -n " --enable-cmac" >> $INSTALLSHELL -fi - -if [ "$USE_HA" = "yes" ] -then - echo -n " --enable-ha" >> $INSTALLSHELL -fi - -if [ "$USE_AF_ALG" = "yes" ] -then - echo -n " --enable-af-alg" >> $INSTALLSHELL -fi - -if [ "$USE_WHITELIST" = "yes" ] -then - echo -n " --enable-whitelist" >> $INSTALLSHELL -fi - -if [ "$USE_XAUTH_GENERIC" = "yes" ] -then - echo -n " --enable-xauth-generic" >> $INSTALLSHELL -fi - -if [ "$USE_XAUTH_EAP" = "yes" ] -then - echo -n " --enable-xauth-eap" >> $INSTALLSHELL -fi - -if [ "$USE_PKCS8" = "yes" ] -then - echo -n " --enable-pkcs8" >> $INSTALLSHELL -fi - -if [ "$USE_IFMAP" = "yes" ] -then - echo -n " --enable-tnc-ifmap" >> $INSTALLSHELL -fi - -if [ "$USE_CISCO_QUIRKS" = "yes" ] -then - echo -n " --enable-cisco-quirks" >> $INSTALLSHELL -fi - -if [ "$USE_UNITY" = "yes" ] -then - echo -n " --enable-unity" >> $INSTALLSHELL -fi - -echo "" >> $INSTALLSHELL -echo "make -j" >> $INSTALLSHELL -echo "make install" >> $INSTALLSHELL -echo "ldconfig" >> $INSTALLSHELL - -cecho-n " * Compiling $STRONGSWANVERSION within the root file system as chroot.." -chroot $LOOPDIR /bin/bash /install.sh >> $LOGFILE 2>&1 -rm -f $INSTALLSHELL -cgecho "done" - -###################################################### -# copying default /etc/ipsec.d/tables.sql to the root filesystem -# -cecho " * Copying '$HOSTCONFIGDIR/default/etc/ipsec.d/tables.sql' to the root filesystem" -cp -fp $HOSTCONFIGDIR/default/etc/ipsec.d/tables.sql $LOOPDIR/etc/ipsec.d/tables.sql - -###################################################### -# copying the host's ssh public key -# - -if [ ! -d $LOOPDIR/root/.ssh ] -then - mkdir $LOOPDIR/root/.ssh -fi -cp ~/.ssh/id_rsa.pub $LOOPDIR/root/.ssh/authorized_keys - -###################################################### -# setup public key based login among all hosts -# -cp $LOOPDIR/etc/ssh/ssh_host_rsa_key $LOOPDIR/root/.ssh/id_rsa - -for host in $STRONGSWANHOSTS -do - eval ip="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F- '{ print $1 }' | awk '{ print $1 }'`" - echo "$host,$ip `cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub`" >> $LOOPDIR/root/.ssh/known_hosts - echo "`cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub` root@$host" >> $LOOPDIR/root/.ssh/authorized_keys -done - -###################################################### -# defining an empty modules.dep -# - -if [ $UMLPATCH ] -then - mkdir $LOOPDIR/lib/modules/`basename $UMLPATCH .bz2 | sed s/uml-patch-//`um - touch $LOOPDIR/lib/modules/`basename $UMLPATCH .bz2 | sed s/uml-patch-//`um/modules.dep -else - mkdir $LOOPDIR/lib/modules/$KERNELVERSION - touch $LOOPDIR/lib/modules/$KERNELVERSION/modules.dep -fi - -umount $LOOPDIR diff --git a/testing/scripts/function.sh b/testing/scripts/function.sh index e7ecbcf83..c4769678c 100755 --- a/testing/scripts/function.sh +++ b/testing/scripts/function.sh @@ -14,31 +14,146 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. +export TERM=xterm +RED=$(tput setaf 1) +GREEN=$(tput setaf 2) +NORMAL=$(tput op) -############################################ -# print output in color -# +# exit with given error message +# $1 - error message +die() { + echo -e "${RED}$1${NORMAL}" + exit 1 +} -function cecho { - echo -e "\033[1;31m$1\033[0m" +# execute command +# $1 - command to execute +# $2 - whether or not to log command exit status +# (0 -> disable exit status logging) +execute() +{ + cmd=${1} + echo $cmd >>$LOGFILE 2>&1 + $cmd >>$LOGFILE 2>&1 + status=$? + [ "$2" != 0 ] && log_status $status + if [ $status != 0 ]; then + echo + echo "! Command $cmd failed, exiting (status $status)" + echo "! Check why here $LOGFILE" + exit 1 + fi } -function cgecho { - echo -e "\033[1;32m$1\033[0m" + +# execute command in chroot +# $1 - command to execute +execute_chroot() +{ + execute "chroot $LOOPDIR $@" } -function cecho-n { - echo -en "\033[1;31m$1\033[0m" +# write green status message to console +# $1 - msg +echo_ok() +{ + echo -e "${GREEN}$1${NORMAL}" } +# write red status message to console +# $1 - msg +echo_failed() +{ + echo -e "${RED}$1${NORMAL}" +} -############################################# -# output all args to stderr and exit with -# return code 1 -# +# log an action +# $1 - current action description +log_action() +{ + /bin/echo -n "[....] $1 " +} -die() { - echo $* 1>&2 - exit 1 +# log an action status +# $1 - exit status of action +log_status() +{ + tput hpa 0 + if [ $1 -eq 0 ]; then + /bin/echo -ne "[${GREEN} ok ${NORMAL}" + else + /bin/echo -ne "[${RED}FAIL${NORMAL}" + fi + echo +} + +# the following two functions are stolen from [1] +# [1] - http://www.linuxjournal.com/content/use-bash-trap-statement-cleanup-temporary-files + +declare -a on_exit_items + +# perform registered actions on exit +on_exit() +{ + for ((onex=${#on_exit_items[@]}-1; onex>=0; onex--)) + do + echo "On_Exit: ${on_exit_items[$onex]}" >>$LOGFILE + ${on_exit_items[$onex]} >>$LOGFILE 2>&1 + done + on_exit_items="" + trap - EXIT +} + +# register a command to execute when the calling script terminates. The +# registered commands are called in FILO order. +# $* - command to register +do_on_exit() +{ + local n=${#on_exit_items[*]} + on_exit_items[$n]="$*" + if [ $n -eq 0 ]; then + trap on_exit EXIT + fi +} + +# wait for a mount to disappear +# $1 - device/image to wait for +# $2 - maximum time to wait in seconds, default is 5 seconds +graceful_umount() +{ + secs=$2 + [ ! $secs ] && secs=5 + + let steps=$secs*100 + for st in `seq 1 $steps` + do + umount $1 >>$LOGFILE 2>&1 + mount | grep $1 >/dev/null 2>&1 + [ $? -eq 0 ] || return 0 + sleep 0.01 + done + + return 1 +} + +# load qemu NBD kernel module, if not already loaded +load_qemu_nbd() +{ + lsmod | grep ^nbd[[:space:]]* >/dev/null 2>&1 + if [ $? != 0 ] + then + log_action "Loading NBD kernel module" + execute "modprobe nbd max_part=16" + fi +} + +# check if given commands exist in $PATH +# $* - commands to check +check_commands() +{ + for i in $* + do + command -v $i >/dev/null || { die "Required command $i not found"; exit 1; } + done } ############################################# @@ -55,13 +170,6 @@ function searchandreplace { [ -d "$DESTDIR" ] || die "$DESTDIR is not a directory!" - ######################### - # create a temporary file - # - - TMPFILE="/tmp/sr.$$" - - ########################################### # search and replace in each found file the # given string @@ -69,59 +177,7 @@ function searchandreplace { for eachfoundfile in `find $DESTDIR -type f` do - sed -e "s/$SEARCHSTRING/$REPLACESTRING/g" "$eachfoundfile" > "$TMPFILE" - cp -f "$TMPFILE" "$eachfoundfile" + sed -i -e "s/$SEARCHSTRING/$REPLACESTRING/g" "$eachfoundfile" done - - ########################### - # delete the temporary file - # - - rm -f "$TMPFILE" - -} - -############################################# -# add a bridge -# - -function umlbr_add { - brctl addbr "umlbr$1" - brctl setfd "umlbr$1" 0 - brctl setageing "umlbr$1" 3600 - brctl stp "umlbr$1" off - ifconfig "umlbr$1" "$2" netmask "$3" up } - -############################################# -# delete a bridge -# - -function umlbr_del { - ifconfig "umlbr$1" down &> /dev/null 2>&1 - brctl delbr "umlbr$1" &> /dev/null 2>&1 -} - -############################################# -# add a tap interface to a bridge -# - -function umlbr_add_tap { - tunctl -t "tap$1_$2" &> /dev/null 2>&1 - ifconfig "tap$1_$2" 0.0.0.0 promisc up &> /dev/null 2>&1 - brctl addif "umlbr$1" "tap$1_$2" &> /dev/null 2>&1 - cecho-n "$2.." - } - -############################################# -# delete a tap interface from a bridge -# - -function umlbr_del_tap { - ifconfig "umlbr$2" down &> /dev/null 2>&1 - brctl delif "umlbr$1" "tap$1_$2" &> /dev/null 2>&1 - tunctl -d "tap$1_$2" &> /dev/null 2>&1 - cecho-n "$2.." - } - diff --git a/testing/scripts/gstart-umls b/testing/scripts/gstart-umls deleted file mode 100755 index c6fcd26dc..000000000 --- a/testing/scripts/gstart-umls +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# starts the UML instances in an gnome-terminal (requires X11R6) -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -#position of xterm window on the desktop -x0=8 -y0=52 -dx=12 -dy=24 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval gnome-terminal --title=${host} --geometry="+${x0}+${y0}" --show-menubar --execute "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" & - cgecho "done" - sleep 15 - fi - let "x0+=dx" - let "y0+=dy" -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/scripts/install-shared b/testing/scripts/install-shared deleted file mode 100755 index 4cfac9e77..000000000 --- a/testing/scripts/install-shared +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash -# Install strongSwan from mounted strongswan-shared tree -# -# Copyright (C) 2006 Martin Willi -# Hochschule fuer Technik Rapperswil -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -# - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -cecho "installing strongSwan from shared tree" -cecho-n " on: " - -for host in $STRONGSWANHOSTS -do - eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - cecho-n "$host... " - ssh $HOSTLOGIN 'cd ~/strongswan-shared && make install' > /dev/null -done - -cecho diff --git a/testing/scripts/kstart-umls b/testing/scripts/kstart-umls deleted file mode 100755 index 18dc64a9d..000000000 --- a/testing/scripts/kstart-umls +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# starts the UML instances in a konsole (requires KDE) -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -#position of konsole window on the desktop -x0=8 -y0=8 -dx=12 -dy=24 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval konsole -title ${host} --geometry "+${x0}+${y0}" -e "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" & - cgecho "done" - sleep 15 - fi - let "x0+=dx" - let "y0+=dy" -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/scripts/load-testconfig b/testing/scripts/load-testconfig index 43100dbe0..0ea4fbf00 100755 --- a/testing/scripts/load-testconfig +++ b/testing/scripts/load-testconfig @@ -14,13 +14,9 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh ########################################################################## # load-testconfig requires a testname as an argument @@ -58,17 +54,16 @@ for host in $IPSECHOSTS do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/auth.log /var/log/daemon.log; \ - kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1 + kill -SIGHUP `cat /var/run/rsyslogd.pid`' > /dev/null 2>&1 done ########################################################################## -# clear radius.log and daemon.log on FreeRadius servers +# clear radius.log on FreeRadius servers # for host in $RADIUSHOSTS do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/radius/radius.log /var/log/daemon.log; \ - kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1 + ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/freeradius/radius.log' > /dev/null 2>&1 done diff --git a/testing/scripts/recipes/001_libtnc.mk b/testing/scripts/recipes/001_libtnc.mk new file mode 100644 index 000000000..b835958b7 --- /dev/null +++ b/testing/scripts/recipes/001_libtnc.mk @@ -0,0 +1,31 @@ +#!/usr/bin/make + +PV = 1.25 +PKG = libtnc-$(PV) +TAR = $(PKG).tar.gz +SRC = http://downloads.sourceforge.net/project/libtnc/libtnc/$(PV)/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + --sysconfdir=/etc + +all: install + +$(TAR): + wget $(SRC) + +.$(PKG)-unpacked: $(TAR) + tar xfz $(TAR) + @touch $@ + +.$(PKG)-configured: .$(PKG)-unpacked + cd $(PKG) && ./configure $(CONFIG_OPTS) + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG) && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG) && make install diff --git a/testing/scripts/recipes/002_tnc-fhh.mk b/testing/scripts/recipes/002_tnc-fhh.mk new file mode 100644 index 000000000..397cef950 --- /dev/null +++ b/testing/scripts/recipes/002_tnc-fhh.mk @@ -0,0 +1,28 @@ +#!/usr/bin/make + +PKG = fhhtnc +SRC = git://github.com/trustatfhh/tnc-fhh.git + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + -DCOMPONENT=all \ + -DNAL=8021x + +all: install + +.$(PKG)-cloned: + git clone $(SRC) $(PKG) + mkdir $(PKG)/build + @touch $@ + +.$(PKG)-configured: .$(PKG)-cloned + cd $(PKG)/build && cmake $(CONFIG_OPTS) ../ + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG)/build && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG)/build && make install diff --git a/testing/scripts/recipes/003_freeradius.mk b/testing/scripts/recipes/003_freeradius.mk new file mode 100644 index 000000000..7b7a5fe82 --- /dev/null +++ b/testing/scripts/recipes/003_freeradius.mk @@ -0,0 +1,44 @@ +#!/usr/bin/make + +PV = 2.2.0 +PKG = freeradius-server-$(PV) +TAR = $(PKG).tar.bz2 +SRC = ftp://ftp.freeradius.org/pub/freeradius/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + --with-raddbdir=/etc/freeradius \ + --sysconfdir=/etc \ + --with-logdir=/var/log/freeradius \ + --enable-developer \ + --with-experimental-modules + +PATCHES = \ + freeradius-eap-sim-identity \ + freeradius-avp-size \ + freeradius-tnc-fhh + +all: install + +$(TAR): + wget $(SRC) + +.$(PKG)-unpacked: $(TAR) + tar xfj $(TAR) + @touch $@ + +.$(PKG)-patches-applied: .$(PKG)-unpacked + cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1 + @touch $@ + +.$(PKG)-configured: .$(PKG)-patches-applied + cd $(PKG) && ./configure $(CONFIG_OPTS) + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG) && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG) && make install diff --git a/testing/scripts/recipes/004_iptables.mk b/testing/scripts/recipes/004_iptables.mk new file mode 100644 index 000000000..51200201a --- /dev/null +++ b/testing/scripts/recipes/004_iptables.mk @@ -0,0 +1,37 @@ +#!/usr/bin/make + +PV = 1.4.16.3 +PKG = iptables-$(PV) +TAR = $(PKG).tar.bz2 +SRC = http://www.netfilter.org/projects/iptables/files/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = + +PATCHES = \ + iptables-xfrm-hooks + +all: install + +$(TAR): + wget $(SRC) + +.$(PKG)-unpacked: $(TAR) + tar xfj $(TAR) + @touch $@ + +.$(PKG)-patches-applied: .$(PKG)-unpacked + cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1 + @touch $@ + +.$(PKG)-configured: .$(PKG)-patches-applied + cd $(PKG) && ./configure $(CONFIG_OPTS) + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG) && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG) && make install diff --git a/testing/scripts/recipes/005_strongswan.mk b/testing/scripts/recipes/005_strongswan.mk new file mode 100644 index 000000000..76d2d0882 --- /dev/null +++ b/testing/scripts/recipes/005_strongswan.mk @@ -0,0 +1,87 @@ +#!/usr/bin/make + +PV = $(SWANVERSION) +PKG = strongswan-$(PV) +TAR = $(PKG).tar.bz2 +SRC = http://download.strongswan.org/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + --sysconfdir=/etc \ + --with-random-device=/dev/urandom \ + --disable-load-warning \ + --enable-curl \ + --enable-ldap \ + --enable-eap-aka \ + --enable-eap-aka-3gpp2 \ + --enable-eap-sim \ + --enable-eap-sim-file \ + --enable-eap-md5 \ + --enable-md4 \ + --enable-eap-mschapv2 \ + --enable-eap-identity \ + --enable-eap-radius \ + --enable-eap-dynamic \ + --enable-eap-tls \ + --enable-eap-ttls \ + --enable-eap-peap \ + --enable-eap-tnc \ + --enable-tnc-pdp \ + --enable-tnc-imc \ + --enable-tnc-imv \ + --enable-tnccs-11 \ + --enable-tnccs-20 \ + --enable-tnccs-dynamic \ + --enable-imc-test \ + --enable-imv-test \ + --enable-imc-scanner \ + --enable-imv-scanner \ + --enable-imc-os \ + --enable-imv-os \ + --enable-imc-attestation \ + --enable-imv-attestation \ + --enable-sql \ + --enable-sqlite \ + --enable-mediation \ + --enable-openssl \ + --enable-blowfish \ + --enable-kernel-pfkey \ + --enable-integrity-test \ + --enable-leak-detective \ + --enable-load-tester \ + --enable-test-vectors \ + --enable-gcrypt \ + --enable-socket-default \ + --enable-socket-dynamic \ + --enable-dhcp \ + --enable-farp \ + --enable-addrblock \ + --enable-ctr \ + --enable-ccm \ + --enable-gcm \ + --enable-cmac \ + --enable-ha \ + --enable-af-alg \ + --enable-whitelist \ + --enable-xauth-generic \ + --enable-xauth-eap \ + --enable-pkcs8 \ + --enable-unity + +all: install + +$(TAR): + wget $(SRC) + +$(PKG): $(TAR) + tar xfj $(TAR) + +configure: $(PKG) + cd $(PKG) && ./configure $(CONFIG_OPTS) + +build: configure + cd $(PKG) && make -j $(NUM_CPUS) + +install: build + cd $(PKG) && make install diff --git a/testing/scripts/recipes/patches/freeradius-avp-size b/testing/scripts/recipes/patches/freeradius-avp-size new file mode 100644 index 000000000..e7e1f635b --- /dev/null +++ b/testing/scripts/recipes/patches/freeradius-avp-size @@ -0,0 +1,18 @@ +diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +index 6c9bd13..3344c53 100644 +--- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c ++++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +@@ -201,8 +201,11 @@ static VALUE_PAIR *diameter2vp(REQUEST *request, SSL *ssl, + goto next_attr; + } + +- if (size > 253) { +- RDEBUG2("WARNING: diameter2vp skipping long attribute %u, attr"); ++ /* ++ * EAP-Message AVPs can be larger than 253 octets. ++ */ ++ if ((size > 253) && !((VENDOR(attr) == 0) && (attr == PW_EAP_MESSAGE))) { ++ RDEBUG2("WARNING: diameter2vp skipping long attribute %u", attr); + goto next_attr; + } + diff --git a/testing/scripts/recipes/patches/freeradius-eap-sim-identity b/testing/scripts/recipes/patches/freeradius-eap-sim-identity new file mode 100644 index 000000000..1ab95ecc6 --- /dev/null +++ b/testing/scripts/recipes/patches/freeradius-eap-sim-identity @@ -0,0 +1,30 @@ +--- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:03:05.081225276 +0100 ++++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:46:59.746289881 +0100 +@@ -246,14 +246,21 @@ + newvp->vp_integer = ess->sim_id++; + pairreplace(outvps, newvp); + ++ ess->keys.identitylen = strlen(handler->identity); ++ memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen); ++ + /* make a copy of the identity */ + newvp = pairfind(*invps, ATTRIBUTE_EAP_SIM_BASE + PW_EAP_SIM_IDENTITY); +- if (newvp) { +- ess->keys.identitylen = newvp->length; +- memcpy(ess->keys.identity, newvp->vp_octets, newvp->length); +- } else { +- ess->keys.identitylen = strlen(handler->identity); +- memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen); ++ if (newvp && newvp->length > 2) { ++ uint16_t len; ++ ++ memcpy(&len, newvp->vp_octets, sizeof(uint16_t)); ++ len = ntohs(len); ++ if (len <= newvp->length - 2 && len <= MAX_STRING_LEN) { ++ ess->keys.identitylen = len; ++ memcpy(ess->keys.identity, newvp->vp_octets + 2, ++ ess->keys.identitylen); ++ } + } + + /* all set, calculate keys! */ diff --git a/testing/scripts/recipes/patches/freeradius-tnc-fhh b/testing/scripts/recipes/patches/freeradius-tnc-fhh new file mode 100644 index 000000000..5abc6b25f --- /dev/null +++ b/testing/scripts/recipes/patches/freeradius-tnc-fhh @@ -0,0 +1,6687 @@ +diff -u -r -N freeradius-server-2.2.0.orig/share/dictionary freeradius-server-2.2.0/share/dictionary +--- freeradius-server-2.2.0.orig/share/dictionary 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/share/dictionary 2012-12-04 19:39:42.261423097 +0100 +@@ -196,6 +196,7 @@ + $INCLUDE dictionary.starent + $INCLUDE dictionary.symbol + $INCLUDE dictionary.telebit ++$INCLUDE dictionary.tncfhh + $INCLUDE dictionary.terena + $INCLUDE dictionary.trapeze + $INCLUDE dictionary.tropos +diff -u -r -N freeradius-server-2.2.0.orig/share/dictionary.tncfhh freeradius-server-2.2.0/share/dictionary.tncfhh +--- freeradius-server-2.2.0.orig/share/dictionary.tncfhh 1970-01-01 01:00:00.000000000 +0100 ++++ freeradius-server-2.2.0/share/dictionary.tncfhh 2012-12-04 19:39:49.645421869 +0100 +@@ -0,0 +1,20 @@ ++# -*- text -*- ++# Dictionary for the tnc@fhh Server. ++# ++# Website: http://trust.inform.fh-hannover.de ++# ++# Version: 0.8.4 ++# Author: Bastian Hellmann ++# Email: trust@f4-i.fh-hannover.de ++# ++ ++VENDOR tncfhh 10000 ++BEGIN-VENDOR tncfhh ++ ++ATTRIBUTE TNC-Status 1 integer ++ ++VALUE TNC-Status Access 0 ++VALUE TNC-Status Isolate 1 ++VALUE TNC-Status None 2 ++ ++END-VENDOR tncfhh +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure 2012-12-04 19:38:00.237420970 +0100 +@@ -1,61 +1,84 @@ + #! /bin/sh + # From configure.in Revision. + # Guess values for system-dependent variables and create Makefiles. +-# Generated by GNU Autoconf 2.61. ++# Generated by GNU Autoconf 2.67. ++# + # + # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, +-# 2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc. ++# 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Free Software ++# Foundation, Inc. ++# ++# + # This configure script is free software; the Free Software Foundation + # gives unlimited permission to copy, distribute and modify it. +-## --------------------- ## +-## M4sh Initialization. ## +-## --------------------- ## ++## -------------------- ## ++## M4sh Initialization. ## ++## -------------------- ## + + # Be more Bourne compatible + DUALCASE=1; export DUALCASE # for MKS sh +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then ++if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : + emulate sh + NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which ++ # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' + setopt NO_GLOB_SUBST + else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; ++ case `(set -o) 2>/dev/null` in #( ++ *posix*) : ++ set -o posix ;; #( ++ *) : ++ ;; + esac +- + fi + + +- +- +-# PATH needs CR +-# Avoid depending upon Character Ranges. +-as_cr_letters='abcdefghijklmnopqrstuvwxyz' +-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' +-as_cr_Letters=$as_cr_letters$as_cr_LETTERS +-as_cr_digits='0123456789' +-as_cr_alnum=$as_cr_Letters$as_cr_digits +- +-# The user is always right. +-if test "${PATH_SEPARATOR+set}" != set; then +- echo "#! /bin/sh" >conf$$.sh +- echo "exit 0" >>conf$$.sh +- chmod +x conf$$.sh +- if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then +- PATH_SEPARATOR=';' ++as_nl=' ++' ++export as_nl ++# Printing a long string crashes Solaris 7 /usr/bin/printf. ++as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo ++# Prefer a ksh shell builtin over an external printf program on Solaris, ++# but without wasting forks for bash or zsh. ++if test -z "$BASH_VERSION$ZSH_VERSION" \ ++ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='print -r --' ++ as_echo_n='print -rn --' ++elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='printf %s\n' ++ as_echo_n='printf %s' ++else ++ if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then ++ as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' ++ as_echo_n='/usr/ucb/echo -n' + else +- PATH_SEPARATOR=: ++ as_echo_body='eval expr "X$1" : "X\\(.*\\)"' ++ as_echo_n_body='eval ++ arg=$1; ++ case $arg in #( ++ *"$as_nl"*) ++ expr "X$arg" : "X\\(.*\\)$as_nl"; ++ arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; ++ esac; ++ expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ++ ' ++ export as_echo_n_body ++ as_echo_n='sh -c $as_echo_n_body as_echo' + fi +- rm -f conf$$.sh ++ export as_echo_body ++ as_echo='sh -c $as_echo_body as_echo' + fi + +-# Support unset when possible. +-if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then +- as_unset=unset +-else +- as_unset=false ++# The user is always right. ++if test "${PATH_SEPARATOR+set}" != set; then ++ PATH_SEPARATOR=: ++ (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { ++ (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || ++ PATH_SEPARATOR=';' ++ } + fi + + +@@ -64,20 +87,18 @@ + # there to prevent editors from complaining about space-tab. + # (If _AS_PATH_WALK were called with IFS unset, it would disable word + # splitting by setting IFS to empty value.) +-as_nl=' +-' + IFS=" "" $as_nl" + + # Find who we are. Look in the path if we contain no directory separator. +-case $0 in ++case $0 in #(( + *[\\/]* ) as_myself=$0 ;; + *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR + for as_dir in $PATH + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break +-done ++ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break ++ done + IFS=$as_save_IFS + + ;; +@@ -88,354 +109,321 @@ + as_myself=$0 + fi + if test ! -f "$as_myself"; then +- echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 +- { (exit 1); exit 1; } ++ $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 ++ exit 1 + fi + +-# Work around bugs in pre-3.0 UWIN ksh. +-for as_var in ENV MAIL MAILPATH +-do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var ++# Unset variables that we do not need and which cause bugs (e.g. in ++# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" ++# suppresses any "Segmentation fault" message there. '((' could ++# trigger a bug in pdksh 5.2.14. ++for as_var in BASH_ENV ENV MAIL MAILPATH ++do eval test x\${$as_var+set} = xset \ ++ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : + done + PS1='$ ' + PS2='> ' + PS4='+ ' + + # NLS nuisances. +-for as_var in \ +- LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ +- LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ +- LC_TELEPHONE LC_TIME +-do +- if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then +- eval $as_var=C; export $as_var +- else +- ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var +- fi +-done +- +-# Required to use basename. +-if expr a : '\(a\)' >/dev/null 2>&1 && +- test "X`expr 00001 : '.*\(...\)'`" = X001; then +- as_expr=expr +-else +- as_expr=false +-fi +- +-if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then +- as_basename=basename +-else +- as_basename=false +-fi +- +- +-# Name of the executable. +-as_me=`$as_basename -- "$0" || +-$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ +- X"$0" : 'X\(//\)$' \| \ +- X"$0" : 'X\(/\)' \| . 2>/dev/null || +-echo X/"$0" | +- sed '/^.*\/\([^/][^/]*\)\/*$/{ +- s//\1/ +- q +- } +- /^X\/\(\/\/\)$/{ +- s//\1/ +- q +- } +- /^X\/\(\/\).*/{ +- s//\1/ +- q +- } +- s/.*/./; q'` ++LC_ALL=C ++export LC_ALL ++LANGUAGE=C ++export LANGUAGE + + # CDPATH. +-$as_unset CDPATH +- ++(unset CDPATH) >/dev/null 2>&1 && unset CDPATH + + if test "x$CONFIG_SHELL" = x; then +- if (eval ":") 2>/dev/null; then +- as_have_required=yes ++ as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then : ++ emulate sh ++ NULLCMD=: ++ # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which ++ # is contrary to our usage. Disable this feature. ++ alias -g '\${1+\"\$@\"}'='\"\$@\"' ++ setopt NO_GLOB_SUBST + else +- as_have_required=no ++ case \`(set -o) 2>/dev/null\` in #( ++ *posix*) : ++ set -o posix ;; #( ++ *) : ++ ;; ++esac + fi +- +- if test $as_have_required = yes && (eval ": +-(as_func_return () { +- (exit \$1) +-} +-as_func_success () { +- as_func_return 0 +-} +-as_func_failure () { +- as_func_return 1 +-} +-as_func_ret_success () { +- return 0 +-} +-as_func_ret_failure () { +- return 1 +-} ++" ++ as_required="as_fn_return () { (exit \$1); } ++as_fn_success () { as_fn_return 0; } ++as_fn_failure () { as_fn_return 1; } ++as_fn_ret_success () { return 0; } ++as_fn_ret_failure () { return 1; } + + exitcode=0 +-if as_func_success; then +- : +-else +- exitcode=1 +- echo as_func_success failed. +-fi +- +-if as_func_failure; then +- exitcode=1 +- echo as_func_failure succeeded. +-fi +- +-if as_func_ret_success; then +- : +-else +- exitcode=1 +- echo as_func_ret_success failed. +-fi +- +-if as_func_ret_failure; then +- exitcode=1 +- echo as_func_ret_failure succeeded. +-fi +- +-if ( set x; as_func_ret_success y && test x = \"\$1\" ); then +- : ++as_fn_success || { exitcode=1; echo as_fn_success failed.; } ++as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; } ++as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; } ++as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; } ++if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then : ++ ++else ++ exitcode=1; echo positional parameters were not saved. ++fi ++test x\$exitcode = x0 || exit 1" ++ as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO ++ as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO ++ eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" && ++ test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1 ++test \$(( 1 + 1 )) = 2 || exit 1" ++ if (eval "$as_required") 2>/dev/null; then : ++ as_have_required=yes + else +- exitcode=1 +- echo positional parameters were not saved. ++ as_have_required=no + fi ++ if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then : + +-test \$exitcode = 0) || { (exit 1); exit 1; } +- +-( +- as_lineno_1=\$LINENO +- as_lineno_2=\$LINENO +- test \"x\$as_lineno_1\" != \"x\$as_lineno_2\" && +- test \"x\`expr \$as_lineno_1 + 1\`\" = \"x\$as_lineno_2\") || { (exit 1); exit 1; } +-") 2> /dev/null; then +- : + else +- as_candidate_shells= +- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++as_found=false + for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- case $as_dir in ++ as_found=: ++ case $as_dir in #( + /*) + for as_base in sh bash ksh sh5; do +- as_candidate_shells="$as_candidate_shells $as_dir/$as_base" ++ # Try only shells that exist, to save several forks. ++ as_shell=$as_dir/$as_base ++ if { test -f "$as_shell" || test -f "$as_shell.exe"; } && ++ { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then : ++ CONFIG_SHELL=$as_shell as_have_required=yes ++ if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then : ++ break 2 ++fi ++fi + done;; + esac ++ as_found=false + done ++$as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } && ++ { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then : ++ CONFIG_SHELL=$SHELL as_have_required=yes ++fi; } + IFS=$as_save_IFS + + +- for as_shell in $as_candidate_shells $SHELL; do +- # Try only shells that exist, to save several forks. +- if { test -f "$as_shell" || test -f "$as_shell.exe"; } && +- { ("$as_shell") 2> /dev/null <<\_ASEOF +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then +- emulate sh +- NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which +- # is contrary to our usage. Disable this feature. +- alias -g '${1+"$@"}'='"$@"' +- setopt NO_GLOB_SUBST +-else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; +-esac +- ++ if test "x$CONFIG_SHELL" != x; then : ++ # We cannot yet assume a decent shell, so we have to provide a ++ # neutralization value for shells without unset; and this also ++ # works around shells that cannot unset nonexistent variables. ++ BASH_ENV=/dev/null ++ ENV=/dev/null ++ (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV ++ export CONFIG_SHELL ++ exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"} ++fi ++ ++ if test x$as_have_required = xno; then : ++ $as_echo "$0: This script requires a shell more modern than all" ++ $as_echo "$0: the shells that I found on your system." ++ if test x${ZSH_VERSION+set} = xset ; then ++ $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should" ++ $as_echo "$0: be upgraded to zsh 4.3.4 or later." ++ else ++ $as_echo "$0: Please tell bug-autoconf@gnu.org about your system, ++$0: including any error possibly output before this ++$0: message. Then install a modern shell, or manually run ++$0: the script under such a shell if you do have one." ++ fi ++ exit 1 + fi +- +- +-: +-_ASEOF +-}; then +- CONFIG_SHELL=$as_shell +- as_have_required=yes +- if { "$as_shell" 2> /dev/null <<\_ASEOF +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then +- emulate sh +- NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which +- # is contrary to our usage. Disable this feature. +- alias -g '${1+"$@"}'='"$@"' +- setopt NO_GLOB_SUBST +-else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; +-esac +- + fi ++fi ++SHELL=${CONFIG_SHELL-/bin/sh} ++export SHELL ++# Unset more variables known to interfere with behavior of common tools. ++CLICOLOR_FORCE= GREP_OPTIONS= ++unset CLICOLOR_FORCE GREP_OPTIONS + +- +-: +-(as_func_return () { +- (exit $1) +-} +-as_func_success () { +- as_func_return 0 +-} +-as_func_failure () { +- as_func_return 1 +-} +-as_func_ret_success () { +- return 0 +-} +-as_func_ret_failure () { +- return 1 ++## --------------------- ## ++## M4sh Shell Functions. ## ++## --------------------- ## ++# as_fn_unset VAR ++# --------------- ++# Portably unset VAR. ++as_fn_unset () ++{ ++ { eval $1=; unset $1;} + } ++as_unset=as_fn_unset + +-exitcode=0 +-if as_func_success; then +- : +-else +- exitcode=1 +- echo as_func_success failed. +-fi ++# as_fn_set_status STATUS ++# ----------------------- ++# Set $? to STATUS, without forking. ++as_fn_set_status () ++{ ++ return $1 ++} # as_fn_set_status + +-if as_func_failure; then +- exitcode=1 +- echo as_func_failure succeeded. +-fi ++# as_fn_exit STATUS ++# ----------------- ++# Exit the shell with STATUS, even in a "trap 0" or "set -e" context. ++as_fn_exit () ++{ ++ set +e ++ as_fn_set_status $1 ++ exit $1 ++} # as_fn_exit ++ ++# as_fn_mkdir_p ++# ------------- ++# Create "$as_dir" as a directory, including parents if necessary. ++as_fn_mkdir_p () ++{ + +-if as_func_ret_success; then +- : +-else +- exitcode=1 +- echo as_func_ret_success failed. +-fi ++ case $as_dir in #( ++ -*) as_dir=./$as_dir;; ++ esac ++ test -d "$as_dir" || eval $as_mkdir_p || { ++ as_dirs= ++ while :; do ++ case $as_dir in #( ++ *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( ++ *) as_qdir=$as_dir;; ++ esac ++ as_dirs="'$as_qdir' $as_dirs" ++ as_dir=`$as_dirname -- "$as_dir" || ++$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ ++ X"$as_dir" : 'X\(//\)[^/]' \| \ ++ X"$as_dir" : 'X\(//\)$' \| \ ++ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X"$as_dir" | ++ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)[^/].*/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\).*/{ ++ s//\1/ ++ q ++ } ++ s/.*/./; q'` ++ test -d "$as_dir" && break ++ done ++ test -z "$as_dirs" || eval "mkdir $as_dirs" ++ } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" + +-if as_func_ret_failure; then +- exitcode=1 +- echo as_func_ret_failure succeeded. +-fi + +-if ( set x; as_func_ret_success y && test x = "$1" ); then +- : ++} # as_fn_mkdir_p ++# as_fn_append VAR VALUE ++# ---------------------- ++# Append the text in VALUE to the end of the definition contained in VAR. Take ++# advantage of any shell optimizations that allow amortized linear growth over ++# repeated appends, instead of the typical quadratic growth present in naive ++# implementations. ++if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : ++ eval 'as_fn_append () ++ { ++ eval $1+=\$2 ++ }' + else +- exitcode=1 +- echo positional parameters were not saved. +-fi +- +-test $exitcode = 0) || { (exit 1); exit 1; } +- +-( +- as_lineno_1=$LINENO +- as_lineno_2=$LINENO +- test "x$as_lineno_1" != "x$as_lineno_2" && +- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2") || { (exit 1); exit 1; } +- +-_ASEOF +-}; then +- break +-fi +- +-fi +- +- done +- +- if test "x$CONFIG_SHELL" != x; then +- for as_var in BASH_ENV ENV +- do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var +- done +- export CONFIG_SHELL +- exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"} +-fi +- +- +- if test $as_have_required = no; then +- echo This script requires a shell more modern than all the +- echo shells that I found on your system. Please install a +- echo modern shell, or manually run the script under such a +- echo shell if you do have one. +- { (exit 1); exit 1; } +-fi +- +- +-fi +- +-fi +- ++ as_fn_append () ++ { ++ eval $1=\$$1\$2 ++ } ++fi # as_fn_append ++ ++# as_fn_arith ARG... ++# ------------------ ++# Perform arithmetic evaluation on the ARGs, and store the result in the ++# global $as_val. Take advantage of shells that can avoid forks. The arguments ++# must be portable across $(()) and expr. ++if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : ++ eval 'as_fn_arith () ++ { ++ as_val=$(( $* )) ++ }' ++else ++ as_fn_arith () ++ { ++ as_val=`expr "$@" || test $? -eq 1` ++ } ++fi # as_fn_arith + + +-(eval "as_func_return () { +- (exit \$1) +-} +-as_func_success () { +- as_func_return 0 +-} +-as_func_failure () { +- as_func_return 1 +-} +-as_func_ret_success () { +- return 0 +-} +-as_func_ret_failure () { +- return 1 +-} ++# as_fn_error STATUS ERROR [LINENO LOG_FD] ++# ---------------------------------------- ++# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are ++# provided, also output the error to LOG_FD, referencing LINENO. Then exit the ++# script with STATUS, using 1 if that was 0. ++as_fn_error () ++{ ++ as_status=$1; test $as_status -eq 0 && as_status=1 ++ if test "$4"; then ++ as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 ++ fi ++ $as_echo "$as_me: error: $2" >&2 ++ as_fn_exit $as_status ++} # as_fn_error + +-exitcode=0 +-if as_func_success; then +- : ++if expr a : '\(a\)' >/dev/null 2>&1 && ++ test "X`expr 00001 : '.*\(...\)'`" = X001; then ++ as_expr=expr + else +- exitcode=1 +- echo as_func_success failed. +-fi +- +-if as_func_failure; then +- exitcode=1 +- echo as_func_failure succeeded. ++ as_expr=false + fi + +-if as_func_ret_success; then +- : ++if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then ++ as_basename=basename + else +- exitcode=1 +- echo as_func_ret_success failed. +-fi +- +-if as_func_ret_failure; then +- exitcode=1 +- echo as_func_ret_failure succeeded. ++ as_basename=false + fi + +-if ( set x; as_func_ret_success y && test x = \"\$1\" ); then +- : ++if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then ++ as_dirname=dirname + else +- exitcode=1 +- echo positional parameters were not saved. ++ as_dirname=false + fi + +-test \$exitcode = 0") || { +- echo No shell found that supports shell functions. +- echo Please tell autoconf@gnu.org about your system, +- echo including any error possibly output before this +- echo message +-} ++as_me=`$as_basename -- "$0" || ++$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ ++ X"$0" : 'X\(//\)$' \| \ ++ X"$0" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X/"$0" | ++ sed '/^.*\/\([^/][^/]*\)\/*$/{ ++ s//\1/ ++ q ++ } ++ /^X\/\(\/\/\)$/{ ++ s//\1/ ++ q ++ } ++ /^X\/\(\/\).*/{ ++ s//\1/ ++ q ++ } ++ s/.*/./; q'` + ++# Avoid depending upon Character Ranges. ++as_cr_letters='abcdefghijklmnopqrstuvwxyz' ++as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' ++as_cr_Letters=$as_cr_letters$as_cr_LETTERS ++as_cr_digits='0123456789' ++as_cr_alnum=$as_cr_Letters$as_cr_digits + + +- as_lineno_1=$LINENO +- as_lineno_2=$LINENO +- test "x$as_lineno_1" != "x$as_lineno_2" && +- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || { +- +- # Create $as_me.lineno as a copy of $as_myself, but with $LINENO +- # uniformly replaced by the line number. The first 'sed' inserts a +- # line-number line after each line using $LINENO; the second 'sed' +- # does the real work. The second script uses 'N' to pair each +- # line-number line with the line containing $LINENO, and appends +- # trailing '-' during substitution so that $LINENO is not a special +- # case at line end. +- # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the +- # scripts with optimization help from Paolo Bonzini. Blame Lee +- # E. McMahon (1931-1989) for sed's syntax. :-) ++ as_lineno_1=$LINENO as_lineno_1a=$LINENO ++ as_lineno_2=$LINENO as_lineno_2a=$LINENO ++ eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" && ++ test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || { ++ # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-) + sed -n ' + p + /[$]LINENO/= +@@ -452,8 +440,7 @@ + s/-\n.*// + ' >$as_me.lineno && + chmod +x "$as_me.lineno" || +- { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 +- { (exit 1); exit 1; }; } ++ { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; } + + # Don't try to exec as it changes $[0], causing all sort of problems + # (the dirname of $[0] is not the place where we might find the +@@ -463,49 +450,40 @@ + exit + } + +- +-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then +- as_dirname=dirname +-else +- as_dirname=false +-fi +- + ECHO_C= ECHO_N= ECHO_T= +-case `echo -n x` in ++case `echo -n x` in #((((( + -n*) +- case `echo 'x\c'` in ++ case `echo 'xy\c'` in + *c*) ECHO_T=' ';; # ECHO_T is single tab character. +- *) ECHO_C='\c';; ++ xy) ECHO_C='\c';; ++ *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ++ ECHO_T=' ';; + esac;; + *) + ECHO_N='-n';; + esac + +-if expr a : '\(a\)' >/dev/null 2>&1 && +- test "X`expr 00001 : '.*\(...\)'`" = X001; then +- as_expr=expr +-else +- as_expr=false +-fi +- + rm -f conf$$ conf$$.exe conf$$.file + if test -d conf$$.dir; then + rm -f conf$$.dir/conf$$.file + else + rm -f conf$$.dir +- mkdir conf$$.dir ++ mkdir conf$$.dir 2>/dev/null + fi +-echo >conf$$.file +-if ln -s conf$$.file conf$$ 2>/dev/null; then +- as_ln_s='ln -s' +- # ... but there are two gotchas: +- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. +- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. +- # In both cases, we have to default to `cp -p'. +- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++if (echo >conf$$.file) 2>/dev/null; then ++ if ln -s conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s='ln -s' ++ # ... but there are two gotchas: ++ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. ++ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. ++ # In both cases, we have to default to `cp -p'. ++ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++ as_ln_s='cp -p' ++ elif ln conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s=ln ++ else + as_ln_s='cp -p' +-elif ln conf$$.file conf$$ 2>/dev/null; then +- as_ln_s=ln ++ fi + else + as_ln_s='cp -p' + fi +@@ -513,7 +491,7 @@ + rmdir conf$$.dir 2>/dev/null + + if mkdir -p . 2>/dev/null; then +- as_mkdir_p=: ++ as_mkdir_p='mkdir -p "$as_dir"' + else + test -d ./-p && rmdir ./-p + as_mkdir_p=false +@@ -530,12 +508,12 @@ + as_test_x=' + eval sh -c '\'' + if test -d "$1"; then +- test -d "$1/."; ++ test -d "$1/."; + else +- case $1 in +- -*)set "./$1";; ++ case $1 in #( ++ -*)set "./$1";; + esac; +- case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in ++ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #(( + ???[sx]*):;;*)false;;esac;fi + '\'' sh + ' +@@ -549,11 +527,11 @@ + as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" + + +- +-exec 7<&0 </dev/null 6>&1 ++test -n "$DJDIR" || exec 7<&0 </dev/null ++exec 6>&1 + + # Name of the host. +-# hostname on some systems (SVR3.2, Linux) returns a bogus exit status, ++# hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status, + # so uname gets run too. + ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` + +@@ -568,7 +546,6 @@ + subdirs= + MFLAGS= + MAKEFLAGS= +-SHELL=${CONFIG_SHELL-/bin/sh} + + # Identity of this package. + PACKAGE_NAME= +@@ -576,58 +553,102 @@ + PACKAGE_VERSION= + PACKAGE_STRING= + PACKAGE_BUGREPORT= ++PACKAGE_URL= + + ac_unique_file="rlm_eap_tnc.c" +-ac_subst_vars='SHELL +-PATH_SEPARATOR +-PACKAGE_NAME +-PACKAGE_TARNAME +-PACKAGE_VERSION +-PACKAGE_STRING +-PACKAGE_BUGREPORT +-exec_prefix +-prefix +-program_transform_name +-bindir +-sbindir +-libexecdir +-datarootdir +-datadir +-sysconfdir +-sharedstatedir +-localstatedir +-includedir +-oldincludedir +-docdir +-infodir +-htmldir +-dvidir +-pdfdir +-psdir +-libdir +-localedir +-mandir +-DEFS +-ECHO_C +-ECHO_N +-ECHO_T +-LIBS +-build_alias +-host_alias +-target_alias +-CC +-CFLAGS +-LDFLAGS +-CPPFLAGS +-ac_ct_CC +-EXEEXT +-OBJEXT +-eap_tnc_cflags +-eap_tnc_ldflags +-targetname ++# Factoring default headers for most tests. ++ac_includes_default="\ ++#include <stdio.h> ++#ifdef HAVE_SYS_TYPES_H ++# include <sys/types.h> ++#endif ++#ifdef HAVE_SYS_STAT_H ++# include <sys/stat.h> ++#endif ++#ifdef STDC_HEADERS ++# include <stdlib.h> ++# include <stddef.h> ++#else ++# ifdef HAVE_STDLIB_H ++# include <stdlib.h> ++# endif ++#endif ++#ifdef HAVE_STRING_H ++# if !defined STDC_HEADERS && defined HAVE_MEMORY_H ++# include <memory.h> ++# endif ++# include <string.h> ++#endif ++#ifdef HAVE_STRINGS_H ++# include <strings.h> ++#endif ++#ifdef HAVE_INTTYPES_H ++# include <inttypes.h> ++#endif ++#ifdef HAVE_STDINT_H ++# include <stdint.h> ++#endif ++#ifdef HAVE_UNISTD_H ++# include <unistd.h> ++#endif" ++ ++ac_subst_vars='LTLIBOBJS + LIBOBJS +-LTLIBOBJS' ++targetname ++eap_tnc_ldflags ++eap_tnc_cflags ++EGREP ++GREP ++CPP ++OBJEXT ++EXEEXT ++ac_ct_CC ++CPPFLAGS ++LDFLAGS ++CFLAGS ++CC ++target_alias ++host_alias ++build_alias ++LIBS ++ECHO_T ++ECHO_N ++ECHO_C ++DEFS ++mandir ++localedir ++libdir ++psdir ++pdfdir ++dvidir ++htmldir ++infodir ++docdir ++oldincludedir ++includedir ++localstatedir ++sharedstatedir ++sysconfdir ++datadir ++datarootdir ++libexecdir ++sbindir ++bindir ++program_transform_name ++prefix ++exec_prefix ++PACKAGE_URL ++PACKAGE_BUGREPORT ++PACKAGE_STRING ++PACKAGE_VERSION ++PACKAGE_TARNAME ++PACKAGE_NAME ++PATH_SEPARATOR ++SHELL' + ac_subst_files='' ++ac_user_opts=' ++enable_option_checking ++' + ac_precious_vars='build_alias + host_alias + target_alias +@@ -635,12 +656,15 @@ + CFLAGS + LDFLAGS + LIBS +-CPPFLAGS' ++CPPFLAGS ++CPP' + + + # Initialize some variables set by options. + ac_init_help= + ac_init_version=false ++ac_unrecognized_opts= ++ac_unrecognized_sep= + # The variables have the same names as the options, with + # dashes changed to underlines. + cache_file=/dev/null +@@ -696,8 +720,9 @@ + fi + + case $ac_option in +- *=*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; +- *) ac_optarg=yes ;; ++ *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; ++ *=) ac_optarg= ;; ++ *) ac_optarg=yes ;; + esac + + # Accept the important Cygnus configure options, so we can diagnose typos. +@@ -739,13 +764,20 @@ + datarootdir=$ac_optarg ;; + + -disable-* | --disable-*) +- ac_feature=`expr "x$ac_option" : 'x-*disable-\(.*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid feature name: $ac_feature" >&2 +- { (exit 1); exit 1; }; } +- ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'` +- eval enable_$ac_feature=no ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid feature name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"enable_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval enable_$ac_useropt=no ;; + + -docdir | --docdir | --docdi | --doc | --do) + ac_prev=docdir ;; +@@ -758,13 +790,20 @@ + dvidir=$ac_optarg ;; + + -enable-* | --enable-*) +- ac_feature=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid feature name: $ac_feature" >&2 +- { (exit 1); exit 1; }; } +- ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'` +- eval enable_$ac_feature=\$ac_optarg ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid feature name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"enable_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval enable_$ac_useropt=\$ac_optarg ;; + + -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ + | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ +@@ -955,22 +994,36 @@ + ac_init_version=: ;; + + -with-* | --with-*) +- ac_package=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid package name: $ac_package" >&2 +- { (exit 1); exit 1; }; } +- ac_package=`echo $ac_package | sed 's/[-.]/_/g'` +- eval with_$ac_package=\$ac_optarg ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid package name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"with_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval with_$ac_useropt=\$ac_optarg ;; + + -without-* | --without-*) +- ac_package=`expr "x$ac_option" : 'x-*without-\(.*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid package name: $ac_package" >&2 +- { (exit 1); exit 1; }; } +- ac_package=`echo $ac_package | sed 's/[-.]/_/g'` +- eval with_$ac_package=no ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid package name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"with_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval with_$ac_useropt=no ;; + + --x) + # Obsolete; use --with-x. +@@ -990,25 +1043,25 @@ + | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) + x_libraries=$ac_optarg ;; + +- -*) { echo "$as_me: error: unrecognized option: $ac_option +-Try \`$0 --help' for more information." >&2 +- { (exit 1); exit 1; }; } ++ -*) as_fn_error $? "unrecognized option: \`$ac_option' ++Try \`$0 --help' for more information" + ;; + + *=*) + ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` + # Reject names that are not valid shell variable names. +- expr "x$ac_envvar" : ".*[^_$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid variable name: $ac_envvar" >&2 +- { (exit 1); exit 1; }; } ++ case $ac_envvar in #( ++ '' | [0-9]* | *[!_$as_cr_alnum]* ) ++ as_fn_error $? "invalid variable name: \`$ac_envvar'" ;; ++ esac + eval $ac_envvar=\$ac_optarg + export $ac_envvar ;; + + *) + # FIXME: should be removed in autoconf 3.0. +- echo "$as_me: WARNING: you should use --build, --host, --target" >&2 ++ $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2 + expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && +- echo "$as_me: WARNING: invalid host type: $ac_option" >&2 ++ $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2 + : ${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option} + ;; + +@@ -1017,23 +1070,36 @@ + + if test -n "$ac_prev"; then + ac_option=--`echo $ac_prev | sed 's/_/-/g'` +- { echo "$as_me: error: missing argument to $ac_option" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "missing argument to $ac_option" ++fi ++ ++if test -n "$ac_unrecognized_opts"; then ++ case $enable_option_checking in ++ no) ;; ++ fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;; ++ *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; ++ esac + fi + +-# Be sure to have absolute directory names. ++# Check all directory arguments for consistency. + for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ + datadir sysconfdir sharedstatedir localstatedir includedir \ + oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ + libdir localedir mandir + do + eval ac_val=\$$ac_var ++ # Remove trailing slashes. ++ case $ac_val in ++ */ ) ++ ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` ++ eval $ac_var=\$ac_val;; ++ esac ++ # Be sure to have absolute directory names. + case $ac_val in + [\\/$]* | ?:[\\/]* ) continue;; + NONE | '' ) case $ac_var in *prefix ) continue;; esac;; + esac +- { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val" + done + + # There might be people who depend on the old broken behavior: `$host' +@@ -1047,8 +1113,8 @@ + if test "x$host_alias" != x; then + if test "x$build_alias" = x; then + cross_compiling=maybe +- echo "$as_me: WARNING: If you wanted to set the --build type, don't use --host. +- If a cross compiler is detected then cross compile mode will be used." >&2 ++ $as_echo "$as_me: WARNING: if you wanted to set the --build type, don't use --host. ++ If a cross compiler is detected then cross compile mode will be used" >&2 + elif test "x$build_alias" != "x$host_alias"; then + cross_compiling=yes + fi +@@ -1063,23 +1129,21 @@ + ac_pwd=`pwd` && test -n "$ac_pwd" && + ac_ls_di=`ls -di .` && + ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || +- { echo "$as_me: error: Working directory cannot be determined" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "working directory cannot be determined" + test "X$ac_ls_di" = "X$ac_pwd_ls_di" || +- { echo "$as_me: error: pwd does not report name of working directory" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "pwd does not report name of working directory" + + + # Find the source files, if location was not specified. + if test -z "$srcdir"; then + ac_srcdir_defaulted=yes + # Try the directory containing this script, then the parent directory. +- ac_confdir=`$as_dirname -- "$0" || +-$as_expr X"$0" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ +- X"$0" : 'X\(//\)[^/]' \| \ +- X"$0" : 'X\(//\)$' \| \ +- X"$0" : 'X\(/\)' \| . 2>/dev/null || +-echo X"$0" | ++ ac_confdir=`$as_dirname -- "$as_myself" || ++$as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ ++ X"$as_myself" : 'X\(//\)[^/]' \| \ ++ X"$as_myself" : 'X\(//\)$' \| \ ++ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X"$as_myself" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ + s//\1/ + q +@@ -1106,13 +1170,11 @@ + fi + if test ! -r "$srcdir/$ac_unique_file"; then + test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." +- { echo "$as_me: error: cannot find sources ($ac_unique_file) in $srcdir" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir" + fi + ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" + ac_abs_confdir=`( +- cd "$srcdir" && test -r "./$ac_unique_file" || { echo "$as_me: error: $ac_msg" >&2 +- { (exit 1); exit 1; }; } ++ cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg" + pwd)` + # When building in place, set srcdir=. + if test "$ac_abs_confdir" = "$ac_pwd"; then +@@ -1152,7 +1214,7 @@ + --help=short display options specific to this package + --help=recursive display the short help of all the included packages + -V, --version display version information and exit +- -q, --quiet, --silent do not print \`checking...' messages ++ -q, --quiet, --silent do not print \`checking ...' messages + --cache-file=FILE cache test results in FILE [disabled] + -C, --config-cache alias for \`--cache-file=config.cache' + -n, --no-create do not create output files +@@ -1160,9 +1222,9 @@ + + Installation directories: + --prefix=PREFIX install architecture-independent files in PREFIX +- [$ac_default_prefix] ++ [$ac_default_prefix] + --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX +- [PREFIX] ++ [PREFIX] + + By default, \`make install' will install all the files in + \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify +@@ -1172,25 +1234,25 @@ + For better control, use the options below. + + Fine tuning of the installation directories: +- --bindir=DIR user executables [EPREFIX/bin] +- --sbindir=DIR system admin executables [EPREFIX/sbin] +- --libexecdir=DIR program executables [EPREFIX/libexec] +- --sysconfdir=DIR read-only single-machine data [PREFIX/etc] +- --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] +- --localstatedir=DIR modifiable single-machine data [PREFIX/var] +- --libdir=DIR object code libraries [EPREFIX/lib] +- --includedir=DIR C header files [PREFIX/include] +- --oldincludedir=DIR C header files for non-gcc [/usr/include] +- --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] +- --datadir=DIR read-only architecture-independent data [DATAROOTDIR] +- --infodir=DIR info documentation [DATAROOTDIR/info] +- --localedir=DIR locale-dependent data [DATAROOTDIR/locale] +- --mandir=DIR man documentation [DATAROOTDIR/man] +- --docdir=DIR documentation root [DATAROOTDIR/doc/PACKAGE] +- --htmldir=DIR html documentation [DOCDIR] +- --dvidir=DIR dvi documentation [DOCDIR] +- --pdfdir=DIR pdf documentation [DOCDIR] +- --psdir=DIR ps documentation [DOCDIR] ++ --bindir=DIR user executables [EPREFIX/bin] ++ --sbindir=DIR system admin executables [EPREFIX/sbin] ++ --libexecdir=DIR program executables [EPREFIX/libexec] ++ --sysconfdir=DIR read-only single-machine data [PREFIX/etc] ++ --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] ++ --localstatedir=DIR modifiable single-machine data [PREFIX/var] ++ --libdir=DIR object code libraries [EPREFIX/lib] ++ --includedir=DIR C header files [PREFIX/include] ++ --oldincludedir=DIR C header files for non-gcc [/usr/include] ++ --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] ++ --datadir=DIR read-only architecture-independent data [DATAROOTDIR] ++ --infodir=DIR info documentation [DATAROOTDIR/info] ++ --localedir=DIR locale-dependent data [DATAROOTDIR/locale] ++ --mandir=DIR man documentation [DATAROOTDIR/man] ++ --docdir=DIR documentation root [DATAROOTDIR/doc/PACKAGE] ++ --htmldir=DIR html documentation [DOCDIR] ++ --dvidir=DIR dvi documentation [DOCDIR] ++ --pdfdir=DIR pdf documentation [DOCDIR] ++ --psdir=DIR ps documentation [DOCDIR] + _ACEOF + + cat <<\_ACEOF +@@ -1207,12 +1269,14 @@ + LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a + nonstandard directory <lib dir> + LIBS libraries to pass to the linker, e.g. -l<library> +- CPPFLAGS C/C++/Objective C preprocessor flags, e.g. -I<include dir> if ++ CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if + you have headers in a nonstandard directory <include dir> ++ CPP C preprocessor + + Use these variables to override the choices made by `configure' or to help + it to find libraries and programs with nonstandard names/locations. + ++Report bugs to the package provider. + _ACEOF + ac_status=$? + fi +@@ -1220,15 +1284,17 @@ + if test "$ac_init_help" = "recursive"; then + # If there are subdirs, report their specific --help. + for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue +- test -d "$ac_dir" || continue ++ test -d "$ac_dir" || ++ { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || ++ continue + ac_builddir=. + + case "$ac_dir" in + .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) +- ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` ++ ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` + # A ".." for each directory in $ac_dir_suffix. +- ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'` ++ ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` + case $ac_top_builddir_sub in + "") ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; +@@ -1264,7 +1330,7 @@ + echo && + $SHELL "$ac_srcdir/configure" --help=recursive + else +- echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 ++ $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 + fi || ac_status=$? + cd "$ac_pwd" || { ac_status=$?; break; } + done +@@ -1274,21 +1340,305 @@ + if $ac_init_version; then + cat <<\_ACEOF + configure +-generated by GNU Autoconf 2.61 ++generated by GNU Autoconf 2.67 + +-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, +-2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc. ++Copyright (C) 2010 Free Software Foundation, Inc. + This configure script is free software; the Free Software Foundation + gives unlimited permission to copy, distribute and modify it. + _ACEOF + exit + fi ++ ++## ------------------------ ## ++## Autoconf initialization. ## ++## ------------------------ ## ++ ++# ac_fn_c_try_compile LINENO ++# -------------------------- ++# Try to compile conftest.$ac_ext, and return whether this succeeded. ++ac_fn_c_try_compile () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ rm -f conftest.$ac_objext ++ if { { ac_try="$ac_compile" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_compile") 2>conftest.err ++ ac_status=$? ++ if test -s conftest.err; then ++ grep -v '^ *+' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ mv -f conftest.er1 conftest.err ++ fi ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest.$ac_objext; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=1 ++fi ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_compile ++ ++# ac_fn_c_try_link LINENO ++# ----------------------- ++# Try to link conftest.$ac_ext, and return whether this succeeded. ++ac_fn_c_try_link () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ rm -f conftest.$ac_objext conftest$ac_exeext ++ if { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>conftest.err ++ ac_status=$? ++ if test -s conftest.err; then ++ grep -v '^ *+' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ mv -f conftest.er1 conftest.err ++ fi ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest$ac_exeext && { ++ test "$cross_compiling" = yes || ++ $as_test_x conftest$ac_exeext ++ }; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=1 ++fi ++ # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information ++ # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would ++ # interfere with the next link command; also delete a directory that is ++ # left behind by Apple's compiler. We do this before executing the actions. ++ rm -rf conftest.dSYM conftest_ipa8_conftest.oo ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_link ++ ++# ac_fn_c_try_cpp LINENO ++# ---------------------- ++# Try to preprocess conftest.$ac_ext, and return whether this succeeded. ++ac_fn_c_try_cpp () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ if { { ac_try="$ac_cpp conftest.$ac_ext" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err ++ ac_status=$? ++ if test -s conftest.err; then ++ grep -v '^ *+' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ mv -f conftest.er1 conftest.err ++ fi ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } > conftest.i && { ++ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || ++ test ! -s conftest.err ++ }; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=1 ++fi ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_cpp ++ ++# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES ++# ------------------------------------------------------- ++# Tests whether HEADER exists, giving a warning if it cannot be compiled using ++# the include files in INCLUDES and setting the cache variable VAR ++# accordingly. ++ac_fn_c_check_header_mongrel () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ if eval "test \"\${$3+set}\"" = set; then : ++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 ++$as_echo_n "checking for $2... " >&6; } ++if eval "test \"\${$3+set}\"" = set; then : ++ $as_echo_n "(cached) " >&6 ++fi ++eval ac_res=\$$3 ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 ++$as_echo "$ac_res" >&6; } ++else ++ # Is the header compilable? ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5 ++$as_echo_n "checking $2 usability... " >&6; } ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++$4 ++#include <$2> ++_ACEOF ++if ac_fn_c_try_compile "$LINENO"; then : ++ ac_header_compiler=yes ++else ++ ac_header_compiler=no ++fi ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5 ++$as_echo "$ac_header_compiler" >&6; } ++ ++# Is the header present? ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5 ++$as_echo_n "checking $2 presence... " >&6; } ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <$2> ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ ac_header_preproc=yes ++else ++ ac_header_preproc=no ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5 ++$as_echo "$ac_header_preproc" >&6; } ++ ++# So? What about this header? ++case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #(( ++ yes:no: ) ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5 ++$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 ++$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ++ ;; ++ no:yes:* ) ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5 ++$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5 ++$as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5 ++$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5 ++$as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 ++$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ++ ;; ++esac ++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 ++$as_echo_n "checking for $2... " >&6; } ++if eval "test \"\${$3+set}\"" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ eval "$3=\$ac_header_compiler" ++fi ++eval ac_res=\$$3 ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 ++$as_echo "$ac_res" >&6; } ++fi ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ ++} # ac_fn_c_check_header_mongrel ++ ++# ac_fn_c_try_run LINENO ++# ---------------------- ++# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes ++# that executables *can* be run. ++ac_fn_c_try_run () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ if { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } && { ac_try='./conftest$ac_exeext' ++ { { case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_try") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; }; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: program exited with status $ac_status" >&5 ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=$ac_status ++fi ++ rm -rf conftest.dSYM conftest_ipa8_conftest.oo ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_run ++ ++# ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES ++# ------------------------------------------------------- ++# Tests whether HEADER exists and can be compiled using the include files in ++# INCLUDES, setting the cache variable VAR accordingly. ++ac_fn_c_check_header_compile () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 ++$as_echo_n "checking for $2... " >&6; } ++if eval "test \"\${$3+set}\"" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++$4 ++#include <$2> ++_ACEOF ++if ac_fn_c_try_compile "$LINENO"; then : ++ eval "$3=yes" ++else ++ eval "$3=no" ++fi ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++fi ++eval ac_res=\$$3 ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 ++$as_echo "$ac_res" >&6; } ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ ++} # ac_fn_c_check_header_compile + cat >config.log <<_ACEOF + This file contains any messages produced by compilers while + running configure, to aid debugging if configure makes a mistake. + + It was created by $as_me, which was +-generated by GNU Autoconf 2.61. Invocation command line was ++generated by GNU Autoconf 2.67. Invocation command line was + + $ $0 $@ + +@@ -1324,8 +1674,8 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- echo "PATH: $as_dir" +-done ++ $as_echo "PATH: $as_dir" ++ done + IFS=$as_save_IFS + + } >&5 +@@ -1359,12 +1709,12 @@ + | -silent | --silent | --silen | --sile | --sil) + continue ;; + *\'*) +- ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; ++ ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; + esac + case $ac_pass in +- 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;; ++ 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;; + 2) +- ac_configure_args1="$ac_configure_args1 '$ac_arg'" ++ as_fn_append ac_configure_args1 " '$ac_arg'" + if test $ac_must_keep_next = true; then + ac_must_keep_next=false # Got value, back to normal. + else +@@ -1380,13 +1730,13 @@ + -* ) ac_must_keep_next=true ;; + esac + fi +- ac_configure_args="$ac_configure_args '$ac_arg'" ++ as_fn_append ac_configure_args " '$ac_arg'" + ;; + esac + done + done +-$as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; } +-$as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; } ++{ ac_configure_args0=; unset ac_configure_args0;} ++{ ac_configure_args1=; unset ac_configure_args1;} + + # When interrupted or exit'd, cleanup temporary files, and complete + # config.log. We remove comments because anyway the quotes in there +@@ -1398,11 +1748,9 @@ + { + echo + +- cat <<\_ASBOX +-## ---------------- ## ++ $as_echo "## ---------------- ## + ## Cache variables. ## +-## ---------------- ## +-_ASBOX ++## ---------------- ##" + echo + # The following way of writing the cache mishandles newlines in values, + ( +@@ -1411,12 +1759,13 @@ + case $ac_val in #( + *${as_nl}*) + case $ac_var in #( +- *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5 +-echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;; ++ *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 ++$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; + esac + case $ac_var in #( + _ | IFS | as_nl) ;; #( +- *) $as_unset $ac_var ;; ++ BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( ++ *) { eval $ac_var=; unset $ac_var;} ;; + esac ;; + esac + done +@@ -1435,128 +1784,136 @@ + ) + echo + +- cat <<\_ASBOX +-## ----------------- ## ++ $as_echo "## ----------------- ## + ## Output variables. ## +-## ----------------- ## +-_ASBOX ++## ----------------- ##" + echo + for ac_var in $ac_subst_vars + do + eval ac_val=\$$ac_var + case $ac_val in +- *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; ++ *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; + esac +- echo "$ac_var='\''$ac_val'\''" ++ $as_echo "$ac_var='\''$ac_val'\''" + done | sort + echo + + if test -n "$ac_subst_files"; then +- cat <<\_ASBOX +-## ------------------- ## ++ $as_echo "## ------------------- ## + ## File substitutions. ## +-## ------------------- ## +-_ASBOX ++## ------------------- ##" + echo + for ac_var in $ac_subst_files + do + eval ac_val=\$$ac_var + case $ac_val in +- *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; ++ *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; + esac +- echo "$ac_var='\''$ac_val'\''" ++ $as_echo "$ac_var='\''$ac_val'\''" + done | sort + echo + fi + + if test -s confdefs.h; then +- cat <<\_ASBOX +-## ----------- ## ++ $as_echo "## ----------- ## + ## confdefs.h. ## +-## ----------- ## +-_ASBOX ++## ----------- ##" + echo + cat confdefs.h + echo + fi + test "$ac_signal" != 0 && +- echo "$as_me: caught signal $ac_signal" +- echo "$as_me: exit $exit_status" ++ $as_echo "$as_me: caught signal $ac_signal" ++ $as_echo "$as_me: exit $exit_status" + } >&5 + rm -f core *.core core.conftest.* && + rm -f -r conftest* confdefs* conf$$* $ac_clean_files && + exit $exit_status + ' 0 + for ac_signal in 1 2 13 15; do +- trap 'ac_signal='$ac_signal'; { (exit 1); exit 1; }' $ac_signal ++ trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal + done + ac_signal=0 + + # confdefs.h avoids OS command line length limits that DEFS can exceed. + rm -f -r conftest* confdefs.h + ++$as_echo "/* confdefs.h */" > confdefs.h ++ + # Predefined preprocessor variables. + + cat >>confdefs.h <<_ACEOF + #define PACKAGE_NAME "$PACKAGE_NAME" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_TARNAME "$PACKAGE_TARNAME" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_VERSION "$PACKAGE_VERSION" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_STRING "$PACKAGE_STRING" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" + _ACEOF + ++cat >>confdefs.h <<_ACEOF ++#define PACKAGE_URL "$PACKAGE_URL" ++_ACEOF ++ + + # Let the site file select an alternate cache file if it wants to. +-# Prefer explicitly selected file to automatically selected ones. ++# Prefer an explicitly selected file to automatically selected ones. ++ac_site_file1=NONE ++ac_site_file2=NONE + if test -n "$CONFIG_SITE"; then +- set x "$CONFIG_SITE" ++ # We do not want a PATH search for config.site. ++ case $CONFIG_SITE in #(( ++ -*) ac_site_file1=./$CONFIG_SITE;; ++ */*) ac_site_file1=$CONFIG_SITE;; ++ *) ac_site_file1=./$CONFIG_SITE;; ++ esac + elif test "x$prefix" != xNONE; then +- set x "$prefix/share/config.site" "$prefix/etc/config.site" ++ ac_site_file1=$prefix/share/config.site ++ ac_site_file2=$prefix/etc/config.site + else +- set x "$ac_default_prefix/share/config.site" \ +- "$ac_default_prefix/etc/config.site" ++ ac_site_file1=$ac_default_prefix/share/config.site ++ ac_site_file2=$ac_default_prefix/etc/config.site + fi +-shift +-for ac_site_file ++for ac_site_file in "$ac_site_file1" "$ac_site_file2" + do +- if test -r "$ac_site_file"; then +- { echo "$as_me:$LINENO: loading site script $ac_site_file" >&5 +-echo "$as_me: loading site script $ac_site_file" >&6;} ++ test "x$ac_site_file" = xNONE && continue ++ if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5 ++$as_echo "$as_me: loading site script $ac_site_file" >&6;} + sed 's/^/| /' "$ac_site_file" >&5 +- . "$ac_site_file" ++ . "$ac_site_file" \ ++ || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "failed to load site script $ac_site_file ++See \`config.log' for more details" "$LINENO" 5 ; } + fi + done + + if test -r "$cache_file"; then +- # Some versions of bash will fail to source /dev/null (special +- # files actually), so we avoid doing that. +- if test -f "$cache_file"; then +- { echo "$as_me:$LINENO: loading cache $cache_file" >&5 +-echo "$as_me: loading cache $cache_file" >&6;} ++ # Some versions of bash will fail to source /dev/null (special files ++ # actually), so we avoid doing that. DJGPP emulates it as a regular file. ++ if test /dev/null != "$cache_file" && test -f "$cache_file"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5 ++$as_echo "$as_me: loading cache $cache_file" >&6;} + case $cache_file in + [\\/]* | ?:[\\/]* ) . "$cache_file";; + *) . "./$cache_file";; + esac + fi + else +- { echo "$as_me:$LINENO: creating cache $cache_file" >&5 +-echo "$as_me: creating cache $cache_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5 ++$as_echo "$as_me: creating cache $cache_file" >&6;} + >$cache_file + fi + +@@ -1570,60 +1927,56 @@ + eval ac_new_val=\$ac_env_${ac_var}_value + case $ac_old_set,$ac_new_set in + set,) +- { echo "$as_me:$LINENO: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 +-echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 ++$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} + ac_cache_corrupted=: ;; + ,set) +- { echo "$as_me:$LINENO: error: \`$ac_var' was not set in the previous run" >&5 +-echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5 ++$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} + ac_cache_corrupted=: ;; + ,);; + *) + if test "x$ac_old_val" != "x$ac_new_val"; then +- { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5 +-echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} +- { echo "$as_me:$LINENO: former value: $ac_old_val" >&5 +-echo "$as_me: former value: $ac_old_val" >&2;} +- { echo "$as_me:$LINENO: current value: $ac_new_val" >&5 +-echo "$as_me: current value: $ac_new_val" >&2;} +- ac_cache_corrupted=: ++ # differences in whitespace do not lead to failure. ++ ac_old_val_w=`echo x $ac_old_val` ++ ac_new_val_w=`echo x $ac_new_val` ++ if test "$ac_old_val_w" != "$ac_new_val_w"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5 ++$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ++ ac_cache_corrupted=: ++ else ++ { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 ++$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} ++ eval $ac_var=\$ac_old_val ++ fi ++ { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5 ++$as_echo "$as_me: former value: \`$ac_old_val'" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5 ++$as_echo "$as_me: current value: \`$ac_new_val'" >&2;} + fi;; + esac + # Pass precious variables to config.status. + if test "$ac_new_set" = set; then + case $ac_new_val in +- *\'*) ac_arg=$ac_var=`echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; ++ *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; + *) ac_arg=$ac_var=$ac_new_val ;; + esac + case " $ac_configure_args " in + *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. +- *) ac_configure_args="$ac_configure_args '$ac_arg'" ;; ++ *) as_fn_append ac_configure_args " '$ac_arg'" ;; + esac + fi + done + if $ac_cache_corrupted; then +- { echo "$as_me:$LINENO: error: changes in the environment can compromise the build" >&5 +-echo "$as_me: error: changes in the environment can compromise the build" >&2;} +- { { echo "$as_me:$LINENO: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&5 +-echo "$as_me: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&2;} +- { (exit 1); exit 1; }; } +-fi +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5 ++$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;} ++ as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5 ++fi ++## -------------------- ## ++## Main body of script. ## ++## -------------------- ## + + ac_ext=c + ac_cpp='$CPP $CPPFLAGS' +@@ -1635,6 +1988,9 @@ + + + ++eap_tnc_cflags= ++eap_tnc_ldflags=-lnaaeap ++ + if test x$with_rlm_eap_tnc != xno; then + + ac_ext=c +@@ -1645,10 +2001,10 @@ + if test -n "$ac_tool_prefix"; then + # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. + set dummy ${ac_tool_prefix}gcc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1658,25 +2014,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_CC="${ac_tool_prefix}gcc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1685,10 +2041,10 @@ + ac_ct_CC=$CC + # Extract the first word of "gcc", so it can be a program name with args. + set dummy gcc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_ac_ct_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_ac_ct_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$ac_ct_CC"; then + ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. +@@ -1698,25 +2054,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_ac_ct_CC="gcc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + ac_ct_CC=$ac_cv_prog_ac_ct_CC + if test -n "$ac_ct_CC"; then +- { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5 +-echo "${ECHO_T}$ac_ct_CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 ++$as_echo "$ac_ct_CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + if test "x$ac_ct_CC" = x; then +@@ -1724,12 +2080,8 @@ + else + case $cross_compiling:$ac_tool_warned in + yes:) +-{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&5 +-echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&2;} ++{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 ++$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} + ac_tool_warned=yes ;; + esac + CC=$ac_ct_CC +@@ -1742,10 +2094,10 @@ + if test -n "$ac_tool_prefix"; then + # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. + set dummy ${ac_tool_prefix}cc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1755,25 +2107,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_CC="${ac_tool_prefix}cc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1782,10 +2134,10 @@ + if test -z "$CC"; then + # Extract the first word of "cc", so it can be a program name with args. + set dummy cc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1796,18 +2148,18 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then + ac_prog_rejected=yes + continue + fi + ac_cv_prog_CC="cc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + if test $ac_prog_rejected = yes; then +@@ -1826,11 +2178,11 @@ + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1841,10 +2193,10 @@ + do + # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. + set dummy $ac_tool_prefix$ac_prog; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1854,25 +2206,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_CC="$ac_tool_prefix$ac_prog" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1885,10 +2237,10 @@ + do + # Extract the first word of "$ac_prog", so it can be a program name with args. + set dummy $ac_prog; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_ac_ct_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_ac_ct_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$ac_ct_CC"; then + ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. +@@ -1898,25 +2250,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_ac_ct_CC="$ac_prog" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + ac_ct_CC=$ac_cv_prog_ac_ct_CC + if test -n "$ac_ct_CC"; then +- { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5 +-echo "${ECHO_T}$ac_ct_CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 ++$as_echo "$ac_ct_CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1928,12 +2280,8 @@ + else + case $cross_compiling:$ac_tool_warned in + yes:) +-{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&5 +-echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&2;} ++{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 ++$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} + ac_tool_warned=yes ;; + esac + CC=$ac_ct_CC +@@ -1943,51 +2291,37 @@ + fi + + +-test -z "$CC" && { { echo "$as_me:$LINENO: error: no acceptable C compiler found in \$PATH +-See \`config.log' for more details." >&5 +-echo "$as_me: error: no acceptable C compiler found in \$PATH +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } ++test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "no acceptable C compiler found in \$PATH ++See \`config.log' for more details" "$LINENO" 5 ; } + + # Provide some information about the compiler. +-echo "$as_me:$LINENO: checking for C compiler version" >&5 +-ac_compiler=`set X $ac_compile; echo $2` +-{ (ac_try="$ac_compiler --version >&5" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compiler --version >&5") 2>&5 +- ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } +-{ (ac_try="$ac_compiler -v >&5" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compiler -v >&5") 2>&5 +- ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } +-{ (ac_try="$ac_compiler -V >&5" ++$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 ++set X $ac_compile ++ac_compiler=$2 ++for ac_option in --version -v -V -qversion; do ++ { { ac_try="$ac_compiler $ac_option >&5" + case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compiler -V >&5") 2>&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_compiler $ac_option >&5") 2>conftest.err + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } ++ if test -s conftest.err; then ++ sed '10a\ ++... rest of stderr output deleted ... ++ 10q' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ fi ++ rm -f conftest.er1 conftest.err ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } ++done + +-cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -1999,42 +2333,38 @@ + } + _ACEOF + ac_clean_files_save=$ac_clean_files +-ac_clean_files="$ac_clean_files a.out a.exe b.out" ++ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out" + # Try to create an executable without -o first, disregard a.out. + # It will help us diagnose broken compilers, and finding out an intuition + # of exeext. +-{ echo "$as_me:$LINENO: checking for C compiler default output file name" >&5 +-echo $ECHO_N "checking for C compiler default output file name... $ECHO_C" >&6; } +-ac_link_default=`echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` +-# +-# List of possible output files, starting from the most likely. +-# The algorithm is not robust to junk in `.', hence go to wildcards (a.*) +-# only as a last resort. b.out is created by i960 compilers. +-ac_files='a_out.exe a.exe conftest.exe a.out conftest a.* conftest.* b.out' +-# +-# The IRIX 6 linker writes into existing files which may not be +-# executable, retaining their permissions. Remove them first so a +-# subsequent execution test works. ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5 ++$as_echo_n "checking whether the C compiler works... " >&6; } ++ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` ++ ++# The possible output files: ++ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*" ++ + ac_rmfiles= + for ac_file in $ac_files + do + case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;; ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; + * ) ac_rmfiles="$ac_rmfiles $ac_file";; + esac + done + rm -f $ac_rmfiles + +-if { (ac_try="$ac_link_default" ++if { { ac_try="$ac_link_default" + case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 + (eval "$ac_link_default") 2>&5 + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; then ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; then : + # Autoconf-2.13 could set the ac_cv_exeext variable to `no'. + # So ignore a value of `no', otherwise this would lead to `EXEEXT = no' + # in a Makefile. We should not override ac_cv_exeext if it was cached, +@@ -2044,14 +2374,14 @@ + do + test -f "$ac_file" || continue + case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) + ;; + [ab].out ) + # We found the default executable, but exeext='' is most + # certainly right. + break;; + *.* ) +- if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; ++ if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; + then :; else + ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` + fi +@@ -2070,116 +2400,132 @@ + else + ac_file='' + fi +- +-{ echo "$as_me:$LINENO: result: $ac_file" >&5 +-echo "${ECHO_T}$ac_file" >&6; } +-if test -z "$ac_file"; then +- echo "$as_me: failed program was:" >&5 ++if test -z "$ac_file"; then : ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } ++$as_echo "$as_me: failed program was:" >&5 + sed 's/^/| /' conftest.$ac_ext >&5 + +-{ { echo "$as_me:$LINENO: error: C compiler cannot create executables +-See \`config.log' for more details." >&5 +-echo "$as_me: error: C compiler cannot create executables +-See \`config.log' for more details." >&2;} +- { (exit 77); exit 77; }; } +-fi +- ++{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error 77 "C compiler cannot create executables ++See \`config.log' for more details" "$LINENO" 5 ; } ++else ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 ++$as_echo "yes" >&6; } ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5 ++$as_echo_n "checking for C compiler default output file name... " >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5 ++$as_echo "$ac_file" >&6; } + ac_exeext=$ac_cv_exeext + ++rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out ++ac_clean_files=$ac_clean_files_save ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5 ++$as_echo_n "checking for suffix of executables... " >&6; } ++if { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; then : ++ # If both `conftest.exe' and `conftest' are `present' (well, observable) ++# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will ++# work properly (i.e., refer to `conftest.exe'), while it won't with ++# `rm'. ++for ac_file in conftest.exe conftest conftest.*; do ++ test -f "$ac_file" || continue ++ case $ac_file in ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; ++ *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` ++ break;; ++ * ) break;; ++ esac ++done ++else ++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "cannot compute suffix of executables: cannot compile and link ++See \`config.log' for more details" "$LINENO" 5 ; } ++fi ++rm -f conftest conftest$ac_cv_exeext ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5 ++$as_echo "$ac_cv_exeext" >&6; } ++ ++rm -f conftest.$ac_ext ++EXEEXT=$ac_cv_exeext ++ac_exeext=$EXEEXT ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <stdio.h> ++int ++main () ++{ ++FILE *f = fopen ("conftest.out", "w"); ++ return ferror (f) || fclose (f) != 0; ++ ++ ; ++ return 0; ++} ++_ACEOF ++ac_clean_files="$ac_clean_files conftest.out" + # Check that the compiler produces executables we can run. If not, either + # the compiler is broken, or we cross compile. +-{ echo "$as_me:$LINENO: checking whether the C compiler works" >&5 +-echo $ECHO_N "checking whether the C compiler works... $ECHO_C" >&6; } +-# FIXME: These cross compiler hacks should be removed for Autoconf 3.0 +-# If not cross compiling, check that we can run a simple program. ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5 ++$as_echo_n "checking whether we are cross compiling... " >&6; } + if test "$cross_compiling" != yes; then +- if { ac_try='./$ac_file' +- { (case "(($ac_try" in ++ { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } ++ if { ac_try='./conftest$ac_cv_exeext' ++ { { case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 + (eval "$ac_try") 2>&5 + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; }; then ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; }; then + cross_compiling=no + else + if test "$cross_compiling" = maybe; then + cross_compiling=yes + else +- { { echo "$as_me:$LINENO: error: cannot run C compiled programs. +-If you meant to cross compile, use \`--host'. +-See \`config.log' for more details." >&5 +-echo "$as_me: error: cannot run C compiled programs. ++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "cannot run C compiled programs. + If you meant to cross compile, use \`--host'. +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } ++See \`config.log' for more details" "$LINENO" 5 ; } + fi + fi + fi +-{ echo "$as_me:$LINENO: result: yes" >&5 +-echo "${ECHO_T}yes" >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5 ++$as_echo "$cross_compiling" >&6; } + +-rm -f a.out a.exe conftest$ac_cv_exeext b.out ++rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out + ac_clean_files=$ac_clean_files_save +-# Check that the compiler produces executables we can run. If not, either +-# the compiler is broken, or we cross compile. +-{ echo "$as_me:$LINENO: checking whether we are cross compiling" >&5 +-echo $ECHO_N "checking whether we are cross compiling... $ECHO_C" >&6; } +-{ echo "$as_me:$LINENO: result: $cross_compiling" >&5 +-echo "${ECHO_T}$cross_compiling" >&6; } +- +-{ echo "$as_me:$LINENO: checking for suffix of executables" >&5 +-echo $ECHO_N "checking for suffix of executables... $ECHO_C" >&6; } +-if { (ac_try="$ac_link" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_link") 2>&5 +- ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; then +- # If both `conftest.exe' and `conftest' are `present' (well, observable) +-# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will +-# work properly (i.e., refer to `conftest.exe'), while it won't with +-# `rm'. +-for ac_file in conftest.exe conftest conftest.*; do +- test -f "$ac_file" || continue +- case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;; +- *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` +- break;; +- * ) break;; +- esac +-done ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5 ++$as_echo_n "checking for suffix of object files... " >&6; } ++if test "${ac_cv_objext+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else +- { { echo "$as_me:$LINENO: error: cannot compute suffix of executables: cannot compile and link +-See \`config.log' for more details." >&5 +-echo "$as_me: error: cannot compute suffix of executables: cannot compile and link +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } +-fi +- +-rm -f conftest$ac_cv_exeext +-{ echo "$as_me:$LINENO: result: $ac_cv_exeext" >&5 +-echo "${ECHO_T}$ac_cv_exeext" >&6; } +- +-rm -f conftest.$ac_ext +-EXEEXT=$ac_cv_exeext +-ac_exeext=$EXEEXT +-{ echo "$as_me:$LINENO: checking for suffix of object files" >&5 +-echo $ECHO_N "checking for suffix of object files... $ECHO_C" >&6; } +-if test "${ac_cv_objext+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 +-else +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2191,51 +2537,46 @@ + } + _ACEOF + rm -f conftest.o conftest.obj +-if { (ac_try="$ac_compile" ++if { { ac_try="$ac_compile" + case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 + (eval "$ac_compile") 2>&5 + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; then ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; then : + for ac_file in conftest.o conftest.obj conftest.*; do + test -f "$ac_file" || continue; + case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf ) ;; ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; + *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` + break;; + esac + done + else +- echo "$as_me: failed program was:" >&5 ++ $as_echo "$as_me: failed program was:" >&5 + sed 's/^/| /' conftest.$ac_ext >&5 + +-{ { echo "$as_me:$LINENO: error: cannot compute suffix of object files: cannot compile +-See \`config.log' for more details." >&5 +-echo "$as_me: error: cannot compute suffix of object files: cannot compile +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } ++{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "cannot compute suffix of object files: cannot compile ++See \`config.log' for more details" "$LINENO" 5 ; } + fi +- + rm -f conftest.$ac_cv_objext conftest.$ac_ext + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_objext" >&5 +-echo "${ECHO_T}$ac_cv_objext" >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5 ++$as_echo "$ac_cv_objext" >&6; } + OBJEXT=$ac_cv_objext + ac_objext=$OBJEXT +-{ echo "$as_me:$LINENO: checking whether we are using the GNU C compiler" >&5 +-echo $ECHO_N "checking whether we are using the GNU C compiler... $ECHO_C" >&6; } +-if test "${ac_cv_c_compiler_gnu+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5 ++$as_echo_n "checking whether we are using the GNU C compiler... " >&6; } ++if test "${ac_cv_c_compiler_gnu+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2249,54 +2590,34 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++if ac_fn_c_try_compile "$LINENO"; then : + ac_compiler_gnu=yes + else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- ac_compiler_gnu=no ++ ac_compiler_gnu=no + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + ac_cv_c_compiler_gnu=$ac_compiler_gnu + + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_c_compiler_gnu" >&5 +-echo "${ECHO_T}$ac_cv_c_compiler_gnu" >&6; } +-GCC=`test $ac_compiler_gnu = yes && echo yes` ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 ++$as_echo "$ac_cv_c_compiler_gnu" >&6; } ++if test $ac_compiler_gnu = yes; then ++ GCC=yes ++else ++ GCC= ++fi + ac_test_CFLAGS=${CFLAGS+set} + ac_save_CFLAGS=$CFLAGS +-{ echo "$as_me:$LINENO: checking whether $CC accepts -g" >&5 +-echo $ECHO_N "checking whether $CC accepts -g... $ECHO_C" >&6; } +-if test "${ac_cv_prog_cc_g+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 ++$as_echo_n "checking whether $CC accepts -g... " >&6; } ++if test "${ac_cv_prog_cc_g+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + ac_save_c_werror_flag=$ac_c_werror_flag + ac_c_werror_flag=yes + ac_cv_prog_cc_g=no + CFLAGS="-g" +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2307,34 +2628,11 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++if ac_fn_c_try_compile "$LINENO"; then : + ac_cv_prog_cc_g=yes + else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- CFLAGS="" +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ CFLAGS="" ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2345,35 +2643,12 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then +- : +-else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 ++if ac_fn_c_try_compile "$LINENO"; then : + +- ac_c_werror_flag=$ac_save_c_werror_flag ++else ++ ac_c_werror_flag=$ac_save_c_werror_flag + CFLAGS="-g" +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2384,42 +2659,18 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++if ac_fn_c_try_compile "$LINENO"; then : + ac_cv_prog_cc_g=yes +-else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + ac_c_werror_flag=$ac_save_c_werror_flag + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_prog_cc_g" >&5 +-echo "${ECHO_T}$ac_cv_prog_cc_g" >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 ++$as_echo "$ac_cv_prog_cc_g" >&6; } + if test "$ac_test_CFLAGS" = set; then + CFLAGS=$ac_save_CFLAGS + elif test $ac_cv_prog_cc_g = yes; then +@@ -2435,18 +2686,14 @@ + CFLAGS= + fi + fi +-{ echo "$as_me:$LINENO: checking for $CC option to accept ISO C89" >&5 +-echo $ECHO_N "checking for $CC option to accept ISO C89... $ECHO_C" >&6; } +-if test "${ac_cv_prog_cc_c89+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5 ++$as_echo_n "checking for $CC option to accept ISO C89... " >&6; } ++if test "${ac_cv_prog_cc_c89+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + ac_cv_prog_cc_c89=no + ac_save_CC=$CC +-cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + #include <stdarg.h> + #include <stdio.h> +@@ -2503,31 +2750,9 @@ + -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" + do + CC="$ac_save_CC $ac_arg" +- rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++ if ac_fn_c_try_compile "$LINENO"; then : + ac_cv_prog_cc_c89=$ac_arg +-else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- + fi +- + rm -f core conftest.err conftest.$ac_objext + test "x$ac_cv_prog_cc_c89" != "xno" && break + done +@@ -2538,17 +2763,19 @@ + # AC_CACHE_VAL + case "x$ac_cv_prog_cc_c89" in + x) +- { echo "$as_me:$LINENO: result: none needed" >&5 +-echo "${ECHO_T}none needed" >&6; } ;; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 ++$as_echo "none needed" >&6; } ;; + xno) +- { echo "$as_me:$LINENO: result: unsupported" >&5 +-echo "${ECHO_T}unsupported" >&6; } ;; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 ++$as_echo "unsupported" >&6; } ;; + *) + CC="$CC $ac_cv_prog_cc_c89" +- { echo "$as_me:$LINENO: result: $ac_cv_prog_cc_c89" >&5 +-echo "${ECHO_T}$ac_cv_prog_cc_c89" >&6; } ;; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 ++$as_echo "$ac_cv_prog_cc_c89" >&6; } ;; + esac ++if test "x$ac_cv_prog_cc_c89" != xno; then : + ++fi + + ac_ext=c + ac_cpp='$CPP $CPPFLAGS' +@@ -2557,81 +2784,474 @@ + ac_compiler_gnu=$ac_cv_c_compiler_gnu + + +- +-{ echo "$as_me:$LINENO: checking for exchangeTNCCSMessages in -lTNCS" >&5 +-echo $ECHO_N "checking for exchangeTNCCSMessages in -lTNCS... $ECHO_C" >&6; } +-if test "${ac_cv_lib_TNCS_exchangeTNCCSMessages+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for processEAPTNCData in -lnaaeap" >&5 ++$as_echo_n "checking for processEAPTNCData in -lnaaeap... " >&6; } ++if test "${ac_cv_lib_naaeap_processEAPTNCData+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + ac_check_lib_save_LIBS=$LIBS +-LIBS="-lTNCS $LIBS" +-cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ ++LIBS="-lnaaeap $LIBS" ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++ ++/* Override any GCC internal prototype to avoid an error. ++ Use char because int might match the return type of a GCC ++ builtin and then its argument prototype would still apply. */ ++#ifdef __cplusplus ++extern "C" ++#endif ++char processEAPTNCData (); ++int ++main () ++{ ++return processEAPTNCData (); ++ ; ++ return 0; ++} ++_ACEOF ++if ac_fn_c_try_link "$LINENO"; then : ++ ac_cv_lib_naaeap_processEAPTNCData=yes ++else ++ ac_cv_lib_naaeap_processEAPTNCData=no ++fi ++rm -f core conftest.err conftest.$ac_objext \ ++ conftest$ac_exeext conftest.$ac_ext ++LIBS=$ac_check_lib_save_LIBS ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_naaeap_processEAPTNCData" >&5 ++$as_echo "$ac_cv_lib_naaeap_processEAPTNCData" >&6; } ++if test "x$ac_cv_lib_naaeap_processEAPTNCData" = x""yes; then : ++ cat >>confdefs.h <<_ACEOF ++#define HAVE_LIBNAAEAP 1 ++_ACEOF ++ ++ LIBS="-lnaaeap $LIBS" ++ ++else ++ fail="$fail -lnaaeap" ++fi ++ ++ if test -x"$ac_cv_lib_NAAEAP_processEAPTNCData" == -x"no"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: the NAAEAP library was not found!" >&5 ++$as_echo "$as_me: WARNING: the NAAEAP library was not found!" >&2;} ++ fail="$fail -lNAAEAP" ++ fi ++ ++ ac_ext=c ++ac_cpp='$CPP $CPPFLAGS' ++ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ++ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ++ac_compiler_gnu=$ac_cv_c_compiler_gnu ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5 ++$as_echo_n "checking how to run the C preprocessor... " >&6; } ++# On Suns, sometimes $CPP names a directory. ++if test -n "$CPP" && test -d "$CPP"; then ++ CPP= ++fi ++if test -z "$CPP"; then ++ if test "${ac_cv_prog_CPP+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ # Double quotes because CPP needs to be expanded ++ for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp" ++ do ++ ac_preproc_ok=false ++for ac_c_preproc_warn_flag in '' yes ++do ++ # Use a header file that comes with gcc, so configuring glibc ++ # with a fresh cross-compiler works. ++ # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since ++ # <limits.h> exists even on freestanding compilers. ++ # On the NeXT, cc -E runs the code through the compiler's parser, ++ # not just through cpp. "Syntax error" is here to catch this case. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#ifdef __STDC__ ++# include <limits.h> ++#else ++# include <assert.h> ++#endif ++ Syntax error ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ ++else ++ # Broken: fails on valid input. ++continue ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++ # OK, works on sane cases. Now check whether nonexistent headers ++ # can be detected and how. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <ac_nonexistent.h> ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ # Broken: success on invalid input. ++continue ++else ++ # Passes both tests. ++ac_preproc_ok=: ++break ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++done ++# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. ++rm -f conftest.i conftest.err conftest.$ac_ext ++if $ac_preproc_ok; then : ++ break ++fi ++ ++ done ++ ac_cv_prog_CPP=$CPP ++ ++fi ++ CPP=$ac_cv_prog_CPP ++else ++ ac_cv_prog_CPP=$CPP ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5 ++$as_echo "$CPP" >&6; } ++ac_preproc_ok=false ++for ac_c_preproc_warn_flag in '' yes ++do ++ # Use a header file that comes with gcc, so configuring glibc ++ # with a fresh cross-compiler works. ++ # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since ++ # <limits.h> exists even on freestanding compilers. ++ # On the NeXT, cc -E runs the code through the compiler's parser, ++ # not just through cpp. "Syntax error" is here to catch this case. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#ifdef __STDC__ ++# include <limits.h> ++#else ++# include <assert.h> ++#endif ++ Syntax error ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ ++else ++ # Broken: fails on valid input. ++continue ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++ # OK, works on sane cases. Now check whether nonexistent headers ++ # can be detected and how. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <ac_nonexistent.h> ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ # Broken: success on invalid input. ++continue ++else ++ # Passes both tests. ++ac_preproc_ok=: ++break ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++done ++# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. ++rm -f conftest.i conftest.err conftest.$ac_ext ++if $ac_preproc_ok; then : ++ ++else ++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "C preprocessor \"$CPP\" fails sanity check ++See \`config.log' for more details" "$LINENO" 5 ; } ++fi ++ ++ac_ext=c ++ac_cpp='$CPP $CPPFLAGS' ++ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ++ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ++ac_compiler_gnu=$ac_cv_c_compiler_gnu ++ ++ ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5 ++$as_echo_n "checking for grep that handles long lines and -e... " >&6; } ++if test "${ac_cv_path_GREP+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ if test -z "$GREP"; then ++ ac_path_GREP_found=false ++ # Loop through the user's path and test for each of PROGNAME-LIST ++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin ++do ++ IFS=$as_save_IFS ++ test -z "$as_dir" && as_dir=. ++ for ac_prog in grep ggrep; do ++ for ac_exec_ext in '' $ac_executable_extensions; do ++ ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext" ++ { test -f "$ac_path_GREP" && $as_test_x "$ac_path_GREP"; } || continue ++# Check for GNU ac_path_GREP and select it if it is found. ++ # Check for GNU $ac_path_GREP ++case `"$ac_path_GREP" --version 2>&1` in ++*GNU*) ++ ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;; ++*) ++ ac_count=0 ++ $as_echo_n 0123456789 >"conftest.in" ++ while : ++ do ++ cat "conftest.in" "conftest.in" >"conftest.tmp" ++ mv "conftest.tmp" "conftest.in" ++ cp "conftest.in" "conftest.nl" ++ $as_echo 'GREP' >> "conftest.nl" ++ "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break ++ diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break ++ as_fn_arith $ac_count + 1 && ac_count=$as_val ++ if test $ac_count -gt ${ac_path_GREP_max-0}; then ++ # Best one so far, save it but keep looking for a better one ++ ac_cv_path_GREP="$ac_path_GREP" ++ ac_path_GREP_max=$ac_count ++ fi ++ # 10*(2^10) chars as input seems more than enough ++ test $ac_count -gt 10 && break ++ done ++ rm -f conftest.in conftest.tmp conftest.nl conftest.out;; ++esac ++ ++ $ac_path_GREP_found && break 3 ++ done ++ done ++ done ++IFS=$as_save_IFS ++ if test -z "$ac_cv_path_GREP"; then ++ as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 ++ fi ++else ++ ac_cv_path_GREP=$GREP ++fi ++ ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5 ++$as_echo "$ac_cv_path_GREP" >&6; } ++ GREP="$ac_cv_path_GREP" ++ ++ ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5 ++$as_echo_n "checking for egrep... " >&6; } ++if test "${ac_cv_path_EGREP+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ if echo a | $GREP -E '(a|b)' >/dev/null 2>&1 ++ then ac_cv_path_EGREP="$GREP -E" ++ else ++ if test -z "$EGREP"; then ++ ac_path_EGREP_found=false ++ # Loop through the user's path and test for each of PROGNAME-LIST ++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin ++do ++ IFS=$as_save_IFS ++ test -z "$as_dir" && as_dir=. ++ for ac_prog in egrep; do ++ for ac_exec_ext in '' $ac_executable_extensions; do ++ ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext" ++ { test -f "$ac_path_EGREP" && $as_test_x "$ac_path_EGREP"; } || continue ++# Check for GNU ac_path_EGREP and select it if it is found. ++ # Check for GNU $ac_path_EGREP ++case `"$ac_path_EGREP" --version 2>&1` in ++*GNU*) ++ ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;; ++*) ++ ac_count=0 ++ $as_echo_n 0123456789 >"conftest.in" ++ while : ++ do ++ cat "conftest.in" "conftest.in" >"conftest.tmp" ++ mv "conftest.tmp" "conftest.in" ++ cp "conftest.in" "conftest.nl" ++ $as_echo 'EGREP' >> "conftest.nl" ++ "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break ++ diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break ++ as_fn_arith $ac_count + 1 && ac_count=$as_val ++ if test $ac_count -gt ${ac_path_EGREP_max-0}; then ++ # Best one so far, save it but keep looking for a better one ++ ac_cv_path_EGREP="$ac_path_EGREP" ++ ac_path_EGREP_max=$ac_count ++ fi ++ # 10*(2^10) chars as input seems more than enough ++ test $ac_count -gt 10 && break ++ done ++ rm -f conftest.in conftest.tmp conftest.nl conftest.out;; ++esac ++ ++ $ac_path_EGREP_found && break 3 ++ done ++ done ++ done ++IFS=$as_save_IFS ++ if test -z "$ac_cv_path_EGREP"; then ++ as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 ++ fi ++else ++ ac_cv_path_EGREP=$EGREP ++fi ++ ++ fi ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5 ++$as_echo "$ac_cv_path_EGREP" >&6; } ++ EGREP="$ac_cv_path_EGREP" ++ ++ ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5 ++$as_echo_n "checking for ANSI C header files... " >&6; } ++if test "${ac_cv_header_stdc+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <stdlib.h> ++#include <stdarg.h> ++#include <string.h> ++#include <float.h> ++ ++int ++main () ++{ ++ ++ ; ++ return 0; ++} ++_ACEOF ++if ac_fn_c_try_compile "$LINENO"; then : ++ ac_cv_header_stdc=yes ++else ++ ac_cv_header_stdc=no ++fi ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++ ++if test $ac_cv_header_stdc = yes; then ++ # SunOS 4.x string.h does not declare mem*, contrary to ANSI. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <string.h> ++ + _ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | ++ $EGREP "memchr" >/dev/null 2>&1; then : ++ ++else ++ ac_cv_header_stdc=no ++fi ++rm -f conftest* ++ ++fi ++ ++if test $ac_cv_header_stdc = yes; then ++ # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <stdlib.h> ++ ++_ACEOF ++if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | ++ $EGREP "free" >/dev/null 2>&1; then : ++ ++else ++ ac_cv_header_stdc=no ++fi ++rm -f conftest* ++ ++fi ++ ++if test $ac_cv_header_stdc = yes; then ++ # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. ++ if test "$cross_compiling" = yes; then : ++ : ++else ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ +- +-/* Override any GCC internal prototype to avoid an error. +- Use char because int might match the return type of a GCC +- builtin and then its argument prototype would still apply. */ +-#ifdef __cplusplus +-extern "C" ++#include <ctype.h> ++#include <stdlib.h> ++#if ((' ' & 0x0FF) == 0x020) ++# define ISLOWER(c) ('a' <= (c) && (c) <= 'z') ++# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) ++#else ++# define ISLOWER(c) \ ++ (('a' <= (c) && (c) <= 'i') \ ++ || ('j' <= (c) && (c) <= 'r') \ ++ || ('s' <= (c) && (c) <= 'z')) ++# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c)) + #endif +-char exchangeTNCCSMessages (); ++ ++#define XOR(e, f) (((e) && !(f)) || (!(e) && (f))) + int + main () + { +-return exchangeTNCCSMessages (); +- ; ++ int i; ++ for (i = 0; i < 256; i++) ++ if (XOR (islower (i), ISLOWER (i)) ++ || toupper (i) != TOUPPER (i)) ++ return 2; + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext conftest$ac_exeext +-if { (ac_try="$ac_link" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_link") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest$ac_exeext && +- $as_test_x conftest$ac_exeext; then +- ac_cv_lib_TNCS_exchangeTNCCSMessages=yes ++if ac_fn_c_try_run "$LINENO"; then : ++ + else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 ++ ac_cv_header_stdc=no ++fi ++rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ ++ conftest.$ac_objext conftest.beam conftest.$ac_ext ++fi + +- ac_cv_lib_TNCS_exchangeTNCCSMessages=no + fi ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5 ++$as_echo "$ac_cv_header_stdc" >&6; } ++if test $ac_cv_header_stdc = yes; then ++ ++$as_echo "#define STDC_HEADERS 1" >>confdefs.h + +-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ +- conftest$ac_exeext conftest.$ac_ext +-LIBS=$ac_check_lib_save_LIBS + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_lib_TNCS_exchangeTNCCSMessages" >&5 +-echo "${ECHO_T}$ac_cv_lib_TNCS_exchangeTNCCSMessages" >&6; } +-if test $ac_cv_lib_TNCS_exchangeTNCCSMessages = yes; then ++ ++# On IRIX 5.3, sys/types and inttypes.h are conflicting. ++for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \ ++ inttypes.h stdint.h unistd.h ++do : ++ as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ++ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default ++" ++if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : + cat >>confdefs.h <<_ACEOF +-#define HAVE_LIBTNCS 1 ++#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 + _ACEOF + +- LIBS="-lTNCS $LIBS" ++fi ++ ++done ++ ++ ++for ac_header in naaeap/naaeap.h ++do : ++ ac_fn_c_check_header_mongrel "$LINENO" "naaeap/naaeap.h" "ac_cv_header_naaeap_naaeap_h" "$ac_includes_default" ++if test "x$ac_cv_header_naaeap_naaeap_h" = x""yes; then : ++ cat >>confdefs.h <<_ACEOF ++#define HAVE_NAAEAP_NAAEAP_H 1 ++_ACEOF + ++else ++ fail="$fail -Inaaeap.h" + fi + +- if test "x$ac_cv_lib_tncs_exchangetnccsmessages" != xyes; then +- { echo "$as_me:$LINENO: WARNING: the TNCS library isn't found!" >&5 +-echo "$as_me: WARNING: the TNCS library isn't found!" >&2;} +- fail="$fail -lTNCS" ++done ++ ++ if test -x"$ac_cv_header_naaeap_h" == -x"no"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: the naaeap header was not found!" >&5 ++$as_echo "$as_me: WARNING: the naaeap header was not found!" >&2;} ++ fail="$fail -Inaaeap.h" + fi + + targetname=rlm_eap_tnc +@@ -2642,14 +3262,12 @@ + + if test x"$fail" != x""; then + if test x"${enable_strict_dependencies}" = x"yes"; then +- { { echo "$as_me:$LINENO: error: set --without-rlm_eap_tnc to disable it explicitly." >&5 +-echo "$as_me: error: set --without-rlm_eap_tnc to disable it explicitly." >&2;} +- { (exit 1); exit 1; }; } ++ as_fn_error $? "set --without-rlm_eap_tnc to disable it explicitly." "$LINENO" 5 + else +- { echo "$as_me:$LINENO: WARNING: silently not building rlm_eap_tnc." >&5 +-echo "$as_me: WARNING: silently not building rlm_eap_tnc." >&2;} +- { echo "$as_me:$LINENO: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&5 +-echo "$as_me: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&2;}; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: silently not building rlm_eap_tnc." >&5 ++$as_echo "$as_me: WARNING: silently not building rlm_eap_tnc." >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&5 ++$as_echo "$as_me: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&2;}; + targetname="" + fi + fi +@@ -2658,11 +3276,7 @@ + + + +- +- unset ac_cv_env_LIBS_set +- unset ac_cv_env_LIBS_value +- +- ac_config_files="$ac_config_files Makefile" ++ac_config_files="$ac_config_files Makefile" + + cat >confcache <<\_ACEOF + # This file is a shell script that caches the results of configure +@@ -2691,12 +3305,13 @@ + case $ac_val in #( + *${as_nl}*) + case $ac_var in #( +- *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5 +-echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;; ++ *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 ++$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; + esac + case $ac_var in #( + _ | IFS | as_nl) ;; #( +- *) $as_unset $ac_var ;; ++ BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( ++ *) { eval $ac_var=; unset $ac_var;} ;; + esac ;; + esac + done +@@ -2704,8 +3319,8 @@ + (set) 2>&1 | + case $as_nl`(ac_space=' '; set) 2>&1` in #( + *${as_nl}ac_space=\ *) +- # `set' does not quote correctly, so add quotes (double-quote +- # substitution turns \\\\ into \\, and sed turns \\ into \). ++ # `set' does not quote correctly, so add quotes: double-quote ++ # substitution turns \\\\ into \\, and sed turns \\ into \. + sed -n \ + "s/'/'\\\\''/g; + s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" +@@ -2728,12 +3343,12 @@ + if diff "$cache_file" confcache >/dev/null 2>&1; then :; else + if test -w "$cache_file"; then + test "x$cache_file" != "x/dev/null" && +- { echo "$as_me:$LINENO: updating cache $cache_file" >&5 +-echo "$as_me: updating cache $cache_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5 ++$as_echo "$as_me: updating cache $cache_file" >&6;} + cat confcache >$cache_file + else +- { echo "$as_me:$LINENO: not updating unwritable cache $cache_file" >&5 +-echo "$as_me: not updating unwritable cache $cache_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5 ++$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;} + fi + fi + rm -f confcache +@@ -2750,6 +3365,12 @@ + # take arguments), then branch to the quote section. Otherwise, + # look for a macro that doesn't take arguments. + ac_script=' ++:mline ++/\\$/{ ++ N ++ s,\\\n,, ++ b mline ++} + t clear + :clear + s/^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\)/-D\1=\2/g +@@ -2776,14 +3397,15 @@ + + ac_libobjs= + ac_ltlibobjs= ++U= + for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue + # 1. Remove the extension, and $U if already installed. + ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' +- ac_i=`echo "$ac_i" | sed "$ac_script"` ++ ac_i=`$as_echo "$ac_i" | sed "$ac_script"` + # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR + # will be set to the directory where LIBOBJS objects are built. +- ac_libobjs="$ac_libobjs \${LIBOBJDIR}$ac_i\$U.$ac_objext" +- ac_ltlibobjs="$ac_ltlibobjs \${LIBOBJDIR}$ac_i"'$U.lo' ++ as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext" ++ as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo' + done + LIBOBJS=$ac_libobjs + +@@ -2792,11 +3414,13 @@ + + + : ${CONFIG_STATUS=./config.status} ++ac_write_fail=0 + ac_clean_files_save=$ac_clean_files + ac_clean_files="$ac_clean_files $CONFIG_STATUS" +-{ echo "$as_me:$LINENO: creating $CONFIG_STATUS" >&5 +-echo "$as_me: creating $CONFIG_STATUS" >&6;} +-cat >$CONFIG_STATUS <<_ACEOF ++{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5 ++$as_echo "$as_me: creating $CONFIG_STATUS" >&6;} ++as_write_fail=0 ++cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1 + #! $SHELL + # Generated by $as_me. + # Run this file to recreate the current configuration. +@@ -2806,59 +3430,79 @@ + debug=false + ac_cs_recheck=false + ac_cs_silent=false +-SHELL=\${CONFIG_SHELL-$SHELL} +-_ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF +-## --------------------- ## +-## M4sh Initialization. ## +-## --------------------- ## ++SHELL=\${CONFIG_SHELL-$SHELL} ++export SHELL ++_ASEOF ++cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1 ++## -------------------- ## ++## M4sh Initialization. ## ++## -------------------- ## + + # Be more Bourne compatible + DUALCASE=1; export DUALCASE # for MKS sh +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then ++if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : + emulate sh + NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which ++ # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' + setopt NO_GLOB_SUBST + else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; ++ case `(set -o) 2>/dev/null` in #( ++ *posix*) : ++ set -o posix ;; #( ++ *) : ++ ;; + esac +- + fi + + +- +- +-# PATH needs CR +-# Avoid depending upon Character Ranges. +-as_cr_letters='abcdefghijklmnopqrstuvwxyz' +-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' +-as_cr_Letters=$as_cr_letters$as_cr_LETTERS +-as_cr_digits='0123456789' +-as_cr_alnum=$as_cr_Letters$as_cr_digits +- +-# The user is always right. +-if test "${PATH_SEPARATOR+set}" != set; then +- echo "#! /bin/sh" >conf$$.sh +- echo "exit 0" >>conf$$.sh +- chmod +x conf$$.sh +- if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then +- PATH_SEPARATOR=';' ++as_nl=' ++' ++export as_nl ++# Printing a long string crashes Solaris 7 /usr/bin/printf. ++as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo ++# Prefer a ksh shell builtin over an external printf program on Solaris, ++# but without wasting forks for bash or zsh. ++if test -z "$BASH_VERSION$ZSH_VERSION" \ ++ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='print -r --' ++ as_echo_n='print -rn --' ++elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='printf %s\n' ++ as_echo_n='printf %s' ++else ++ if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then ++ as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' ++ as_echo_n='/usr/ucb/echo -n' + else +- PATH_SEPARATOR=: ++ as_echo_body='eval expr "X$1" : "X\\(.*\\)"' ++ as_echo_n_body='eval ++ arg=$1; ++ case $arg in #( ++ *"$as_nl"*) ++ expr "X$arg" : "X\\(.*\\)$as_nl"; ++ arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; ++ esac; ++ expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ++ ' ++ export as_echo_n_body ++ as_echo_n='sh -c $as_echo_n_body as_echo' + fi +- rm -f conf$$.sh ++ export as_echo_body ++ as_echo='sh -c $as_echo_body as_echo' + fi + +-# Support unset when possible. +-if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then +- as_unset=unset +-else +- as_unset=false ++# The user is always right. ++if test "${PATH_SEPARATOR+set}" != set; then ++ PATH_SEPARATOR=: ++ (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { ++ (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || ++ PATH_SEPARATOR=';' ++ } + fi + + +@@ -2867,20 +3511,18 @@ + # there to prevent editors from complaining about space-tab. + # (If _AS_PATH_WALK were called with IFS unset, it would disable word + # splitting by setting IFS to empty value.) +-as_nl=' +-' + IFS=" "" $as_nl" + + # Find who we are. Look in the path if we contain no directory separator. +-case $0 in ++case $0 in #(( + *[\\/]* ) as_myself=$0 ;; + *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR + for as_dir in $PATH + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break +-done ++ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break ++ done + IFS=$as_save_IFS + + ;; +@@ -2891,32 +3533,111 @@ + as_myself=$0 + fi + if test ! -f "$as_myself"; then +- echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 +- { (exit 1); exit 1; } ++ $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 ++ exit 1 + fi + +-# Work around bugs in pre-3.0 UWIN ksh. +-for as_var in ENV MAIL MAILPATH +-do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var ++# Unset variables that we do not need and which cause bugs (e.g. in ++# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" ++# suppresses any "Segmentation fault" message there. '((' could ++# trigger a bug in pdksh 5.2.14. ++for as_var in BASH_ENV ENV MAIL MAILPATH ++do eval test x\${$as_var+set} = xset \ ++ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : + done + PS1='$ ' + PS2='> ' + PS4='+ ' + + # NLS nuisances. +-for as_var in \ +- LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ +- LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ +- LC_TELEPHONE LC_TIME +-do +- if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then +- eval $as_var=C; export $as_var +- else +- ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var ++LC_ALL=C ++export LC_ALL ++LANGUAGE=C ++export LANGUAGE ++ ++# CDPATH. ++(unset CDPATH) >/dev/null 2>&1 && unset CDPATH ++ ++ ++# as_fn_error STATUS ERROR [LINENO LOG_FD] ++# ---------------------------------------- ++# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are ++# provided, also output the error to LOG_FD, referencing LINENO. Then exit the ++# script with STATUS, using 1 if that was 0. ++as_fn_error () ++{ ++ as_status=$1; test $as_status -eq 0 && as_status=1 ++ if test "$4"; then ++ as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 + fi +-done ++ $as_echo "$as_me: error: $2" >&2 ++ as_fn_exit $as_status ++} # as_fn_error ++ ++ ++# as_fn_set_status STATUS ++# ----------------------- ++# Set $? to STATUS, without forking. ++as_fn_set_status () ++{ ++ return $1 ++} # as_fn_set_status ++ ++# as_fn_exit STATUS ++# ----------------- ++# Exit the shell with STATUS, even in a "trap 0" or "set -e" context. ++as_fn_exit () ++{ ++ set +e ++ as_fn_set_status $1 ++ exit $1 ++} # as_fn_exit ++ ++# as_fn_unset VAR ++# --------------- ++# Portably unset VAR. ++as_fn_unset () ++{ ++ { eval $1=; unset $1;} ++} ++as_unset=as_fn_unset ++# as_fn_append VAR VALUE ++# ---------------------- ++# Append the text in VALUE to the end of the definition contained in VAR. Take ++# advantage of any shell optimizations that allow amortized linear growth over ++# repeated appends, instead of the typical quadratic growth present in naive ++# implementations. ++if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : ++ eval 'as_fn_append () ++ { ++ eval $1+=\$2 ++ }' ++else ++ as_fn_append () ++ { ++ eval $1=\$$1\$2 ++ } ++fi # as_fn_append ++ ++# as_fn_arith ARG... ++# ------------------ ++# Perform arithmetic evaluation on the ARGs, and store the result in the ++# global $as_val. Take advantage of shells that can avoid forks. The arguments ++# must be portable across $(()) and expr. ++if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : ++ eval 'as_fn_arith () ++ { ++ as_val=$(( $* )) ++ }' ++else ++ as_fn_arith () ++ { ++ as_val=`expr "$@" || test $? -eq 1` ++ } ++fi # as_fn_arith ++ + +-# Required to use basename. + if expr a : '\(a\)' >/dev/null 2>&1 && + test "X`expr 00001 : '.*\(...\)'`" = X001; then + as_expr=expr +@@ -2930,13 +3651,17 @@ + as_basename=false + fi + ++if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then ++ as_dirname=dirname ++else ++ as_dirname=false ++fi + +-# Name of the executable. + as_me=`$as_basename -- "$0" || + $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ + X"$0" : 'X\(//\)$' \| \ + X"$0" : 'X\(/\)' \| . 2>/dev/null || +-echo X/"$0" | ++$as_echo X/"$0" | + sed '/^.*\/\([^/][^/]*\)\/*$/{ + s//\1/ + q +@@ -2951,104 +3676,103 @@ + } + s/.*/./; q'` + +-# CDPATH. +-$as_unset CDPATH +- +- +- +- as_lineno_1=$LINENO +- as_lineno_2=$LINENO +- test "x$as_lineno_1" != "x$as_lineno_2" && +- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || { +- +- # Create $as_me.lineno as a copy of $as_myself, but with $LINENO +- # uniformly replaced by the line number. The first 'sed' inserts a +- # line-number line after each line using $LINENO; the second 'sed' +- # does the real work. The second script uses 'N' to pair each +- # line-number line with the line containing $LINENO, and appends +- # trailing '-' during substitution so that $LINENO is not a special +- # case at line end. +- # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the +- # scripts with optimization help from Paolo Bonzini. Blame Lee +- # E. McMahon (1931-1989) for sed's syntax. :-) +- sed -n ' +- p +- /[$]LINENO/= +- ' <$as_myself | +- sed ' +- s/[$]LINENO.*/&-/ +- t lineno +- b +- :lineno +- N +- :loop +- s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ +- t loop +- s/-\n.*// +- ' >$as_me.lineno && +- chmod +x "$as_me.lineno" || +- { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 +- { (exit 1); exit 1; }; } +- +- # Don't try to exec as it changes $[0], causing all sort of problems +- # (the dirname of $[0] is not the place where we might find the +- # original and so on. Autoconf is especially sensitive to this). +- . "./$as_me.lineno" +- # Exit status is that of the last command. +- exit +-} +- +- +-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then +- as_dirname=dirname +-else +- as_dirname=false +-fi ++# Avoid depending upon Character Ranges. ++as_cr_letters='abcdefghijklmnopqrstuvwxyz' ++as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' ++as_cr_Letters=$as_cr_letters$as_cr_LETTERS ++as_cr_digits='0123456789' ++as_cr_alnum=$as_cr_Letters$as_cr_digits + + ECHO_C= ECHO_N= ECHO_T= +-case `echo -n x` in ++case `echo -n x` in #((((( + -n*) +- case `echo 'x\c'` in ++ case `echo 'xy\c'` in + *c*) ECHO_T=' ';; # ECHO_T is single tab character. +- *) ECHO_C='\c';; ++ xy) ECHO_C='\c';; ++ *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ++ ECHO_T=' ';; + esac;; + *) + ECHO_N='-n';; + esac + +-if expr a : '\(a\)' >/dev/null 2>&1 && +- test "X`expr 00001 : '.*\(...\)'`" = X001; then +- as_expr=expr +-else +- as_expr=false +-fi +- + rm -f conf$$ conf$$.exe conf$$.file + if test -d conf$$.dir; then + rm -f conf$$.dir/conf$$.file + else + rm -f conf$$.dir +- mkdir conf$$.dir ++ mkdir conf$$.dir 2>/dev/null + fi +-echo >conf$$.file +-if ln -s conf$$.file conf$$ 2>/dev/null; then +- as_ln_s='ln -s' +- # ... but there are two gotchas: +- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. +- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. +- # In both cases, we have to default to `cp -p'. +- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++if (echo >conf$$.file) 2>/dev/null; then ++ if ln -s conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s='ln -s' ++ # ... but there are two gotchas: ++ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. ++ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. ++ # In both cases, we have to default to `cp -p'. ++ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++ as_ln_s='cp -p' ++ elif ln conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s=ln ++ else + as_ln_s='cp -p' +-elif ln conf$$.file conf$$ 2>/dev/null; then +- as_ln_s=ln ++ fi + else + as_ln_s='cp -p' + fi + rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file + rmdir conf$$.dir 2>/dev/null + ++ ++# as_fn_mkdir_p ++# ------------- ++# Create "$as_dir" as a directory, including parents if necessary. ++as_fn_mkdir_p () ++{ ++ ++ case $as_dir in #( ++ -*) as_dir=./$as_dir;; ++ esac ++ test -d "$as_dir" || eval $as_mkdir_p || { ++ as_dirs= ++ while :; do ++ case $as_dir in #( ++ *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( ++ *) as_qdir=$as_dir;; ++ esac ++ as_dirs="'$as_qdir' $as_dirs" ++ as_dir=`$as_dirname -- "$as_dir" || ++$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ ++ X"$as_dir" : 'X\(//\)[^/]' \| \ ++ X"$as_dir" : 'X\(//\)$' \| \ ++ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X"$as_dir" | ++ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)[^/].*/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\).*/{ ++ s//\1/ ++ q ++ } ++ s/.*/./; q'` ++ test -d "$as_dir" && break ++ done ++ test -z "$as_dirs" || eval "mkdir $as_dirs" ++ } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" ++ ++ ++} # as_fn_mkdir_p + if mkdir -p . 2>/dev/null; then +- as_mkdir_p=: ++ as_mkdir_p='mkdir -p "$as_dir"' + else + test -d ./-p && rmdir ./-p + as_mkdir_p=false +@@ -3065,12 +3789,12 @@ + as_test_x=' + eval sh -c '\'' + if test -d "$1"; then +- test -d "$1/."; ++ test -d "$1/."; + else +- case $1 in +- -*)set "./$1";; ++ case $1 in #( ++ -*)set "./$1";; + esac; +- case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in ++ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #(( + ???[sx]*):;;*)false;;esac;fi + '\'' sh + ' +@@ -3085,13 +3809,19 @@ + + + exec 6>&1 ++## ----------------------------------- ## ++## Main body of $CONFIG_STATUS script. ## ++## ----------------------------------- ## ++_ASEOF ++test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1 + +-# Save the log message, to keep $[0] and so on meaningful, and to ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ++# Save the log message, to keep $0 and so on meaningful, and to + # report actual input values of CONFIG_FILES etc. instead of their + # values after options handling. + ac_log=" + This file was extended by $as_me, which was +-generated by GNU Autoconf 2.61. Invocation command line was ++generated by GNU Autoconf 2.67. Invocation command line was + + CONFIG_FILES = $CONFIG_FILES + CONFIG_HEADERS = $CONFIG_HEADERS +@@ -3104,59 +3834,74 @@ + + _ACEOF + +-cat >>$CONFIG_STATUS <<_ACEOF ++case $ac_config_files in *" ++"*) set x $ac_config_files; shift; ac_config_files=$*;; ++esac ++ ++ ++ ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + # Files that config.status was made for. + config_files="$ac_config_files" + + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + ac_cs_usage="\ +-\`$as_me' instantiates files from templates according to the +-current configuration. ++\`$as_me' instantiates files and other configuration actions ++from templates according to the current configuration. Unless the files ++and actions are specified as TAGs, all are instantiated by default. + +-Usage: $0 [OPTIONS] [FILE]... ++Usage: $0 [OPTION]... [TAG]... + + -h, --help print this help, then exit + -V, --version print version number and configuration settings, then exit +- -q, --quiet do not print progress messages ++ --config print configuration, then exit ++ -q, --quiet, --silent ++ do not print progress messages + -d, --debug don't remove temporary files + --recheck update $as_me by reconfiguring in the same conditions +- --file=FILE[:TEMPLATE] +- instantiate the configuration file FILE ++ --file=FILE[:TEMPLATE] ++ instantiate the configuration file FILE + + Configuration files: + $config_files + +-Report bugs to <bug-autoconf@gnu.org>." ++Report bugs to the package provider." + + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" + ac_cs_version="\\ + config.status +-configured by $0, generated by GNU Autoconf 2.61, +- with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\" ++configured by $0, generated by GNU Autoconf 2.67, ++ with options \\"\$ac_cs_config\\" + +-Copyright (C) 2006 Free Software Foundation, Inc. ++Copyright (C) 2010 Free Software Foundation, Inc. + This config.status script is free software; the Free Software Foundation + gives unlimited permission to copy, distribute and modify it." + + ac_pwd='$ac_pwd' + srcdir='$srcdir' ++test -n "\$AWK" || AWK=awk + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF +-# If no file are specified by the user, then we need to provide default +-# value. By we need to know if files were specified by the user. ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ++# The default lists apply if the user does not specify any file. + ac_need_defaults=: + while test $# != 0 + do + case $1 in +- --*=*) ++ --*=?*) + ac_option=`expr "X$1" : 'X\([^=]*\)='` + ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` + ac_shift=: + ;; ++ --*=) ++ ac_option=`expr "X$1" : 'X\([^=]*\)='` ++ ac_optarg= ++ ac_shift=: ++ ;; + *) + ac_option=$1 + ac_optarg=$2 +@@ -3169,25 +3914,30 @@ + -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) + ac_cs_recheck=: ;; + --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) +- echo "$ac_cs_version"; exit ;; ++ $as_echo "$ac_cs_version"; exit ;; ++ --config | --confi | --conf | --con | --co | --c ) ++ $as_echo "$ac_cs_config"; exit ;; + --debug | --debu | --deb | --de | --d | -d ) + debug=: ;; + --file | --fil | --fi | --f ) + $ac_shift +- CONFIG_FILES="$CONFIG_FILES $ac_optarg" ++ case $ac_optarg in ++ *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; ++ '') as_fn_error $? "missing file argument" ;; ++ esac ++ as_fn_append CONFIG_FILES " '$ac_optarg'" + ac_need_defaults=false;; + --he | --h | --help | --hel | -h ) +- echo "$ac_cs_usage"; exit ;; ++ $as_echo "$ac_cs_usage"; exit ;; + -q | -quiet | --quiet | --quie | --qui | --qu | --q \ + | -silent | --silent | --silen | --sile | --sil | --si | --s) + ac_cs_silent=: ;; + + # This is an error. +- -*) { echo "$as_me: error: unrecognized option: $1 +-Try \`$0 --help' for more information." >&2 +- { (exit 1); exit 1; }; } ;; ++ -*) as_fn_error $? "unrecognized option: \`$1' ++Try \`$0 --help' for more information." ;; + +- *) ac_config_targets="$ac_config_targets $1" ++ *) as_fn_append ac_config_targets " $1" + ac_need_defaults=false ;; + + esac +@@ -3202,30 +3952,32 @@ + fi + + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + if \$ac_cs_recheck; then +- echo "running CONFIG_SHELL=$SHELL $SHELL $0 "$ac_configure_args \$ac_configure_extra_args " --no-create --no-recursion" >&6 +- CONFIG_SHELL=$SHELL ++ set X '$SHELL' '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion ++ shift ++ \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6 ++ CONFIG_SHELL='$SHELL' + export CONFIG_SHELL +- exec $SHELL "$0"$ac_configure_args \$ac_configure_extra_args --no-create --no-recursion ++ exec "\$@" + fi + + _ACEOF +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + exec 5>>config.log + { + echo + sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX + ## Running $as_me. ## + _ASBOX +- echo "$ac_log" ++ $as_echo "$ac_log" + } >&5 + + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + + # Handling of arguments. + for ac_config_target in $ac_config_targets +@@ -3233,9 +3985,7 @@ + case $ac_config_target in + "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; + +- *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5 +-echo "$as_me: error: invalid argument: $ac_config_target" >&2;} +- { (exit 1); exit 1; }; };; ++ *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5 ;; + esac + done + +@@ -3260,7 +4010,7 @@ + trap 'exit_status=$? + { test -z "$tmp" || test ! -d "$tmp" || rm -fr "$tmp"; } && exit $exit_status + ' 0 +- trap '{ (exit 1); exit 1; }' 1 2 13 15 ++ trap 'as_fn_exit 1' 1 2 13 15 + } + # Create a (secure) tmp directory for tmp files. + +@@ -3271,145 +4021,177 @@ + { + tmp=./conf$$-$RANDOM + (umask 077 && mkdir "$tmp") +-} || +-{ +- echo "$me: cannot create a temporary directory in ." >&2 +- { (exit 1); exit 1; } +-} +- +-# +-# Set up the sed scripts for CONFIG_FILES section. +-# ++} || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5 + +-# No need to generate the scripts if there are no CONFIG_FILES. +-# This happens for instance when ./config.status config.h ++# Set up the scripts for CONFIG_FILES section. ++# No need to generate them if there are no CONFIG_FILES. ++# This happens for instance with `./config.status config.h'. + if test -n "$CONFIG_FILES"; then + +-_ACEOF + ++ac_cr=`echo X | tr X '\015'` ++# On cygwin, bash can eat \r inside `` if the user requested igncr. ++# But we know of no other shell where ac_cr would be empty at this ++# point, so we can use a bashism as a fallback. ++if test "x$ac_cr" = x; then ++ eval ac_cr=\$\'\\r\' ++fi ++ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' </dev/null 2>/dev/null` ++if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ++ ac_cs_awk_cr='\\r' ++else ++ ac_cs_awk_cr=$ac_cr ++fi ++ ++echo 'BEGIN {' >"$tmp/subs1.awk" && ++_ACEOF + + ++{ ++ echo "cat >conf$$subs.awk <<_ACEOF" && ++ echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && ++ echo "_ACEOF" ++} >conf$$subs.sh || ++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ++ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'` + ac_delim='%!_!# ' + for ac_last_try in false false false false false :; do +- cat >conf$$subs.sed <<_ACEOF +-SHELL!$SHELL$ac_delim +-PATH_SEPARATOR!$PATH_SEPARATOR$ac_delim +-PACKAGE_NAME!$PACKAGE_NAME$ac_delim +-PACKAGE_TARNAME!$PACKAGE_TARNAME$ac_delim +-PACKAGE_VERSION!$PACKAGE_VERSION$ac_delim +-PACKAGE_STRING!$PACKAGE_STRING$ac_delim +-PACKAGE_BUGREPORT!$PACKAGE_BUGREPORT$ac_delim +-exec_prefix!$exec_prefix$ac_delim +-prefix!$prefix$ac_delim +-program_transform_name!$program_transform_name$ac_delim +-bindir!$bindir$ac_delim +-sbindir!$sbindir$ac_delim +-libexecdir!$libexecdir$ac_delim +-datarootdir!$datarootdir$ac_delim +-datadir!$datadir$ac_delim +-sysconfdir!$sysconfdir$ac_delim +-sharedstatedir!$sharedstatedir$ac_delim +-localstatedir!$localstatedir$ac_delim +-includedir!$includedir$ac_delim +-oldincludedir!$oldincludedir$ac_delim +-docdir!$docdir$ac_delim +-infodir!$infodir$ac_delim +-htmldir!$htmldir$ac_delim +-dvidir!$dvidir$ac_delim +-pdfdir!$pdfdir$ac_delim +-psdir!$psdir$ac_delim +-libdir!$libdir$ac_delim +-localedir!$localedir$ac_delim +-mandir!$mandir$ac_delim +-DEFS!$DEFS$ac_delim +-ECHO_C!$ECHO_C$ac_delim +-ECHO_N!$ECHO_N$ac_delim +-ECHO_T!$ECHO_T$ac_delim +-LIBS!$LIBS$ac_delim +-build_alias!$build_alias$ac_delim +-host_alias!$host_alias$ac_delim +-target_alias!$target_alias$ac_delim +-CC!$CC$ac_delim +-CFLAGS!$CFLAGS$ac_delim +-LDFLAGS!$LDFLAGS$ac_delim +-CPPFLAGS!$CPPFLAGS$ac_delim +-ac_ct_CC!$ac_ct_CC$ac_delim +-EXEEXT!$EXEEXT$ac_delim +-OBJEXT!$OBJEXT$ac_delim +-eap_tnc_cflags!$eap_tnc_cflags$ac_delim +-eap_tnc_ldflags!$eap_tnc_ldflags$ac_delim +-targetname!$targetname$ac_delim +-LIBOBJS!$LIBOBJS$ac_delim +-LTLIBOBJS!$LTLIBOBJS$ac_delim +-_ACEOF ++ . ./conf$$subs.sh || ++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 + +- if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 49; then ++ ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` ++ if test $ac_delim_n = $ac_delim_num; then + break + elif $ac_last_try; then +- { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 +-echo "$as_me: error: could not make $CONFIG_STATUS" >&2;} +- { (exit 1); exit 1; }; } ++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 + else + ac_delim="$ac_delim!$ac_delim _$ac_delim!! " + fi + done ++rm -f conf$$subs.sh + +-ac_eof=`sed -n '/^CEOF[0-9]*$/s/CEOF/0/p' conf$$subs.sed` +-if test -n "$ac_eof"; then +- ac_eof=`echo "$ac_eof" | sort -nru | sed 1q` +- ac_eof=`expr $ac_eof + 1` +-fi +- +-cat >>$CONFIG_STATUS <<_ACEOF +-cat >"\$tmp/subs-1.sed" <<\CEOF$ac_eof +-/@[a-zA-Z_][a-zA-Z_0-9]*@/!b end +-_ACEOF +-sed ' +-s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g +-s/^/s,@/; s/!/@,|#_!!_#|/ +-:n +-t n +-s/'"$ac_delim"'$/,g/; t +-s/$/\\/; p +-N; s/^.*\n//; s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g; b n +-' >>$CONFIG_STATUS <conf$$subs.sed +-rm -f conf$$subs.sed +-cat >>$CONFIG_STATUS <<_ACEOF +-:end +-s/|#_!!_#|//g +-CEOF$ac_eof ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++cat >>"\$tmp/subs1.awk" <<\\_ACAWK && + _ACEOF ++sed -n ' ++h ++s/^/S["/; s/!.*/"]=/ ++p ++g ++s/^[^!]*!// ++:repl ++t repl ++s/'"$ac_delim"'$// ++t delim ++:nl ++h ++s/\(.\{148\}\)..*/\1/ ++t more1 ++s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ ++p ++n ++b repl ++:more1 ++s/["\\]/\\&/g; s/^/"/; s/$/"\\/ ++p ++g ++s/.\{148\}// ++t nl ++:delim ++h ++s/\(.\{148\}\)..*/\1/ ++t more2 ++s/["\\]/\\&/g; s/^/"/; s/$/"/ ++p ++b ++:more2 ++s/["\\]/\\&/g; s/^/"/; s/$/"\\/ ++p ++g ++s/.\{148\}// ++t delim ++' <conf$$subs.awk | sed ' ++/^[^""]/{ ++ N ++ s/\n// ++} ++' >>$CONFIG_STATUS || ac_write_fail=1 ++rm -f conf$$subs.awk ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++_ACAWK ++cat >>"\$tmp/subs1.awk" <<_ACAWK && ++ for (key in S) S_is_set[key] = 1 ++ FS = "" ++ ++} ++{ ++ line = $ 0 ++ nfields = split(line, field, "@") ++ substed = 0 ++ len = length(field[1]) ++ for (i = 2; i < nfields; i++) { ++ key = field[i] ++ keylen = length(key) ++ if (S_is_set[key]) { ++ value = S[key] ++ line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) ++ len += length(value) + length(field[++i]) ++ substed = 1 ++ } else ++ len += 1 + keylen ++ } ++ ++ print line ++} + ++_ACAWK ++_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ++if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then ++ sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" ++else ++ cat ++fi < "$tmp/subs1.awk" > "$tmp/subs.awk" \ ++ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5 ++_ACEOF + +-# VPATH may cause trouble with some makes, so we remove $(srcdir), +-# ${srcdir} and @srcdir@ from VPATH if srcdir is ".", strip leading and ++# VPATH may cause trouble with some makes, so we remove sole $(srcdir), ++# ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and + # trailing colons and then remove the whole line if VPATH becomes empty + # (actually we leave an empty line to preserve line numbers). + if test "x$srcdir" = x.; then +- ac_vpsub='/^[ ]*VPATH[ ]*=/{ +-s/:*\$(srcdir):*/:/ +-s/:*\${srcdir}:*/:/ +-s/:*@srcdir@:*/:/ +-s/^\([^=]*=[ ]*\):*/\1/ ++ ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{ ++h ++s/// ++s/^/:/ ++s/[ ]*$/:/ ++s/:\$(srcdir):/:/g ++s/:\${srcdir}:/:/g ++s/:@srcdir@:/:/g ++s/^:*// + s/:*$// ++x ++s/\(=[ ]*\).*/\1/ ++G ++s/\n// + s/^[^=]*=[ ]*$// + }' + fi + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + fi # test -n "$CONFIG_FILES" + + +-for ac_tag in :F $CONFIG_FILES ++eval set X " :F $CONFIG_FILES " ++shift ++for ac_tag + do + case $ac_tag in + :[FHLC]) ac_mode=$ac_tag; continue;; + esac + case $ac_mode$ac_tag in + :[FHL]*:*);; +- :L* | :C*:*) { { echo "$as_me:$LINENO: error: Invalid tag $ac_tag." >&5 +-echo "$as_me: error: Invalid tag $ac_tag." >&2;} +- { (exit 1); exit 1; }; };; ++ :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5 ;; + :[FH]-) ac_tag=-:-;; + :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; + esac +@@ -3437,26 +4219,34 @@ + [\\/$]*) false;; + *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; + esac || +- { { echo "$as_me:$LINENO: error: cannot find input file: $ac_f" >&5 +-echo "$as_me: error: cannot find input file: $ac_f" >&2;} +- { (exit 1); exit 1; }; };; ++ as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5 ;; + esac +- ac_file_inputs="$ac_file_inputs $ac_f" ++ case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac ++ as_fn_append ac_file_inputs " '$ac_f'" + done + + # Let's still pretend it is `configure' which instantiates (i.e., don't + # use $as_me), people would be surprised to read: + # /* config.h. Generated by config.status. */ +- configure_input="Generated from "`IFS=: +- echo $* | sed 's|^[^:]*/||;s|:[^:]*/|, |g'`" by configure." ++ configure_input='Generated from '` ++ $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' ++ `' by configure.' + if test x"$ac_file" != x-; then + configure_input="$ac_file. $configure_input" +- { echo "$as_me:$LINENO: creating $ac_file" >&5 +-echo "$as_me: creating $ac_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5 ++$as_echo "$as_me: creating $ac_file" >&6;} + fi ++ # Neutralize special characters interpreted by sed in replacement strings. ++ case $configure_input in #( ++ *\&* | *\|* | *\\* ) ++ ac_sed_conf_input=`$as_echo "$configure_input" | ++ sed 's/[\\\\&|]/\\\\&/g'`;; #( ++ *) ac_sed_conf_input=$configure_input;; ++ esac + + case $ac_tag in +- *:-:* | *:-) cat >"$tmp/stdin";; ++ *:-:* | *:-) cat >"$tmp/stdin" \ ++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; + esac + ;; + esac +@@ -3466,42 +4256,7 @@ + X"$ac_file" : 'X\(//\)[^/]' \| \ + X"$ac_file" : 'X\(//\)$' \| \ + X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || +-echo X"$ac_file" | +- sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ +- s//\1/ +- q +- } +- /^X\(\/\/\)[^/].*/{ +- s//\1/ +- q +- } +- /^X\(\/\/\)$/{ +- s//\1/ +- q +- } +- /^X\(\/\).*/{ +- s//\1/ +- q +- } +- s/.*/./; q'` +- { as_dir="$ac_dir" +- case $as_dir in #( +- -*) as_dir=./$as_dir;; +- esac +- test -d "$as_dir" || { $as_mkdir_p && mkdir -p "$as_dir"; } || { +- as_dirs= +- while :; do +- case $as_dir in #( +- *\'*) as_qdir=`echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #( +- *) as_qdir=$as_dir;; +- esac +- as_dirs="'$as_qdir' $as_dirs" +- as_dir=`$as_dirname -- "$as_dir" || +-$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ +- X"$as_dir" : 'X\(//\)[^/]' \| \ +- X"$as_dir" : 'X\(//\)$' \| \ +- X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || +-echo X"$as_dir" | ++$as_echo X"$ac_file" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ + s//\1/ + q +@@ -3519,20 +4274,15 @@ + q + } + s/.*/./; q'` +- test -d "$as_dir" && break +- done +- test -z "$as_dirs" || eval "mkdir $as_dirs" +- } || test -d "$as_dir" || { { echo "$as_me:$LINENO: error: cannot create directory $as_dir" >&5 +-echo "$as_me: error: cannot create directory $as_dir" >&2;} +- { (exit 1); exit 1; }; }; } ++ as_dir="$ac_dir"; as_fn_mkdir_p + ac_builddir=. + + case "$ac_dir" in + .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) +- ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` ++ ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` + # A ".." for each directory in $ac_dir_suffix. +- ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'` ++ ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` + case $ac_top_builddir_sub in + "") ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; +@@ -3568,12 +4318,12 @@ + + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + # If the template does not know about datarootdir, expand it. + # FIXME: This hack should be removed a few years after 2.60. + ac_datarootdir_hack=; ac_datarootdir_seen= +- +-case `sed -n '/datarootdir/ { ++ac_sed_dataroot=' ++/datarootdir/ { + p + q + } +@@ -3581,36 +4331,37 @@ + /@docdir@/p + /@infodir@/p + /@localedir@/p +-/@mandir@/p +-' $ac_file_inputs` in ++/@mandir@/p' ++case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in + *datarootdir*) ac_datarootdir_seen=yes;; + *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) +- { echo "$as_me:$LINENO: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 +-echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 ++$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + ac_datarootdir_hack=' + s&@datadir@&$datadir&g + s&@docdir@&$docdir&g + s&@infodir@&$infodir&g + s&@localedir@&$localedir&g + s&@mandir@&$mandir&g +- s&\\\${datarootdir}&$datarootdir&g' ;; ++ s&\\\${datarootdir}&$datarootdir&g' ;; + esac + _ACEOF + + # Neutralize VPATH when `$srcdir' = `.'. + # Shell code in configure.ac might set extrasub. + # FIXME: do we really want to maintain this feature? +-cat >>$CONFIG_STATUS <<_ACEOF +- sed "$ac_vpsub ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++ac_sed_extra="$ac_vpsub + $extrasub + _ACEOF +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + :t + /@[a-zA-Z_][a-zA-Z_0-9]*@/!b +-s&@configure_input@&$configure_input&;t t ++s|@configure_input@|$ac_sed_conf_input|;t t + s&@top_builddir@&$ac_top_builddir_sub&;t t ++s&@top_build_prefix@&$ac_top_build_prefix&;t t + s&@srcdir@&$ac_srcdir&;t t + s&@abs_srcdir@&$ac_abs_srcdir&;t t + s&@top_srcdir@&$ac_top_srcdir&;t t +@@ -3619,21 +4370,24 @@ + s&@abs_builddir@&$ac_abs_builddir&;t t + s&@abs_top_builddir@&$ac_abs_top_builddir&;t t + $ac_datarootdir_hack +-" $ac_file_inputs | sed -f "$tmp/subs-1.sed" >$tmp/out ++" ++eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$tmp/subs.awk" >$tmp/out \ ++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 + + test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && + { ac_out=`sed -n '/\${datarootdir}/p' "$tmp/out"`; test -n "$ac_out"; } && + { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' "$tmp/out"`; test -z "$ac_out"; } && +- { echo "$as_me:$LINENO: WARNING: $ac_file contains a reference to the variable \`datarootdir' +-which seems to be undefined. Please make sure it is defined." >&5 +-echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' +-which seems to be undefined. Please make sure it is defined." >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir' ++which seems to be undefined. Please make sure it is defined" >&5 ++$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' ++which seems to be undefined. Please make sure it is defined" >&2;} + + rm -f "$tmp/stdin" + case $ac_file in +- -) cat "$tmp/out"; rm -f "$tmp/out";; +- *) rm -f "$ac_file"; mv "$tmp/out" $ac_file;; +- esac ++ -) cat "$tmp/out" && rm -f "$tmp/out";; ++ *) rm -f "$ac_file" && mv "$tmp/out" "$ac_file";; ++ esac \ ++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 + ;; + + +@@ -3643,11 +4397,13 @@ + done # for ac_tag + + +-{ (exit 0); exit 0; } ++as_fn_exit 0 + _ACEOF +-chmod +x $CONFIG_STATUS + ac_clean_files=$ac_clean_files_save + ++test $ac_write_fail = 0 || ++ as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5 ++ + + # configure is writing to config.log, and then calls config.status. + # config.status does its own redirection, appending to config.log. +@@ -3667,7 +4423,10 @@ + exec 5>>config.log + # Use ||, not &&, to avoid exiting from the if with $? = 1, which + # would make configure fail if this is the last instruction. +- $ac_cs_success || { (exit 1); exit 1; } ++ $ac_cs_success || as_fn_exit 1 ++fi ++if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 ++$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} + fi +- + +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in 2012-12-04 19:38:00.241420966 +0100 +@@ -2,12 +2,21 @@ + AC_REVISION($Revision$) + AC_DEFUN(modname,[rlm_eap_tnc]) + ++eap_tnc_cflags= ++eap_tnc_ldflags=-lnaaeap ++ + if test x$with_[]modname != xno; then + +- AC_CHECK_LIB(TNCS, exchangeTNCCSMessages) +- if test "x$ac_cv_lib_tncs_exchangetnccsmessages" != xyes; then +- AC_MSG_WARN([the TNCS library isn't found!]) +- fail="$fail -lTNCS" ++ AC_CHECK_LIB(naaeap,processEAPTNCData,,fail="$fail -lnaaeap",) ++ if test -x"$ac_cv_lib_NAAEAP_processEAPTNCData" == -x"no"; then ++ AC_MSG_WARN([the NAAEAP library was not found!]) ++ fail="$fail -lNAAEAP" ++ fi ++ ++ AC_CHECK_HEADERS(naaeap/naaeap.h,,fail="$fail -Inaaeap.h",) ++ if test -x"$ac_cv_header_naaeap_h" == -x"no"; then ++ AC_MSG_WARN([the naaeap header was not found!]) ++ fail="$fail -Inaaeap.h" + fi + + targetname=modname +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c 2012-12-04 19:38:00.241420966 +0100 +@@ -1,12 +1,12 @@ + /* + * eap_tnc.c EAP TNC functionality. + * +- * This software is Copyright (C) 2006,2007 FH Hannover ++ * This software is Copyright (C) 2006-2009 FH Hannover + * + * Portions of this code unrelated to FreeRADIUS are available + * separately under a commercial license. If you require an + * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. ++ * contact trust@f4-i.fh-hannover.de for details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +@@ -23,230 +23,41 @@ + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + */ +-#include <freeradius-devel/ident.h> +-RCSID("$Id$") +- +- +-/* +- * +- * MD5 Packet Format in EAP Type-Data +- * --- ------ ------ -- --- --------- +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Value-Size | Value ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Name ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * +- * EAP-TNC Packet Format in EAP Type-Data +- * +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Flags |Ver | Data Length ... +- * |L M S R R|=1 | +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * |... | Data ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- +- * +- */ +- + #include <stdio.h> + #include <stdlib.h> + #include "eap.h" + + #include "eap_tnc.h" + +- /* +- * WTF is wrong with htonl ? +- */ +-static uint32_t ByteSwap2 (uint32_t nLongNumber) +-{ +- return (((nLongNumber&0x000000FF)<<24)+((nLongNumber&0x0000FF00)<<8)+ +- ((nLongNumber&0x00FF0000)>>8)+((nLongNumber&0xFF000000)>>24)); +-} +- + /* +- * Allocate a new TNC_PACKET ++ * Forms an EAP_REQUEST packet from the EAP_TNC specific data. + */ +-TNC_PACKET *eaptnc_alloc(void) ++int eaptnc_compose(EAP_HANDLER *handler, TNC_BufferReference request, TNC_UInt32 length, uint8_t code) + { +- TNC_PACKET *rp; +- +- if ((rp = malloc(sizeof(TNC_PACKET))) == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- return NULL; ++ // check parameters ++ if(handler == NULL || (request == NULL && length != 0) || (request != NULL && length < 1) || code > PW_EAP_MAX_CODES){ ++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler == %p, request == %p, length == %lu, code == %u", handler, request, length, code); ++ return 0; + } +- memset(rp, 0, sizeof(TNC_PACKET)); +- return rp; +-} +- +-/* +- * Free TNC_PACKET +- */ +-void eaptnc_free(TNC_PACKET **tnc_packet_ptr) +-{ +- TNC_PACKET *tnc_packet; +- +- if (!tnc_packet_ptr) return; +- tnc_packet = *tnc_packet_ptr; +- if (tnc_packet == NULL) return; +- +- if (tnc_packet->data) free(tnc_packet->data); + +- free(tnc_packet); +- +- *tnc_packet_ptr = NULL; +-} +- +-/* +- * We expect only RESPONSE for which REQUEST, SUCCESS or FAILURE is sent back +- */ +-TNC_PACKET *eaptnc_extract(EAP_DS *eap_ds) +-{ +- tnc_packet_t *data; +- TNC_PACKET *packet; +- /* +- * We need a response, of type EAP-TNC +- */ +- if (!eap_ds || +- !eap_ds->response || +- (eap_ds->response->code != PW_TNC_RESPONSE) || +- eap_ds->response->type.type != PW_EAP_TNC || +- !eap_ds->response->type.data || +- (eap_ds->response->length <= TNC_HEADER_LEN) || +- (eap_ds->response->type.data[0] <= 0)) { +- radlog(L_ERR, "rlm_eap_tnc: corrupted data"); +- return NULL; ++ // further check parameters ++ if(handler->opaque == NULL || handler->eap_ds == NULL){ ++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler->opaque == %p, handler->eap_ds == %p", handler->opaque, handler->eap_ds); ++ return 0; + } +- packet = eaptnc_alloc(); +- if (!packet) return NULL; +- + +- packet->code = eap_ds->response->code; +- packet->id = eap_ds->response->id; +- packet->length = eap_ds->response->length; +- +- data = (tnc_packet_t *)eap_ds->response->type.data; +- /* +- * Already checked the size above. +- */ +- packet->flags_ver = data->flags_ver; +- unsigned char *ptr = (unsigned char*)data; +- +- +- DEBUG2("Flags/Ver: %x\n", packet->flags_ver); +- int thisDataLength; +- int dataStart; +- if(TNC_LENGTH_INCLUDED(packet->flags_ver)){ +- DEBUG2("data_length included\n"); +-// memcpy(&packet->flags_ver[1], &data->flags_ver[1], 4); +- //packet->data_length = data->data_length; +- memcpy(&packet->data_length, &ptr[1], TNC_DATA_LENGTH_LENGTH); +- DEBUG2("data_length: %x\n", packet->data_length); +- DEBUG2("data_length: %d\n", packet->data_length); +- DEBUG2("data_length: %x\n", ByteSwap2(packet->data_length)); +- DEBUG2("data_length: %d\n", ByteSwap2(packet->data_length)); +- packet->data_length = ByteSwap2(packet->data_length); +- thisDataLength = packet->length-TNC_PACKET_LENGTH; //1: we need space for flags_ver +- dataStart = TNC_DATA_LENGTH_LENGTH+TNC_FLAGS_VERSION_LENGTH; +- }else{ +- DEBUG2("no data_length included\n"); +- thisDataLength = packet->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- packet->data_length = 0; +- dataStart = TNC_FLAGS_VERSION_LENGTH; +- +- } +- /* +- * Allocate room for the data, and copy over the data. +- */ +- packet->data = malloc(thisDataLength); +- if (packet->data == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- eaptnc_free(&packet); +- return NULL; ++ if(handler->eap_ds->request == NULL){ ++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler->eap_ds->request == %p", handler->eap_ds->request); ++ return 0; + } +- +- memcpy(packet->data, &(eap_ds->response->type.data[dataStart]), thisDataLength); +- +- return packet; +-} + +- +-/* +- * Compose the portions of the reply packet specific to the +- * EAP-TNC protocol, in the EAP reply typedata +- */ +-int eaptnc_compose(EAP_DS *eap_ds, TNC_PACKET *reply) +-{ +- uint8_t *ptr; +- +- +- if (reply->code < 3) { +- //fill: EAP-Type (0x888e) +- eap_ds->request->type.type = PW_EAP_TNC; +- DEBUG2("TYPE: EAP-TNC set\n"); +- rad_assert(reply->length > 0); +- +- //alloc enough space for whole TNC-Packet (from Code on) +- eap_ds->request->type.data = calloc(reply->length, sizeof(unsigned char*)); +- DEBUG2("Malloc %d bytes for packet\n", reply->length); +- if (eap_ds->request->type.data == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- return 0; +- } +- //put pointer at position where data starts (behind Type) +- ptr = eap_ds->request->type.data; +- //*ptr = (uint8_t)(reply->data_length & 0xFF); +- +- //ptr++; +- *ptr = reply->flags_ver; +- DEBUG2("Set Flags/Version: %d\n", *ptr); +- if(reply->data_length!=0){ +- DEBUG2("Set data-length: %d\n", reply->data_length); +- ptr++; //move to start-position of "data_length" +- DEBUG2("Set data-length: %x\n", reply->data_length); +- DEBUG2("Set data-length (swapped): %x\n", ByteSwap2(reply->data_length)); +- unsigned long swappedDataLength = ByteSwap2(reply->data_length); +- //DEBUG2("DATA-length: %d", reply->data_ +- memcpy(ptr, &swappedDataLength, 4); +- //*ptr = swappedDataLength; +- } +- uint16_t thisDataLength=0; +- if(reply->data!=NULL){ +- DEBUG2("Adding TNCCS-Data "); +- int offset; +- //if data_length-Field present +- if(reply->data_length !=0){ +- DEBUG2("with Fragmentation\n"); +- offset = TNC_DATA_LENGTH_LENGTH; //length of data_length-field: 4 +- thisDataLength = reply->length-TNC_PACKET_LENGTH; +- }else{ //data_length-Field not present +- DEBUG2("without Fragmentation\n"); +- offset = 1; +- thisDataLength = reply->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- } +- DEBUG2("TNCCS-Datalength: %d\n", thisDataLength); +- ptr=ptr+offset; //move to start-position of "data" +- memcpy(ptr,reply->data, thisDataLength); +- }else{ +- DEBUG2("No TNCCS-Data present"); +- } +- +- //the length of the TNC-packet (behind Type) +- if(reply->data_length!=0){ +- eap_ds->request->type.length = TNC_DATA_LENGTH_LENGTH+TNC_FLAGS_VERSION_LENGTH+thisDataLength; //4:data_length, 1: flags_ver +- }else{ +- eap_ds->request->type.length = TNC_FLAGS_VERSION_LENGTH+thisDataLength; //1: flags_ver +- } +- DEBUG2("Packet built\n"); +- +- } else { +- eap_ds->request->type.length = 0; +- } +- eap_ds->request->code = reply->code; ++ // fill EAP data to handler ++ handler->eap_ds->request->code = code; ++ handler->eap_ds->request->type.type = PW_EAP_TNC; ++ // fill EAP TYPE specific data to handler ++ handler->eap_ds->request->type.length = length; ++ free(handler->eap_ds->request->type.data); ++ handler->eap_ds->request->type.data = request; + + return 1; + } +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h 2012-12-04 19:38:00.241420966 +0100 +@@ -1,10 +1,10 @@ + /* +- * This software is Copyright (C) 2006,2007 FH Hannover ++ * This software is Copyright (C) 2006-2009 FH Hannover + * + * Portions of this code unrelated to FreeRADIUS are available + * separately under a commercial license. If you require an + * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. ++ * contact trust@f4-i.fh-hannover.de for details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +@@ -26,105 +26,20 @@ + #define _EAP_TNC_H + + #include "eap.h" ++#include <naaeap/naaeap.h> + +-#define PW_TNC_REQUEST 1 +-#define PW_TNC_RESPONSE 2 +-#define PW_TNC_SUCCESS 3 +-#define PW_TNC_FAILURE 4 +-#define PW_TNC_MAX_CODES 4 +- +-#define TNC_HEADER_LEN 4 +-#define TNC_CHALLENGE_LEN 16 +-#define TNC_START_LEN 8 +- +-#define TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH 6 +-#define TNC_PACKET_LENGTH 10 +-#define TNC_DATA_LENGTH_LENGTH 4 +-#define TNC_FLAGS_VERSION_LENGTH 1 +- +-typedef unsigned int VlanAccessMode; +- +-#define VLAN_ISOLATE 97 +-#define VLAN_ACCESS 2 +-/* +- **** +- * EAP - MD5 doesnot specify code, id & length but chap specifies them, +- * for generalization purpose, complete header should be sent +- * and not just value_size, value and name. +- * future implementation. +- * +- * Huh? What does that mean? +- */ ++#define SET_START(x) ((x) | (0x20)) + +-/* ++/** ++ * Composes the EAP packet. + * +- * MD5 Packet Format in EAP Type-Data +- * --- ------ ------ -- --- --------- +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Value-Size | Value ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Name ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * +- * EAP-TNC Packet Format in EAP Type-Data +- * +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Flags |Ver | Data Length ... +- * |L M S R R|=1 | +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * |... | Data ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- ++ * @param handler The EAP_HANDLER from tnc_initiate() or tnc_authenticate ++ * @param request The EAP_TNC packet received from NAA-TNCS ++ * @param length The length of the EAP_TNC packet received from NAA-TNCS ++ * @param code EAP_CODE for the request + * ++ * @return True if operation was successful, otherwise false. + */ +- +-/* eap packet structure */ +-typedef struct tnc_packet_t { +-/* +- uint8_t code; +- uint8_t id; +- uint16_t length; +-*/ +- uint8_t flags_ver; +- uint32_t data_length; +- uint8_t *data; +-} tnc_packet_t; +- +-typedef struct tnc_packet { +- uint8_t code; +- uint8_t id; +- uint16_t length; +- uint8_t flags_ver; +- uint32_t data_length; +- uint8_t *data; +-} TNC_PACKET; +- +-#define TNC_START(x) (((x) & 0x20) != 0) +-#define TNC_MORE_FRAGMENTS(x) (((x) & 0x40) != 0) +-#define TNC_LENGTH_INCLUDED(x) (((x) & 0x80) != 0) +-#define TNC_RESERVED_EQ_NULL(x) (((x) & 0x10) == 0 && ((x) & 0x8) == 0) +-#define TNC_VERSION_EQ_ONE(x) (((x) & 0x07) == 1) +- +-#define SET_START(x) ((x) | (0x20)) +-#define SET_MORE_FRAGMENTS(x) ((x) | (0x40)) +-#define SET_LENGTH_INCLUDED(x) ((x) | (0x80)) +- +- +-/* function declarations here */ +- +-TNC_PACKET *eaptnc_alloc(void); +-void eaptnc_free(TNC_PACKET **tnc_packet_ptr); +- +-int eaptnc_compose(EAP_DS *auth, TNC_PACKET *reply); +-TNC_PACKET *eaptnc_extract(EAP_DS *auth); +-int eaptnc_verify(TNC_PACKET *pkt, VALUE_PAIR* pwd, uint8_t *ch); +- +- +- +- ++int eaptnc_compose(EAP_HANDLER *handler, TNC_BufferReference request, TNC_UInt32 length, uint8_t code); + + #endif /*_EAP_TNC_H*/ +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in 2012-12-04 19:38:49.277421870 +0100 +@@ -3,8 +3,8 @@ + # + + TARGET = @targetname@ +-SRCS = rlm_eap_tnc.c eap_tnc.c tncs_connect.c +-HEADERS = eap_tnc.h tncs.h tncs_connect.h ../../eap.h ../../rlm_eap.h ++SRCS = rlm_eap_tnc.c eap_tnc.c ++HEADERS = eap_tnc.h ../../eap.h ../../rlm_eap.h + RLM_CFLAGS = -I../.. -I../../libeap $(OPENSSL_INCLUDE) @eap_tnc_cflags@ + RLM_LIBS = @eap_tnc_ldflags@ ../../libeap/$(LIBPREFIX)freeradius-eap.la $(OPENSSL_LIBS) + RLM_INSTALL = +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c 2012-12-04 19:38:00.241420966 +0100 +@@ -1,12 +1,12 @@ + /* + * rlm_eap_tnc.c Handles that are called from eap + * +- * This software is Copyright (C) 2006,2007 FH Hannover ++ * This software is Copyright (C) 2006-2009 FH Hannover + * + * Portions of this code unrelated to FreeRADIUS are available + * separately under a commercial license. If you require an + * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. ++ * contact trust@f4-i.fh-hannover.de for details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +@@ -26,96 +26,262 @@ + * Copyright (C) 2007 Alan DeKok <aland@deployingradius.com> + */ + +-#include <freeradius-devel/ident.h> +-RCSID("$Id$") ++/* ++ * EAP-TNC Packet with EAP Header, general structure ++ * ++ * 0 1 2 3 ++ * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Code | Identifier | Length | ++ * | | | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Type | Flags | Ver | Data Length | ++ * | |L M S R R| =1 | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Data Length | Data ... ++ * | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ */ + + #include <freeradius-devel/autoconf.h> + + #include <stdio.h> + #include <stdlib.h> + +-#include "tncs_connect.h" + #include "eap_tnc.h" +-#include "tncs.h" ++#include <naaeap/naaeap.h> + #include <freeradius-devel/rad_assert.h> ++//#include <freeradius-devel/libradius.h> + +-typedef struct rlm_eap_tnc_t { +- char *vlan_access; +- char *vlan_isolate; +- char *tnc_path; +-} rlm_eap_tnc_t; ++#include <netinet/in.h> + +-static int sessionCounter=0; ++/** ++ * Calculates an identifying string based upon nas_port, nas_ip and nas_port_type. ++ * The maximum length of the calculated string is 70 (not including the trailing '\0'). ++ * ++ * @return the number of bytes written to out (not including the trailing '\0') ++ */ ++static uint32_t calculateConnectionString(RADIUS_PACKET* radius_packet, char *out, size_t outMaxLength) ++{ ++ VALUE_PAIR *vp = NULL; ++ uint32_t nas_port = 0; ++ uint32_t nas_ip = 0; ++ uint32_t nas_port_type = 0; ++ ++ char out_nas_port[11]; ++ char out_nas_ip_byte_0[4]; ++ char out_nas_ip_byte_1[4]; ++ char out_nas_ip_byte_2[4]; ++ char out_nas_ip_byte_3[4]; ++ char out_nas_port_type[11]; ++ ++ // check for NULL ++ if (radius_packet == NULL) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: calculateConnectionString failed. radius_packet == NULL!"); ++ return 0; ++ } ++ ++ // read NAS port, ip and port type ++ for (vp = radius_packet->vps; vp; vp=vp->next) { ++ switch (vp->attribute) { ++ case PW_NAS_PORT: ++ nas_port = vp->vp_integer; ++ DEBUG("NAS scr port = %u\n", nas_port); ++ break; ++ case PW_NAS_IP_ADDRESS: ++ nas_ip = vp->vp_ipaddr; ++ DEBUG("NAS scr ip = %X\n", ntohl(nas_ip)); ++ break; ++ case PW_NAS_PORT_TYPE: ++ nas_port_type = vp->vp_integer; ++ DEBUG("NAS scr port type = %u\n", nas_port_type); ++ break; ++ } ++ } ++ ++ snprintf(out_nas_port, 11, "%u", nas_port); ++ snprintf(out_nas_ip_byte_0, 4, "%u", nas_ip & 0xFF); ++ snprintf(out_nas_ip_byte_1, 4, "%u", (nas_ip >> 8) & 0xFF); ++ snprintf(out_nas_ip_byte_2, 4, "%u", (nas_ip >> 16) & 0xFF); ++ snprintf(out_nas_ip_byte_3, 4, "%u", (nas_ip >> 24) & 0xFF); ++ snprintf(out_nas_port_type, 11, "%u", nas_port_type); ++ ++ return snprintf(out, outMaxLength, "NAS Port: %s NAS IP: %s.%s.%s.%s NAS_PORT_TYPE: %s", out_nas_port, out_nas_ip_byte_3, out_nas_ip_byte_2, out_nas_ip_byte_1, out_nas_ip_byte_0, out_nas_port_type); ++} ++ ++/* ++ * This function is called when the FreeRADIUS attach this module. ++ */ ++static int tnc_attach(CONF_SECTION *conf, void **type_data) ++{ ++ // initialize NAA-EAP ++ DEBUG2("TNC-ATTACH initializing NAA-EAP"); ++ TNC_Result result = initializeDefault(); ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_attach error while calling NAA-EAP initializeDefault()"); ++ return -1; ++ } ++ return 0; ++} ++ ++/* ++ * This function is called when the FreeRADIUS detach this module. ++ */ ++static int tnc_detach(void *args) ++{ ++ // terminate NAA-EAP ++ DEBUG2("TNC-TERMINATE terminating NAA-EAP"); ++ TNC_Result result = terminate(); ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_attach error while calling NAA-EAP terminate()"); ++ return -1; ++ } ++ return 0; ++} + + /* +- * Initiate the EAP-MD5 session by sending a challenge to the peer. +- * Initiate the EAP-TNC session by sending a EAP Request witch Start Bit set +- * and with no data ++ * This function is called when the first EAP_IDENTITY_RESPONSE message ++ * was received. ++ * ++ * Initiates the EPA_TNC session by sending the first EAP_TNC_RESPONSE ++ * to the peer. The packet has the Start-Bit set and contains no data. ++ * ++ * 0 1 2 3 ++ * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Code | Identifier | Length | ++ * | | | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Type | Flags | Ver | ++ * | |0 0 1 0 0|0 0 1| ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * ++ * For this package, only 'Identifier' has to be set dynamically. Any ++ * other information is static. + */ + static int tnc_initiate(void *type_data, EAP_HANDLER *handler) + { +- uint8_t flags_ver = 1; //set version to 1 +- rlm_eap_tnc_t *inst = type_data; +- TNC_PACKET *reply; ++ size_t buflen = 71; ++ size_t ret = 0; ++ char buf[buflen]; ++ REQUEST * request = NULL; ++ TNC_Result result; ++ TNC_ConnectionID conID; ++ TNC_BufferReference username; + ++ // check if we run inside a secure EAP method. ++ // FIXME check concrete outer EAP method + if (!handler->request || !handler->request->parent) { +- DEBUG("rlm_eap_tnc: EAP-TNC can only be run inside of a TLS-based method."); ++ DEBUG2("rlm_eap_tnc: EAP_TNC must only be used as an inner method within a protected tunneled EAP created by an outer EAP method."); ++ request = handler->request; + return 0; ++ } else { ++ request = handler->request->parent; + } + +- /* +- * FIXME: Update this when the TTLS and PEAP methods can +- * run EAP-TLC *after* the user has been authenticated. +- * This likely means moving the phase2 handlers to a +- * common code base. +- */ +- if (1) { +- DEBUG("rlm-eap_tnc: EAP-TNC can only be run after the user has been authenticated."); ++ if (request->packet == NULL) { ++ DEBUG2("rlm_eap_tnc: ERROR request->packet is NULL."); + return 0; + } + + DEBUG("tnc_initiate: %ld", handler->timestamp); + +- if(connectToTncs(inst->tnc_path)==-1){ +- DEBUG("Could not connect to TNCS"); ++ //calculate connectionString ++ ret = calculateConnectionString(request->packet, buf, buflen); ++ if(ret == 0){ ++ radlog(L_ERR, "rlm_eap_tnc:tnc_attach: calculating connection String failed."); ++ return 0; + } + ++ DEBUG2("TNC-INITIATE getting connection from NAA-EAP"); ++ + /* +- * Allocate an EAP-MD5 packet. ++ * get connection ++ * (uses a function from the NAA-EAP-library) ++ * the presence of the library is checked via the configure-script + */ +- reply = eaptnc_alloc(); +- if (reply == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); ++ result = getConnection(buf, &conID); ++ ++ // check for errors ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_initiate error while calling NAA-EAP getConnection"); + return 0; + } + + /* +- * Fill it with data. ++ * tries to get the username from FreeRADIUS; ++ * copied from modules/rlm_eap/types/rlm_eap_ttls/ttls.c + */ +- reply->code = PW_TNC_REQUEST; +- flags_ver = SET_START(flags_ver); //set start-flag +- DEBUG("$$$$$$$$$$$$$$$$Flags: %d", flags_ver); +- reply->flags_ver = flags_ver; +- reply->length = 1+1; /* one byte of flags_ver */ ++ VALUE_PAIR *usernameValuePair; ++ usernameValuePair = pairfind(request->packet->vps, PW_USER_NAME); + ++ VALUE_PAIR *eapMessageValuePair; ++ if (!usernameValuePair) { ++ eapMessageValuePair = pairfind(request->packet->vps, PW_EAP_MESSAGE); ++ ++ if (eapMessageValuePair && ++ (eapMessageValuePair->length >= EAP_HEADER_LEN + 2) && ++ (eapMessageValuePair->vp_strvalue[0] == PW_EAP_RESPONSE) && ++ (eapMessageValuePair->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) && ++ (eapMessageValuePair->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) { ++ ++ /* ++ * Create & remember a User-Name ++ */ ++ usernameValuePair = pairmake("User-Name", "", T_OP_EQ); ++ rad_assert(usernameValuePair != NULL); ++ ++ memcpy(usernameValuePair->vp_strvalue, eapMessageValuePair->vp_strvalue + 5, ++ eapMessageValuePair->length - 5); ++ usernameValuePair->length = eapMessageValuePair->length - 5; ++ usernameValuePair->vp_strvalue[usernameValuePair->length] = 0; ++ } ++ } ++ ++ username = malloc(usernameValuePair->length + 1); ++ memcpy(username, usernameValuePair->vp_strvalue, usernameValuePair->length); ++ username[usernameValuePair->length] = '\0'; ++ ++ RDEBUG("Username for current TNC connection: %s", username); ++ ++ /* ++ * stores the username of this connection ++ * (uses a function from the NAA-EAP-library) ++ * the presence of the library is checked via the configure-script ++ */ ++ result = storeUsername(conID, username, usernameValuePair->length); ++ ++ // check for errors ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_initiate error while calling NAA-EAP storeUsername"); ++ return 0; ++ } ++ ++ // set connection ID in FreeRADIUS ++ handler->opaque = malloc(sizeof(TNC_ConnectionID)); ++ memcpy(handler->opaque, &conID, sizeof(TNC_ConnectionID)); ++ ++ // build first EAP TNC request ++ TNC_BufferReference eap_tnc_request = malloc(sizeof(unsigned char)); ++ if (eap_tnc_request == NULL) { ++ radlog(L_ERR, "rlm_eap_tnc:tnc_initiate: malloc failed."); ++ return 0; ++ } ++ *eap_tnc_request = SET_START(1); ++ TNC_UInt32 eap_tnc_length = 1; ++ type_data = type_data; /* suppress -Wunused */ + + /* + * Compose the EAP-TNC packet out of the data structure, + * and free it. + */ +- eaptnc_compose(handler->eap_ds, reply); +- eaptnc_free(&reply); ++ eaptnc_compose(handler, eap_tnc_request, eap_tnc_length, PW_EAP_REQUEST); + +- //put sessionAttribute to Handler and increase sessionCounter +- handler->opaque = calloc(sizeof(TNC_ConnectionID), 1); +- if (handler->opaque == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- return 0; +- } +- handler->free_opaque = free; +- memcpy(handler->opaque, &sessionCounter, sizeof(int)); +- sessionCounter++; +- + /* + * We don't need to authorize the user at this point. + * +@@ -124,246 +290,114 @@ + * to us... + */ + handler->stage = AUTHENTICATE; +- +- return 1; +-} + +-static void setVlanAttribute(rlm_eap_tnc_t *inst, EAP_HANDLER *handler, +- VlanAccessMode mode){ +- VALUE_PAIR *vp; +- char *vlanNumber = NULL; +- switch(mode){ +- case VLAN_ISOLATE: +- vlanNumber = inst->vlan_isolate; +- vp = pairfind(handler->request->config_items, +- PW_TNC_VLAN_ISOLATE); +- if (vp) vlanNumber = vp->vp_strvalue; +- break; +- case VLAN_ACCESS: +- vlanNumber = inst->vlan_access; +- vp = pairfind(handler->request->config_items, +- PW_TNC_VLAN_ACCESS); +- if (vp) vlanNumber = vp->vp_strvalue; +- break; +- +- default: +- DEBUG2(" rlm_eap_tnc: Internal error. Not setting vlan number"); +- return; +- } +- pairadd(&handler->request->reply->vps, +- pairmake("Tunnel-Type", "VLAN", T_OP_SET)); +- +- pairadd(&handler->request->reply->vps, +- pairmake("Tunnel-Medium-Type", "IEEE-802", T_OP_SET)); +- +- pairadd(&handler->request->reply->vps, +- pairmake("Tunnel-Private-Group-ID", vlanNumber, T_OP_SET)); +- ++ return 1; + } + +-/* +- * Authenticate a previously sent challenge. ++/** ++ * This function is called when a EAP_TNC_RESPONSE was received. ++ * It basically forwards the EAP_TNC data to NAA-TNCS and forms ++ * and appropriate EAP_RESPONSE. Furthermore, it sets the VlanID ++ * based on the TNC_ConnectionState determined by NAA-TNCS. ++ * ++ * @param type_arg The configuration data ++ * @param handler The EAP_HANDLER ++ * @return True, if successfully, else false. + */ +-static int tnc_authenticate(void *type_arg, EAP_HANDLER *handler) +-{ +- TNC_PACKET *packet; +- TNC_PACKET *reply; +- TNC_ConnectionID connId = *((TNC_ConnectionID *) (handler->opaque)); +- TNC_ConnectionState state; +- rlm_eap_tnc_t *inst = type_arg; +- int isAcknowledgement = 0; +- TNC_UInt32 tnccsMsgLength = 0; +- int isLengthIncluded; +- int moreFragments; +- TNC_UInt32 overallLength; +- TNC_BufferReference outMessage; +- TNC_UInt32 outMessageLength = 2; +- int outIsLengthIncluded=0; +- int outMoreFragments=0; +- TNC_UInt32 outOverallLength=0; ++static int tnc_authenticate(void *type_arg, EAP_HANDLER *handler) { + +- DEBUG2("HANDLER_OPAQUE: %d", (int) *((TNC_ConnectionID *) (handler->opaque))); +- DEBUG2("TNC-AUTHENTICATE is starting now for %d..........", (int) connId); ++ rad_assert(handler->request != NULL); // check that request has been sent previously ++ rad_assert(handler->stage == AUTHENTICATE); // check if initiate has been called + +- /* +- * Get the User-Password for this user. +- */ +- rad_assert(handler->request != NULL); +- rad_assert(handler->stage == AUTHENTICATE); +- +- /* +- * Extract the EAP-TNC packet. +- */ +- if (!(packet = eaptnc_extract(handler->eap_ds))) ++ if (handler == NULL) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler == NULL"); + return 0; ++ } ++ if (handler->eap_ds == NULL) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds == NULL"); ++ return 0; ++ } ++ if (handler->eap_ds->response == NULL) { ++ radlog( ++ L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds->resonse == NULL"); ++ return 0; ++ } ++ if (handler->eap_ds->response->type.type != PW_EAP_TNC ++ || handler->eap_ds->response->type.length < 1 ++ || handler->eap_ds->response->type.data == NULL) { ++ radlog( ++ L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds->response->type.type == %X, ->type.length == %u, ->type.data == %p", ++ handler->eap_ds->response->type.type, ++ handler->eap_ds->response->type.length, ++ handler->eap_ds->response->type.data); ++ return 0; ++ } + +- /* +- * Create a reply, and initialize it. +- */ +- reply = eaptnc_alloc(); +- if (!reply) { +- eaptnc_free(&packet); +- return 0; +- } +- +- reply->id = handler->eap_ds->request->id; +- reply->length = 0; +- if(packet->data_length==0){ +- tnccsMsgLength = packet->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- }else{ +- tnccsMsgLength = packet->length-TNC_PACKET_LENGTH; +- } +- isLengthIncluded = TNC_LENGTH_INCLUDED(packet->flags_ver); +- moreFragments = TNC_MORE_FRAGMENTS(packet->flags_ver); +- overallLength = packet->data_length; +- if(isLengthIncluded == 0 +- && moreFragments == 0 +- && overallLength == 0 +- && tnccsMsgLength == 0 +- && TNC_START(packet->flags_ver)==0){ +- +- isAcknowledgement = 1; +- } +- +- DEBUG("Data received: (%d)", (int) tnccsMsgLength); +-/* int i; +- for(i=0;i<tnccsMsgLength;i++){ +- DEBUG2("%c", (packet->data)[i]); +- } +- DEBUG2("\n"); +- */ +- state = exchangeTNCCSMessages(inst->tnc_path, +- connId, +- isAcknowledgement, +- packet->data, +- tnccsMsgLength, +- isLengthIncluded, +- moreFragments, +- overallLength, +- &outMessage, +- &outMessageLength, +- &outIsLengthIncluded, +- &outMoreFragments, +- &outOverallLength); +- DEBUG("GOT State %08x from TNCS", (unsigned int) state); +- if(state == TNC_CONNECTION_EAP_ACKNOWLEDGEMENT){ //send back acknoledgement +- reply->code = PW_TNC_REQUEST; +- reply->data = NULL; +- reply->data_length = 0; +- reply->flags_ver = 1; +- reply->length =TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- }else{ //send back normal message +- DEBUG("GOT Message from TNCS (length: %d)", (int) outMessageLength); +- +- /* for(i=0;i<outMessageLength;i++){ +- DEBUG2("%c", outMessage[i]); +- } +- DEBUG2("\n"); +- */ +- DEBUG("outIsLengthIncluded: %d, outMoreFragments: %d, outOverallLength: %d", +- outIsLengthIncluded, outMoreFragments, (int) outOverallLength); +- DEBUG("NEW STATE: %08x", (unsigned int) state); +- switch(state){ +- case TNC_CONNECTION_STATE_HANDSHAKE: +- reply->code = PW_TNC_REQUEST; +- DEBUG2("Set Reply->Code to EAP-REQUEST\n"); +- break; +- case TNC_CONNECTION_STATE_ACCESS_ALLOWED: +- reply->code = PW_TNC_SUCCESS; +- setVlanAttribute(inst, handler,VLAN_ACCESS); +- break; +- case TNC_CONNECTION_STATE_ACCESS_NONE: +- reply->code = PW_TNC_FAILURE; +- //setVlanAttribute(inst, handler, VLAN_ISOLATE); +- break; +- case TNC_CONNECTION_STATE_ACCESS_ISOLATED: +- reply->code = PW_TNC_SUCCESS; +- setVlanAttribute(inst, handler, VLAN_ISOLATE); +- break; +- default: +- reply->code= PW_TNC_FAILURE; +- +- } +- if(outMessage!=NULL && outMessageLength!=0){ +- reply->data = outMessage; +- } +- reply->flags_ver = 1; +- if(outIsLengthIncluded){ +- reply->flags_ver = SET_LENGTH_INCLUDED(reply->flags_ver); +- reply->data_length = outOverallLength; +- reply->length = TNC_PACKET_LENGTH + outMessageLength; +- DEBUG("SET LENGTH: %d", reply->length); +- DEBUG("SET DATALENGTH: %d", (int) outOverallLength); +- }else{ +- reply->data_length = 0; +- reply->length = TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH + outMessageLength; +- DEBUG("SET LENGTH: %d", reply->length); +- } +- if(outMoreFragments){ +- reply->flags_ver = SET_MORE_FRAGMENTS(reply->flags_ver); +- } +- } +- +- /* +- * Compose the EAP-MD5 packet out of the data structure, +- * and free it. +- */ +- eaptnc_compose(handler->eap_ds, reply); +- eaptnc_free(&reply); +- +- handler->stage = AUTHENTICATE; +- +- eaptnc_free(&packet); +- return 1; +-} +- +-/* +- * Detach the EAP-TNC module. +- */ +-static int tnc_detach(void *arg) +-{ +- free(arg); +- return 0; +-} +- +- +-static CONF_PARSER module_config[] = { +- { "vlan_access", PW_TYPE_STRING_PTR, +- offsetof(rlm_eap_tnc_t, vlan_access), NULL, NULL }, +- { "vlan_isolate", PW_TYPE_STRING_PTR, +- offsetof(rlm_eap_tnc_t, vlan_isolate), NULL, NULL }, +- { "tnc_path", PW_TYPE_STRING_PTR, +- offsetof(rlm_eap_tnc_t, tnc_path), NULL, +- "/usr/local/lib/libTNCS.so"}, ++ // get connection ID ++ TNC_ConnectionID conID = *((TNC_ConnectionID *) (handler->opaque)); + +- { NULL, -1, 0, NULL, NULL } /* end the list */ +-}; ++ DEBUG2("TNC-AUTHENTICATE is starting now for connection ID %lX !", conID); + +-/* +- * Attach the EAP-TNC module. +- */ +-static int tnc_attach(CONF_SECTION *cs, void **instance) +-{ +- rlm_eap_tnc_t *inst; ++ // pass EAP_TNC data to NAA-EAP and get answer data ++ TNC_BufferReference output = NULL; ++ TNC_UInt32 outputLength = 0; ++ TNC_ConnectionState connectionState = TNC_CONNECTION_STATE_CREATE; + +- inst = malloc(sizeof(*inst)); +- if (!inst) return -1; +- memset(inst, 0, sizeof(*inst)); ++ /* ++ * forwards the eap_tnc data to NAA-EAP and gets the response ++ * (uses a function from the NAA-EAP-library) ++ * the presence of the library is checked via the configure-script ++ */ ++ TNC_Result result = processEAPTNCData(conID, handler->eap_ds->response->type.data, ++ handler->eap_ds->response->type.length, &output, &outputLength, ++ &connectionState); ++ ++ // check for errors ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate error while calling NAA-EAP processEAPTNCData"); ++ return 0; ++ } + +- if (cf_section_parse(cs, inst, module_config) < 0) { +- tnc_detach(inst); +- return -1; ++ // output contains now the answer from NAA-EAP ++ uint8_t eapCode = 0; ++ // determine eapCode for request ++ switch (connectionState) { ++ case TNC_CONNECTION_STATE_HANDSHAKE: ++ eapCode = PW_EAP_REQUEST; ++ break; ++ case TNC_CONNECTION_STATE_ACCESS_NONE: ++ eapCode = PW_EAP_FAILURE; ++ break; ++ case TNC_CONNECTION_STATE_ACCESS_ALLOWED: ++ eapCode = PW_EAP_SUCCESS; ++ pairadd(&handler->request->config_items, pairmake("TNC-Status", "Access", T_OP_SET)); ++ break; ++ case TNC_CONNECTION_STATE_ACCESS_ISOLATED: ++ eapCode = PW_EAP_SUCCESS; ++ pairadd(&handler->request->config_items, pairmake("TNC-Status", "Isolate", T_OP_SET)); ++ break; ++ default: ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid TNC_CONNECTION_STATE."); ++ return 0; + } + +- +- if (!inst->vlan_access || !inst->vlan_isolate) { +- radlog(L_ERR, "rlm_eap_tnc: Must set both vlan_access and vlan_isolate"); +- tnc_detach(inst); +- return -1; ++ // form EAP_REQUEST ++ if (!eaptnc_compose(handler, output, outputLength, eapCode)) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate error while forming EAP_REQUEST."); ++ return 0; + } + +- *instance = inst; +- return 0; ++ // FIXME: Why is that needed? ++ handler->stage = AUTHENTICATE; ++ ++ return 1; + } + + /* +@@ -371,10 +405,10 @@ + * That is, everything else should be 'static'. + */ + EAP_TYPE rlm_eap_tnc = { +- "eap_tnc", +- tnc_attach, /* attach */ +- tnc_initiate, /* Start the initial request */ +- NULL, /* authorization */ +- tnc_authenticate, /* authentication */ +- tnc_detach /* detach */ ++ "eap_tnc", ++ tnc_attach, /* attach */ ++ tnc_initiate, /* Start the initial request */ ++ NULL, /* authorization */ ++ tnc_authenticate, /* authentication */ ++ tnc_detach /* detach */ + }; +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c 1970-01-01 01:00:00.000000000 +0100 +@@ -1,146 +0,0 @@ +-/* +- * This software is Copyright (C) 2006,2007 FH Hannover +- * +- * Portions of this code unrelated to FreeRADIUS are available +- * separately under a commercial license. If you require an +- * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or +- * (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA +- * +- */ +-#include <freeradius-devel/ident.h> +-RCSID("$Id$") +- +-#include "tncs_connect.h" +-#include <ltdl.h> +-#include <stdlib.h> +-#include <stdio.h> +-#include <eap.h> +- +- /* +- * FIXME: This linking should really be done at compile time. +- */ +-static lt_dlhandle handle = NULL; +- +-static ExchangeTNCCSMessagePointer callTNCS = NULL; +- +-/* +- * returns the function-pointer to a function of a shared-object +- * +- * soHandle: handle to a shared-object +- * name: name of the requested function +- * +- * return: the procAddress if found, else NULL +- */ +-static void *getProcAddress(lt_dlhandle soHandle, const char *name){ +- void *proc = lt_dlsym(soHandle, name); +- DEBUG("Searching for function %s", name); +- if(proc == NULL){ +- DEBUG("rlm_eap_tnc: Failed to resolve symbol %s: %s", +- name, lt_dlerror()); +- } +- return proc; +-} +- +- +-/* +- * establishs the connection to the TNCCS without calling functionality. +- * That means that the TNCS-shared-object is loaded and the function-pointer +- * to "exchangeTNCCSMessages" is explored. +- * +- * return: -1 if connect failed, 0 if connect was successful +- */ +-int connectToTncs(char *pathToSO){ +- int state = -1; +- if(handle==NULL){ +- handle = lt_dlopen(pathToSO); +- DEBUG("OPENED HANDLE!"); +- } +- +- if(handle==NULL){ +- DEBUG("HANDLE IS NULL"); +- DEBUG("rlm_eap_tnc: Failed to link to library %s: %s", +- pathToSO, lt_dlerror()); +- }else{ +- DEBUG("SO %s found!", pathToSO); +- if(callTNCS==NULL){ +- callTNCS = (ExchangeTNCCSMessagePointer) getProcAddress(handle, "exchangeTNCCSMessages"); +- } +- if(callTNCS!=NULL){ +- DEBUG("TNCS is connected"); +- state = 0; +-// int ret = callTNCS2(2, "Bla", NULL); +- // DEBUG("GOT %d from exchangeTNCCSMessages", ret); +- }else{ +- DEBUG("Could not find exchangeTNCCSMessages"); +- } +- +- } +- return state; +-} +- +-/* +- * Accesspoint to the TNCS for sending and receiving TNCCS-Messages. +- * -pathToSO: Path to TNCCS-Shared Object +- * -connId: identifies the client which the passed message belongs to. +- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant +- * -input: input-TNCCS-message received from the client with connId +- * -inputLength: length of input-TNCCS-message +- * -isFirst: 1 if first message in fragmentation else 0 +- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)? +- * -overallLength: length of all fragments together (only set if fragmentation) +- * -output: answer-TNCCS-message from the TNCS to the client +- * -outputLength: length of answer-TNCCS-message +- * -answerIsFirst: returned answer is first in row +- * -moreFragmentsFollow: more fragments after this answer +- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer +- * +- * return: state of connection as result of the exchange +- */ +-TNC_ConnectionState exchangeTNCCSMessages(/*in*/ char *pathToSO, +- /*in*/ TNC_ConnectionID connId, +- /*in*/ int isAcknoledgement, +- /*in*/ TNC_BufferReference input, +- /*in*/ TNC_UInt32 inputLength, +- /*in*/ int isFirst, +- /*in*/ int moreFragments, +- /*in*/ TNC_UInt32 overallLength, +- /*out*/ TNC_BufferReference *output, +- /*out*/ TNC_UInt32 *outputLength, +- /*out*/ int *answerIsFirst, +- /*out*/ int *moreFragmentsFollow, +- /*out*/ TNC_UInt32 *overallLengthOut){ +- TNC_ConnectionState state = TNC_CONNECTION_STATE_ACCESS_NONE; +- int connectStatus = connectToTncs(pathToSO); +- if(connectStatus!=-1){ +- state = callTNCS(connId, +- isAcknoledgement, +- input, +- inputLength, +- isFirst, +- moreFragments, +- overallLength, +- output, +- outputLength, +- answerIsFirst, +- moreFragmentsFollow, +- overallLengthOut); +- DEBUG("GOT TNC_ConnectionState (juhuuu): %u", (unsigned int) state); +- }else{ +- DEBUG("CAN NOT CONNECT TO TNCS"); +- } +- return state; +-} +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h 1970-01-01 01:00:00.000000000 +0100 +@@ -1,70 +0,0 @@ +-/* +- * This software is Copyright (C) 2006,2007 FH Hannover +- * +- * Portions of this code unrelated to FreeRADIUS are available +- * separately under a commercial license. If you require an +- * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or +- * (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA +- * +- */ +- +-#ifndef _TNCS_CONNECT_H_ +-#define _TNCS_CONNECT_H_ +- +-#include "tncs.h" +- +-/* +- * establishs the connection to the TNCCS without calling functionality. +- * That means that the TNCS-shared-object is loaded and the function-pointer +- * to "exchangeTNCCSMessages" is explored. +- * +- * return: -1 if connect failed, 0 if connect was successful +- */ +-int connectToTncs(char *pathToSO); +-/* +- * Accesspoint to the TNCS for sending and receiving TNCCS-Messages. +- * -pathToSO: Path to TNCCS-Shared Object +- * -connId: identifies the client which the passed message belongs to. +- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant +- * -input: input-TNCCS-message received from the client with connId +- * -inputLength: length of input-TNCCS-message +- * -isFirst: 1 if first message in fragmentation else 0 +- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)? +- * -overallLength: length of all fragments together (only set if fragmentation) +- * -output: answer-TNCCS-message from the TNCS to the client +- * -outputLength: length of answer-TNCCS-message +- * -answerIsFirst: returned answer is first in row +- * -moreFragmentsFollow: more fragments after this answer +- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer +- * +- * return: state of connection as result of the exchange +- */ +-TNC_ConnectionState exchangeTNCCSMessages(/*in*/ char *pathToSO, +- /*in*/ TNC_ConnectionID connId, +- /*in*/ int isAcknoledgement, +- /*in*/ TNC_BufferReference input, +- /*in*/ TNC_UInt32 inputLength, +- /*in*/ int isFirst, +- /*in*/ int moreFragments, +- /*in*/ TNC_UInt32 overallLength, +- /*out*/ TNC_BufferReference *output, +- /*out*/ TNC_UInt32 *outputLength, +- /*out*/ int *answerIsFirst, +- /*out*/ int *moreFragmentsFollow, +- /*out*/ TNC_UInt32 *overallLengthOut); +- +-#endif //_TNCS_CONNECT_H_ +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h 1970-01-01 01:00:00.000000000 +0100 +@@ -1,86 +0,0 @@ +-/* +- * This software is Copyright (C) 2006,2007 FH Hannover +- * +- * Portions of this code unrelated to FreeRADIUS are available +- * separately under a commercial license. If you require an +- * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or +- * (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA +- * +- */ +- +-#ifndef _TNCS_H_ +-#define _TNCS_H_ +- +- +- +-#ifdef __cplusplus +-extern "C" { +-#endif +- +-/* +- * copied from tncimv.h: +- */ +-typedef unsigned long TNC_UInt32; +-typedef TNC_UInt32 TNC_ConnectionState; +-typedef unsigned char *TNC_BufferReference; +-typedef TNC_UInt32 TNC_ConnectionID; +- +-#define TNC_CONNECTION_STATE_CREATE 0 +-#define TNC_CONNECTION_STATE_HANDSHAKE 1 +-#define TNC_CONNECTION_STATE_ACCESS_ALLOWED 2 +-#define TNC_CONNECTION_STATE_ACCESS_ISOLATED 3 +-#define TNC_CONNECTION_STATE_ACCESS_NONE 4 +-#define TNC_CONNECTION_STATE_DELETE 5 +-#define TNC_CONNECTION_EAP_ACKNOWLEDGEMENT 6 +- +-/* +- * Accesspoint (as function-pointer) to the TNCS for sending and receiving +- * TNCCS-Messages. +- * +- * -connId: identifies the client which the passed message belongs to. +- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant +- * -input: input-TNCCS-message received from the client with connId +- * -inputLength: length of input-TNCCS-message +- * -isFirst: 1 if first message in fragmentation else 0 +- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)? +- * -overallLength: length of all fragments together (only set if fragmentation) +- * -output: answer-TNCCS-message from the TNCS to the client +- * -outputLength: length of answer-TNCCS-message +- * -answerIsFirst: returned answer is first in row +- * -moreFragmentsFollow: more fragments after this answer +- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer +- * +- * return: state of connection as result of the exchange +- */ +-typedef TNC_ConnectionState (*ExchangeTNCCSMessagePointer)(/*in*/ TNC_ConnectionID connId, +- /*in*/ int isAcknoledgement, +- /*in*/ TNC_BufferReference input, +- /*in*/ TNC_UInt32 inputLength, +- /*in*/ int isFirst, +- /*in*/ int moreFragments, +- /*in*/ TNC_UInt32 overallLength, +- /*out*/ TNC_BufferReference *output, +- /*out*/ TNC_UInt32 *outputLength, +- /*out*/ int *answerIsFirst, +- /*out*/ int *moreFragmentsFollow, +- /*out*/ TNC_UInt32 *overallLengthOut +-); +- +-#ifdef __cplusplus +-} +-#endif +-#endif //_TNCS_H_ +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h 2012-12-04 19:39:54.749423138 +0100 +@@ -37,6 +37,10 @@ + int copy_request_to_tunnel; + int use_tunneled_reply; + const char *virtual_server; ++ const char *tnc_virtual_server; // virtual server for EAP-TNC as the second inner method ++ VALUE_PAIR *auth_reply; // cache storage of the last reply of the first inner method ++ int auth_code; // cache storage of the reply-code of the first inner method ++ int doing_tnc; // status if we're doing EAP-TNC + } ttls_tunnel_t; + + /* +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c 2012-12-04 19:39:54.749423138 +0100 +@@ -62,6 +62,11 @@ + * Virtual server for inner tunnel session. + */ + char *virtual_server; ++ ++ /* ++ * Virtual server for the second inner tunnel method, which is EAP-TNC. ++ */ ++ char *tnc_virtual_server; + } rlm_eap_ttls_t; + + +@@ -78,6 +83,9 @@ + { "virtual_server", PW_TYPE_STRING_PTR, + offsetof(rlm_eap_ttls_t, virtual_server), NULL, NULL }, + ++ { "tnc_virtual_server", PW_TYPE_STRING_PTR, ++ offsetof(rlm_eap_ttls_t, tnc_virtual_server), NULL, NULL }, ++ + { "include_length", PW_TYPE_BOOLEAN, + offsetof(rlm_eap_ttls_t, include_length), NULL, "yes" }, + +@@ -171,6 +179,10 @@ + t->copy_request_to_tunnel = inst->copy_request_to_tunnel; + t->use_tunneled_reply = inst->use_tunneled_reply; + t->virtual_server = inst->virtual_server; ++ t->tnc_virtual_server = inst->tnc_virtual_server; // virtual server for EAP-TNC as the second inner method ++ t->auth_reply = NULL; // cache storage of the last reply of the first inner method ++ t->auth_code = -1; // cache storage of the reply-code of the first inner method ++ t->doing_tnc = 0; // status if we're doing EAP-TNC (on start we're doing NOT) + return t; + } + +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c 2012-12-04 19:39:54.749423138 +0100 +@@ -585,6 +585,94 @@ + } + + /* ++ * Start EAP-TNC as a second inner method. ++ * Creates a new fake-request out of the original incoming request (via EAP_HANDLER). ++ * If it's the first time, we create a EAP-START-packet and send ++ * EAP-START := code = PW_EAP_REQUEST ++ * ++ */ ++static REQUEST* start_tnc(EAP_HANDLER *handler, ttls_tunnel_t *t) { ++ REQUEST* request = handler->request; ++ RDEBUG2("EAP-TNC as second inner authentication method starts now"); ++ ++ /* ++ * Allocate a fake REQUEST struct, ++ * to make a new request, based on the original request. ++ */ ++ REQUEST* fake = request_alloc_fake(request); ++ ++ /* ++ * Set the virtual server to that of EAP-TNC. ++ */ ++ fake->server = t->tnc_virtual_server; ++ ++ /* ++ * Build a new EAP-Message. ++ */ ++ VALUE_PAIR *eap_msg; ++ eap_msg = paircreate(PW_EAP_MESSAGE, PW_TYPE_OCTETS); ++ ++ /* ++ * Set the EAP-Message to look like EAP-Start ++ */ ++ eap_msg->vp_octets[0] = PW_EAP_RESPONSE; ++ eap_msg->vp_octets[1] = 0x00; ++ ++ /* ++ * Only setting EAP-TNC here, ++ * because it is intended to do user-authentication in the first inner method, ++ * and then a hardware-authentication (like EAP-TNC) as the second method. ++ */ ++ eap_msg->vp_octets[4] = PW_EAP_TNC; ++ ++ eap_msg->length = 0; ++ ++ /* ++ * Add the EAP-Message to the request. ++ */ ++ pairadd(&(fake->packet->vps), eap_msg); ++ ++ /* ++ * Process the new request by the virtual server configured for ++ * EAP-TNC. ++ */ ++ rad_authenticate(fake); ++ ++ /* ++ * From now on we're doing EAP-TNC as the second inner authentication method. ++ */ ++ t->doing_tnc = TRUE; ++ ++ return fake; ++} ++ ++/* ++ * Stop EAP-TNC as a second inner method. ++ * Copy the value pairs from the cached Access-Accept of the first inner method ++ * to the Access-Accept/Reject package of EAP-TNC. ++ */ ++static REQUEST* stop_tnc(REQUEST *request, ttls_tunnel_t *t) { ++ RDEBUG2("EAP-TNC as second inner authentication method stops now"); ++ ++ /* ++ * Copy the value-pairs of the origina Access-Accept of the first ++ * inner authentication method to the Access-Accept/Reject of the ++ * second inner authentication method (EAP-TNC). ++ */ ++ if (request->reply->code == PW_AUTHENTICATION_ACK) { ++ pairadd(&(request->reply->vps), t->auth_reply); ++ } else if (request->reply->code == PW_AUTHENTICATION_REJECT) { ++ pairadd(&(request->reply->vps), t->auth_reply); ++ } ++ ++ pairdelete(&(request->reply->vps), PW_MESSAGE_AUTHENTICATOR); ++ pairdelete(&(request->reply->vps), PW_PROXY_STATE); ++ pairdelete(&(request->reply->vps), PW_USER_NAME); ++ ++ return request; ++} ++ ++/* + * Use a reply packet to determine what to do. + */ + static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session, +@@ -1135,6 +1223,16 @@ + + } /* else fake->server == request->server */ + ++ /* ++ * If we're doing EAP-TNC as a second method, ++ * then set the server to that one. ++ * Then, rad_authenticate will run EAP-TNC, ++ * so that afterwards we have to look for the state of ++ * EAP-TNC. ++ */ ++ if (t->doing_tnc) { ++ fake->server = t->tnc_virtual_server; ++ } + + if ((debug_flag > 0) && fr_log_fp) { + RDEBUG("Sending tunneled request"); +@@ -1248,6 +1346,53 @@ + + default: + /* ++ * If the result of the first method was an acknowledgment OR ++ * if were already running EAP-TNC, ++ * we're doing additional things before processing the reply. ++ * Also the configuration for EAP-TTLS has to contain a virtual server ++ * for EAP-TNC as the second method. ++ */ ++ if (t->tnc_virtual_server) { ++ /* ++ * If the reply code of the first inner method is PW_AUTHENTICATION_ACK ++ * which means that the method was successful, ++ * and we're not doing EAP-TNC as the second method, ++ * then we want to intercept the Access-Accept and start EAP-TNC as the second inner method. ++ */ ++ if (fake->reply->code == PW_AUTHENTICATION_ACK ++ && t->doing_tnc == FALSE) { ++ RDEBUG2("Reply-Code of the first inner method was: %d (PW_AUTHENTICATION_ACK)", fake->reply->code); ++ ++ /* ++ * Save reply-value pairs and reply-code of the first method. ++ */ ++ t->auth_reply = fake->reply->vps; ++ fake->reply->vps = NULL; ++ t->auth_code = fake->reply->code; ++ ++ /* ++ * Create the start package for EAP-TNC. ++ */ ++ fake = start_tnc(handler, t); ++ ++ /* ++ * If we're doing EAP-TNC as the second inner method, ++ * and the reply->code was PW_AUTHENTICATION_ACK or PW_AUTHENTICATION_REJECT, ++ * then we stop EAP-TNC and create an combined Access-Accept or Access-Reject. ++ */ ++ } else if (t->doing_tnc == TRUE ++ && (fake->reply->code == PW_AUTHENTICATION_ACK || fake->reply->code == PW_AUTHENTICATION_REJECT)) { ++ ++ /* ++ * Create the combined Access-Accept or -Reject. ++ */ ++ RDEBUG2("Reply-Code of EAP-TNC as the second inner method was: %d (%s)", fake->reply->code, ++ fake->reply->code == PW_AUTHENTICATION_ACK ? "PW_AUTHENTICATION_ACK" : "PW_AUTHENTICATION_REJECT"); ++ fake = stop_tnc(fake, t); ++ } ++ } ++ ++ /* + * Returns RLM_MODULE_FOO, and we want to return + * PW_FOO + */ diff --git a/testing/scripts/recipes/patches/iptables-xfrm-hooks b/testing/scripts/recipes/patches/iptables-xfrm-hooks new file mode 100644 index 000000000..baa4a65c1 --- /dev/null +++ b/testing/scripts/recipes/patches/iptables-xfrm-hooks @@ -0,0 +1,61 @@ +From 4553ba0130bb9f0aa266cc1e4c3288a52f34eed6 Mon Sep 17 00:00:00 2001 +From: Martin Willi <martin@revosec.ch> +Date: Wed, 7 Apr 2010 11:40:15 +0200 +Subject: [PATCH] Added XFRM hooks to iptables headers + +--- + include/linux/netfilter.h | 2 ++ + include/linux/netfilter_ipv4.h | 6 +++++- + include/linux/netfilter_ipv6.h | 6 +++++- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h +index 2eb00b6..b692c67 100644 +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -35,6 +35,8 @@ enum nf_inet_hooks { + NF_INET_FORWARD, + NF_INET_LOCAL_OUT, + NF_INET_POST_ROUTING, ++ NF_INET_XFRM_IN, ++ NF_INET_XFRM_OUT, + NF_INET_NUMHOOKS + }; + +diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h +index 4d7ba3e..28d3ca9 100644 +--- a/include/linux/netfilter_ipv4.h ++++ b/include/linux/netfilter_ipv4.h +@@ -47,7 +47,11 @@ + #define NF_IP_LOCAL_OUT 3 + /* Packets about to hit the wire. */ + #define NF_IP_POST_ROUTING 4 +-#define NF_IP_NUMHOOKS 5 ++/* Packets going into XFRM input transformation. */ ++#define NF_IP_XFRM_IN 5 ++/* Packets going into XFRM output transformation. */ ++#define NF_IP_XFRM_OUT 6 ++#define NF_IP_NUMHOOKS 7 + + enum nf_ip_hook_priorities { + NF_IP_PRI_FIRST = INT_MIN, +diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h +index 7430b39..18590a5 100644 +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -51,7 +51,11 @@ + #define NF_IP6_LOCAL_OUT 3 + /* Packets about to hit the wire. */ + #define NF_IP6_POST_ROUTING 4 +-#define NF_IP6_NUMHOOKS 5 ++/* Packets going into XFRM input transformation. */ ++#define NF_IP6_XFRM_IN 5 ++/* Packets going into XFRM output transformation. */ ++#define NF_IP6_XFRM_OUT 6 ++#define NF_IP6_NUMHOOKS 7 + + + enum nf_ip6_hook_priorities { +-- +1.6.3.3 + diff --git a/testing/scripts/restore-defaults b/testing/scripts/restore-defaults index 64cc0262e..953548a1b 100755 --- a/testing/scripts/restore-defaults +++ b/testing/scripts/restore-defaults @@ -14,32 +14,20 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -########################################################################## -# load-testconfig requires a testname as an argument -# +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh testname=$1 -HOSTCONFIGDIR=$BUILDDIR/hosts +HOSTCONFIGDIR=$DIR/../hosts TESTSDIR=$BUILDDIR/tests [ -d $TESTSDIR ] || die "Directory '$TESTSDIR' not found" [ -d $TESTSDIR/$testname ] || die "Test '$testname' not found" [ -f $TESTSDIR/$testname/test.conf ] || die "File 'test.conf' is missing" -source $TESTSDIR/$testname/test.conf - -########################################################################## -# copy default host config back if necessary -# +. $TESTSDIR/$testname/test.conf if [ -d $TESTSDIR/${testname}/hosts ] then @@ -47,5 +35,6 @@ then do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" scp $SSHCONF -r $HOSTCONFIGDIR/${host}/etc $HOSTLOGIN:/ > /dev/null 2>&1 + scp $SSHCONF -r $HOSTCONFIGDIR/default/etc $HOSTLOGIN:/ > /dev/null 2>&1 done fi diff --git a/testing/scripts/shutdown-umls b/testing/scripts/shutdown-umls deleted file mode 100755 index e71e46602..000000000 --- a/testing/scripts/shutdown-umls +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash -# Install strongSwan from mounted strongswan-shared tree -# -# Copyright (C) 2006 Martin Willi -# Hochschule fuer Technik Rapperswil -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -# - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -cecho "shutting down" -cecho-n " " - -for host in $STRONGSWANHOSTS -do - eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - cecho-n "$host... " - ssh $HOSTLOGIN 'shutdown now -h' > /dev/null -done - -cecho diff --git a/testing/scripts/start-bridges b/testing/scripts/start-bridges deleted file mode 100755 index 1e09d6e7d..000000000 --- a/testing/scripts/start-bridges +++ /dev/null @@ -1,64 +0,0 @@ -#!/bin/bash -# start the UML bridges in the kernel using the brctl command -# -# Copyright (C) 2009 Andreas Steffen -# HSR Hochschule fuer Technik Rapperswil -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -# create umlbr1 and its taps -# -if [ `brctl show | grep umlbr1 | wc -l` -eq 1 ] -then - cecho " * Great, umlbr1 is already running!" -else - cecho-n " * Starting umlbr1 with taps.." - umlbr_add 1 10.1.0.254 255.255.0.0 - umlbr_add_tap 1 alice - umlbr_add_tap 1 venus - umlbr_add_tap 1 moon - cgecho "done" -fi - -# create umlbr0 and its taps -# -if [ `brctl show | grep umlbr0 | wc -l` -eq 1 ] -then - cecho " * Great, umlbr0 is already running!" -else - cecho-n " * Starting umlbr0 with taps.." - umlbr_add 0 192.168.0.254 255.255.255.0 - umlbr_add_tap 0 alice - umlbr_add_tap 0 moon - umlbr_add_tap 0 carol - umlbr_add_tap 0 winnetou - umlbr_add_tap 0 dave - umlbr_add_tap 0 sun - cgecho "done" -fi - -# create umlbr2 and its taps -# -if [ `brctl show | grep umlbr2 | wc -l` -eq 1 ] -then - cecho " * Great, umlbr2 is already running!" -else - cecho-n " * Starting umlbr2 with taps.." - umlbr_add 2 10.2.0.254 255.255.0.0 - umlbr_add_tap 2 sun - umlbr_add_tap 2 bob - cgecho "done" -fi - diff --git a/testing/scripts/start-umls b/testing/scripts/start-umls deleted file mode 100755 index 878494370..000000000 --- a/testing/scripts/start-umls +++ /dev/null @@ -1,117 +0,0 @@ -#!/bin/bash -# starts the UML instances with a hidden screen -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval screen -dmS ${host} "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" - cgecho "done" - fi -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/scripts/stop-bridges b/testing/scripts/stop-bridges deleted file mode 100755 index eb92bd0eb..000000000 --- a/testing/scripts/stop-bridges +++ /dev/null @@ -1,49 +0,0 @@ -#!/bin/bash -# stop the UML bridges in the kernel using the brctl command -# -# Copyright (C) 2009 Andreas Steffen -# HSR Hochschule fuer Technik Rapperswil -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -# stop umlbr1 and its taps -# -cecho-n " * Stopping umlbr1 with taps.." -umlbr_del_tap 1 alice -umlbr_del_tap 1 venus -umlbr_del_tap 1 moon -umlbr_del 1 -cgecho "done" - -# stop umlbr0 and its taps -# -cecho-n " * Stopping umlbr0 with taps.." -umlbr_del_tap 0 alice -umlbr_del_tap 0 moon -umlbr_del_tap 0 carol -umlbr_del_tap 0 winnetou -umlbr_del_tap 0 dave -umlbr_del_tap 0 sun -umlbr_del 0 -cgecho "done" - -# stop umlbr2 and its taps -# -cecho-n " * Stopping umlbr2 with taps.." -umlbr_del_tap 2 sun -umlbr_del_tap 2 bob -umlbr_del 2 -cgecho "done" - diff --git a/testing/scripts/xstart-umls b/testing/scripts/xstart-umls deleted file mode 100755 index ed2662b6c..000000000 --- a/testing/scripts/xstart-umls +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# starts the UML instances in an xterm (requires X11R6) -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -#position of xterm window on the desktop -x0=8 -y0=8 -dx=12 -dy=24 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval xterm -title ${host} -geometry "+${x0}+${y0}" -rightbar -sb -sl 500 -e "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" & - cgecho "done" - sleep 15 - fi - let "x0+=dx" - let "y0+=dy" -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/ssh_config b/testing/ssh_config index 36569c07c..831b9dc1a 100644 --- a/testing/ssh_config +++ b/testing/ssh_config @@ -1,7 +1,8 @@ Host * # debian default SendEnv LANG LC_* - HashKnownHosts yes + StrictHostKeyChecking no + UserKnownHostsFile /dev/null GSSAPIAuthentication yes # faster encryption Ciphers arcfour diff --git a/testing/start-testing b/testing/start-testing index 278500e6f..183729423 100755 --- a/testing/start-testing +++ b/testing/start-testing @@ -1,85 +1,48 @@ #!/bin/bash -# Start up the specified UML instances and wait for them to finish booting -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/scripts/function.sh - -[ -f $DIR/testing.conf ] || die "!! Configuration file 'testing.conf' not found" -[ -d $DIR/hosts ] || die "Directory hosts cannot be found." - -source $DIR/testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -##################################################### -# start the uml bridges -# -cecho "Start the uml bridges (scripts/start-bridges)" -$DIR/scripts/start-bridges - - -##################################################### -# start the uml instances -# -case $UMLSTARTMODE in - konsole) - cecho "Start the uml instances (scripts/kstart-umls)" - $DIR/scripts/kstart-umls $HOSTS - ;; - gnome-terminal) - cecho "Start the uml instances (scripts/gstart-umls)" - $DIR/scripts/gstart-umls $HOSTS - ;; - xterm) - cecho "Start the uml instances (scripts/xstart-umls)" - $DIR/scripts/xstart-umls $HOSTS - ;; - screen) - cecho "Start the uml instances (scripts/start-umls)" - $DIR/scripts/start-umls $HOSTS - ;; - *) - die "The start mode is unknown! Please set $UMLSTARTMODE properly." - ;; -esac - - -##################################################### -# do the automated testing -# -if [ $ENABLE_DO_TESTS = "yes" ] -then - cecho "Run the automated tests (do-tests)" - $DIR/do-tests -fi - - -############################################################################## -# stop all UML instances and switches -# - -if [ $ENABLE_STOP_TESTING = "yes" ] -then - cecho "Stopping all UML instances and switches (stop-testing)" - $DIR/stop-testing $HOSTS -fi +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf +. $DIR/scripts/function.sh + +NETWORKS="vnet1 vnet2 vnet3" +CONFDIR=$DIR/config/kvm +KNLSRC=$BUILDDIR/$KERNEL/arch/x86/boot/bzImage +KNLTARGET=/var/run/kvm-swan-kernel +HOSTFSTARGET=/var/run/kvm-swan-hostfs +MCASTBRS="virbr1 virbr2" + +echo "Starting test environment" + +[ `id -u` -eq 0 ] || die "You must be root to run $0" + +check_commands virsh + +log_action "Deploying kernel $KERNEL" +execute "ln -fs $KNLSRC $KNLTARGET" + +log_action "Deploying $SHAREDDIR as hostfs" +execute "chown -R $KVMUSER:$KVMGROUP $SHAREDDIR" 0 +execute "ln -Tfs $SHAREDDIR $HOSTFSTARGET" + +for net in $NETWORKS +do + log_action "Network $net" + execute "virsh net-create $CONFDIR/$net.xml" +done + +for host in $STRONGSWANHOSTS +do + ln -fs $IMGDIR/$host.$IMGEXT $VIRTIMGSTORE/$host.$IMGEXT + log_action "Guest $host" + execute "virsh create $CONFDIR/$host.xml" +done + +# Enforce reception of multicast traffic on bridges +for br in $MCASTBRS +do + cd /sys/devices/virtual/net/$br/brif + for vnet in `find . -name "vnet*"` + do + echo 2 > $vnet/multicast_router + done +done diff --git a/testing/stop-testing b/testing/stop-testing index 023a5b39e..704ae6667 100755 --- a/testing/stop-testing +++ b/testing/stop-testing @@ -1,48 +1,34 @@ #!/bin/bash -# Stop all UML instances and UML switches -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/scripts/function.sh - -[ -f $DIR/testing.conf ] || die "No configuration file testing.conf found." - -source $DIR/testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -##################################################### -# Shutting down the uml instances -# -cecho-n " * Halting all UML instances.." -for host in $HOSTS + +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf +. $DIR/scripts/function.sh + +echo "Stopping test environment" + +NETWORKS="vnet1 vnet2 vnet3" +KNLTARGET=/var/run/kvm-swan-kernel +HOSTFSTARGET=/var/run/kvm-swan-hostfs + +[ `id -u` -eq 0 ] || die "You must be root to run $0" + +check_commands virsh + +for net in $NETWORKS do - uml_mconsole $host halt &> /dev/null + log_action "Network $net" + execute "virsh net-destroy $net" done -cgecho "done" -##################################################### -# Shutting down the uml bridhges -# -cecho "Stop the uml bridges (scripts/stop-bridges)" -$DIR/scripts/stop-bridges +for host in $STRONGSWANHOSTS +do + log_action "Guest $host" + execute "virsh shutdown $host" + rm -f $VIRTIMGSTORE/$host.$IMGEXT +done +log_action "Removing kernel $KERNEL" +execute "rm $KNLTARGET" +log_action "Removing link to hostfs" +execute "rm $HOSTFSTARGET" diff --git a/testing/testing.conf b/testing/testing.conf index d0c918860..960d3f63e 100755..100644 --- a/testing/testing.conf +++ b/testing/testing.conf @@ -1,5 +1,5 @@ #!/bin/bash -# Global configuration file for strongswan UML testing. +# Global configuration file for strongswan integration testing. # # Copyright (C) 2004 Eric Marchionni, Patrik Rayo # Zuercher Hochschule Winterthur @@ -15,146 +15,66 @@ # for more details. # Root directory of testing -UMLTESTDIR=~/strongswan-testing - -# Bzipped kernel sources -# (file extension .tar.bz2 required) -KERNEL=$UMLTESTDIR/linux-3.5.3.tar.bz2 - -# Extract kernel version -KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'` - -# Kernel configuration file -KERNELCONFIG=$UMLTESTDIR/.config-3.5 - - -# Bzipped uml patch for kernel -UMLPATCH=$UMLTESTDIR/ha-3.0.patch.bz2 - -# Bzipped source of strongSwan -STRONGSWAN=$UMLTESTDIR/strongswan-5.0.1.tar.bz2 - -# strongSwan compile options (use "yes" or "no") -USE_LIBCURL="yes" -USE_LDAP="yes" -USE_EAP_AKA="yes" -USE_EAP_SIM="yes" -USE_EAP_MD5="yes" -USE_EAP_MSCHAPV2="yes" -USE_EAP_IDENTITY="yes" -USE_EAP_RADIUS="yes" -USE_EAP_DYNAMIC="yes" -USE_EAP_TLS="yes" -USE_EAP_TTLS="yes" -USE_EAP_PEAP="yes" -USE_EAP_TNC="yes" -USE_TNC_PDP="yes" -USE_TNC_IMC="yes" -USE_TNC_IMV="yes" -USE_TNCCS_11="yes" -USE_TNCCS_20="yes" -USE_TNCCS_DYNAMIC="yes" -USE_IMC_TEST="yes" -USE_IMV_TEST="yes" -USE_IMC_SCANNER="yes" -USE_IMV_SCANNER="yes" -USE_IMC_ATTESTATION="yes" -USE_IMV_ATTESTATION="yes" -USE_SQL="yes" -USE_MEDIATION="yes" -USE_OPENSSL="yes" -USE_BLOWFISH="yes" -USE_KERNEL_PFKEY="yes" -USE_INTEGRITY_TEST="yes" -USE_LEAK_DETECTIVE="yes" -USE_LOAD_TESTER="yes" -USE_TEST_VECTORS="yes" -USE_GCRYPT="yes" -USE_SOCKET_DEFAULT="yes" -USE_SOCKET_DYNAMIC="yes" -USE_DHCP="yes" -USE_FARP="yes" -USE_ADDRBLOCK="yes" -USE_CTR="yes" -USE_CCM="yes" -USE_GCM="yes" -USE_CMAC="yes" -USE_HA="yes" -USE_AF_ALG="yes" -USE_WHITELIST="yes" -USE_XAUTH_GENERIC="yes" -USE_XAUTH_EAP="yes" -USE_PKCS8="yes" -USE_IFMAP="no" -USE_CISCO_QUIRKS="no" -USE_UNITY="yes" - -# Gentoo linux root filesystem -ROOTFS=$UMLTESTDIR/gentoo-fs-20111212.tar.bz2 - -# Size of the finished root filesystem in MB -ROOTFSSIZE=850 - -# Amount of Memory to use per UML [MB]. -# If "auto" is stated 1/12 of total host ram will be used. -# Examples: MEM=64, MEM="128", MEM="auto" -MEM=96 - -# Directory where the UML kernels and file system will be built -BUILDDIR=$UMLTESTDIR/umlbuild - -# Filename of the built UML Kernel -UMLKERNEL=$BUILDDIR/linux-uml-$KERNELVERSION +TESTDIR=/srv/strongswan-testing + +# Kernel configuration +KERNELVERSION=3.5.3 +KERNEL=linux-$KERNELVERSION +KERNELTARBALL=$KERNEL.tar.bz2 +KERNELCONFIG=$DIR/../config/kernel/config-3.5 +KERNELPATCH=ha-3.0.patch.bz2 + +# strongSwan version used in tests +SWANVERSION=5.0.2dr4 + +# Build directory where the guest kernel and images will be built +BUILDDIR=$TESTDIR/build +# Directory shared between host and guests +SHAREDDIR=$BUILDDIR/shared + +# Logfile +LOGFILE=$BUILDDIR/testing.log + +# Directory used for loop-mounts +LOOPDIR=$BUILDDIR/loop + +# Common image settings +IMGEXT=qcow2 +IMGDIR=$BUILDDIR/images + +# Base image settings +# The base image is a pristine OS installation created using debootstrap. +BASEIMGSIZE=1024 +BASEIMGSUITE=wheezy +BASEIMGARCH=amd64 +BASEIMG=$IMGDIR/debian-$BASEIMGSUITE-$BASEIMGARCH.$IMGEXT +BASEIMGMIRROR=http://cdn.debian.net/debian + +# Root image settings +# The root image is the origin of all guest images. It is a clone of the base +# image and contains additional test-specific software and patches. +ROOTIMG=$IMGDIR/root.$IMGEXT + +# libvirt config +NBDEV=/dev/nbd0 +NBDPARTITION=${NBDEV}p1 +VIRTIMGSTORE=/var/lib/libvirt/images +KVMUSER=libvirt-qemu +KVMGROUP=kvm # Directory where test results will be stored -TESTRESULTSDIR=$UMLTESTDIR/testresults +TESTRESULTSDIR=$TESTDIR/testresults # SSH configuration (speedup SSH) -SSHCONF="-F $UMLTESTDIR/testing/ssh_config" - -# Path to a full strongswan tree on the host system, which is -# mounted into /root/strongswan-shared. This gives us an easy -# way to apply and test changes instantly. -#SHAREDTREE=/home/martin/strongswan/trunk - -# Timezone for the UMLs, look in /usr/share/zoneinfo! -TZUML="Europe/Zurich" - -############################################################## -# Enable particular steps in the make-testing and -# start-testing scripts -# -ENABLE_BUILD_UMLKERNEL="yes" -ENABLE_BUILD_SSHKEYS="yes" -ENABLE_BUILD_HOSTCONFIG="yes" -ENABLE_BUILD_UMLROOTFS="yes" -ENABLE_BUILD_UMLHOSTFS="yes" -ENABLE_START_TESTING="yes" -ENABLE_DO_TESTS="no" -ENABLE_STOP_TESTING="no" +SSHCONF="-F $TESTDIR/testing/ssh_config" ############################################################## -# How to start the UMLs? -# -# Start the UML instance in KDE konsole (requires KDE) -# UMLSTARTMODE="konsole" -# Start the UML instance in a gnome-terminal (requires gnome) -UMLSTARTMODE="gnome-terminal" -# Start the UML instance in an xterm (requires X11R6) -# UMLSTARTMODE="xterm" -# Start the UML instance without a terminal window -# but screen -r <host> can open a window anytime -# UMLSTARTMODE="screen" - -############################################################## -# If set to "yes" only the tests stated at $SELECTEDTESTS -# will be executed. (use "yes" or "no") -# -SELECTEDTESTSONLY="no" - -# Tests to do if $SELECTEDTESTSONLY is set "yes". +# Enable particular steps in the make-testing # -SELECTEDTESTS="ikev2/rw-cert" +ENABLE_BUILD_BASEIMAGE="yes" +ENABLE_BUILD_ROOTIMAGE="yes" +ENABLE_BUILD_GUESTKERNEL="yes" +ENABLE_BUILD_GUESTIMAGES="yes" ############################################################## # hostname and corresponding IPv4 and IPv6 addresses @@ -186,35 +106,5 @@ bob,fec2::10" # VPN gateways / clients # The hosts stated here will be created. Possible values # are sun, moon, dave, carol, alice, venus, bob, winnetou. -# It's fine to make them all unless you don't have much -# resources. In this case we assume you know what you do! -# -STRONGSWANHOSTS="sun moon dave carol alice venus bob winnetou" - -############################################################## -# Needed programs, do not change! -# -PROGRAMS="uml_switch uml_mconsole ssh ssh-keygen iptables \ - chroot screen mkreiserfs" - -############################################################## -# IP parameters of the UML switches -# -IFCONFIG_0="192.168.0.254 netmask 255.255.255.0" -IFCONFIG_1="10.1.0.254 netmask 255.255.0.0" -IFCONFIG_2="10.2.0.254 netmask 255.255.0.0" - -############################################################## -# Network interfaces of the UML instances # -SWITCH_alice="eth0=tuntap,tap1_alice,fe:fd:0a:01:00:0a \ - eth1=tuntap,tap0_alice,fe:fd:c0:a8:00:32" -SWITCH_venus="eth0=tuntap,tap1_venus,fe:fd:0a:01:00:14" -SWITCH_moon="eth0=tuntap,tap0_moon,fe:fd:c0:a8:00:01 \ - eth1=tuntap,tap1_moon,fe:fd:0a:01:00:01" -SWITCH_carol="eth0=tuntap,tap0_carol,fe:fd:c0:a8:00:64" -SWITCH_winnetou="eth0=tuntap,tap0_winnetou,fe:fd:c0:a8:00:96" -SWITCH_dave="eth0=tuntap,tap0_dave,fe:fd:c0:a8:00:c8" -SWITCH_sun="eth0=tuntap,tap0_sun,fe:fd:c0:a8:00:02 \ - eth1=tuntap,tap2_sun,fe:fd:0a:02:00:01" -SWITCH_bob="eth0=tuntap,tap2_bob,fe:fd:0a:02:00:0a" +STRONGSWANHOSTS="alice bob carol dave moon sun venus winnetou" diff --git a/testing/tests/af-alg/alg-camellia/evaltest.dat b/testing/tests/af-alg/alg-camellia/evaltest.dat index 72e3c5e29..2096cb994 100644 --- a/testing/tests/af-alg/alg-camellia/evaltest.dat +++ b/testing/tests/af-alg/alg-camellia/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/af-alg/alg-camellia/posttest.dat b/testing/tests/af-alg/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/af-alg/alg-camellia/posttest.dat +++ b/testing/tests/af-alg/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/alg-camellia/pretest.dat b/testing/tests/af-alg/alg-camellia/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/af-alg/alg-camellia/pretest.dat +++ b/testing/tests/af-alg/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/af-alg/alg-camellia/test.conf b/testing/tests/af-alg/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/af-alg/alg-camellia/test.conf +++ b/testing/tests/af-alg/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/af-alg/rw-cert/evaltest.dat b/testing/tests/af-alg/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/af-alg/rw-cert/evaltest.dat +++ b/testing/tests/af-alg/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/af-alg/rw-cert/posttest.dat b/testing/tests/af-alg/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/af-alg/rw-cert/posttest.dat +++ b/testing/tests/af-alg/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/rw-cert/pretest.dat b/testing/tests/af-alg/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/af-alg/rw-cert/pretest.dat +++ b/testing/tests/af-alg/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/af-alg/rw-cert/test.conf b/testing/tests/af-alg/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/af-alg/rw-cert/test.conf +++ b/testing/tests/af-alg/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat b/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat index 81e413f98..db5a76204 100644 --- a/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat +++ b/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat @@ -4,7 +4,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES moon:: ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES carol::ip xfrm state::enc cbc(serpent)::YES diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat b/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat index 6d2eeb5f9..1b8fc3b79 100644 --- a/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat +++ b/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/test.conf b/testing/tests/gcrypt-ikev1/alg-serpent/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/gcrypt-ikev1/alg-serpent/test.conf +++ b/testing/tests/gcrypt-ikev1/alg-serpent/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat index 7003977f9..ac3b5e0b0 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat +++ b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat @@ -4,7 +4,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES moon:: ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES carol::ip xfrm state::enc cbc(twofish)::YES diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat index 6d2eeb5f9..1b8fc3b79 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat +++ b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/test.conf b/testing/tests/gcrypt-ikev1/alg-twofish/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/test.conf +++ b/testing/tests/gcrypt-ikev1/alg-twofish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat index d82b68dcb..5f0bb3cdc 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat +++ b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat @@ -4,7 +4,7 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat +++ b/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat +++ b/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/test.conf b/testing/tests/gcrypt-ikev2/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/test.conf +++ b/testing/tests/gcrypt-ikev2/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat b/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat +++ b/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat b/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat +++ b/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat b/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat +++ b/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/gcrypt-ikev2/rw-cert/test.conf b/testing/tests/gcrypt-ikev2/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/test.conf +++ b/testing/tests/gcrypt-ikev2/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ha/both-active/evaltest.dat b/testing/tests/ha/both-active/evaltest.dat index 36d72ff97..89e5f4b6e 100644 --- a/testing/tests/ha/both-active/evaltest.dat +++ b/testing/tests/ha/both-active/evaltest.dat @@ -8,8 +8,8 @@ alice::cat /var/log/daemon.log::HA segment 1 activated::YES moon:: cat /var/log/daemon.log::HA segment 2 activated::YES alice::cat /var/log/daemon.log::handling HA CHILD_SA::YES moon:: cat /var/log/daemon.log::installed HA CHILD_SA::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES carol::tcpdump::IP carol.strongswan.org > mars.strongswan.org: ESP::YES carol::tcpdump::IP mars.strongswan.org > carol.strongswan.org: ESP::YES dave::tcpdump::IP dave.strongswan.org > mars.strongswan.org: ESP::YES diff --git a/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables b/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 95d3b8828..000000000 --- a/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # forward ESP-tunneled traffic - iptables -A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT - iptables -A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT - iptables -A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # clusterip rules - iptables -A INPUT -i eth1 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 2 - iptables -A INPUT -i eth0 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 2 - - # allow esp - iptables -A INPUT -p 50 -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow heartbeat - iptables -A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT - iptables -A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT - - # allow ICMP type 3 - iptables -A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT - iptables -A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT - - # allow IGMP multicasts - iptables -A INPUT -d 224.0.0.1 -p igmp -j ACCEPT - iptables -A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules b/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..cad1d202a --- /dev/null +++ b/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules @@ -0,0 +1,50 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# forward ESP-tunneled traffic +-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT +-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT +-A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# clusterip rules +-A INPUT -i eth1 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 2 +-A INPUT -i eth0 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 2 + +# allow esp +-A INPUT -p 50 -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT + +# allow IKE +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow heartbeat +-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT +-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT + +# allow ICMP type 3 +-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT +-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT + +# allow IGMP multicasts +-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT +-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT diff --git a/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables b/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 6f7a0316b..000000000 --- a/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # forward ESP-tunneled traffic - iptables -A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT - iptables -A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT - iptables -A FORWARD -m policy -o eth0 --dir out --pol ipsec --proto esp -j ACCEPT - - # clusterip rules - iptables -A INPUT -i eth0 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 1 - iptables -A INPUT -i eth1 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 1 - - # allow esp - iptables -A INPUT -p 50 -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow heartbeat - iptables -A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT - iptables -A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT - - # allow ICMP type 3 - iptables -A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT - iptables -A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT - - # allow IGMP multicasts - iptables -A INPUT -d 224.0.0.1 -p igmp -j ACCEPT - iptables -A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules b/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..ab7fd7fcb --- /dev/null +++ b/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules @@ -0,0 +1,50 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# forward ESP-tunneled traffic +-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT +-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT +-A FORWARD -m policy -o eth0 --dir out --pol ipsec --proto esp -j ACCEPT + +# clusterip rules +-A INPUT -i eth0 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 1 +-A INPUT -i eth1 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 1 + +# allow esp +-A INPUT -p 50 -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow heartbeat +-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT +-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT + +# allow ICMP type 3 +-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT +-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT + +# allow IGMP multicasts +-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT +-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT diff --git a/testing/tests/ha/both-active/posttest.dat b/testing/tests/ha/both-active/posttest.dat index 49bf76055..e4ffe8eef 100644 --- a/testing/tests/ha/both-active/posttest.dat +++ b/testing/tests/ha/both-active/posttest.dat @@ -2,15 +2,15 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop alice::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -alice::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +alice::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ip addr del 192.168.0.5/24 dev eth0 moon::ip addr del 10.1.0.5/16 dev eth1 alice::ip addr del 192.168.0.5/24 dev eth1 alice::ip addr del 10.1.0.5/16 dev eth0 -alice::/etc/init.d/net.eth1 stop +alice::ifdown eth1 venus::ip route del default via 10.1.0.5 dev eth0 venus::ip route add default via 10.1.0.1 dev eth0 moon::conntrack -F diff --git a/testing/tests/ha/both-active/pretest.dat b/testing/tests/ha/both-active/pretest.dat index e2e509855..af4d66cfc 100644 --- a/testing/tests/ha/both-active/pretest.dat +++ b/testing/tests/ha/both-active/pretest.dat @@ -1,14 +1,14 @@ moon::ip addr add 192.168.0.5/24 dev eth0 moon::ip addr add 10.1.0.5/16 dev eth1 -alice::/etc/init.d/net.eth1 start +alice::ifup eth1 alice::ip addr add 192.168.0.5/24 dev eth1 alice::ip addr add 10.1.0.5/16 dev eth0 venus::ip route del default via 10.1.0.1 dev eth0 venus::ip route add default via 10.1.0.5 dev eth0 -moon::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start alice::ipsec start carol::ipsec start diff --git a/testing/tests/ha/both-active/test.conf b/testing/tests/ha/both-active/test.conf index 0473013e1..8056d9ce4 100644 --- a/testing/tests/ha/both-active/test.conf +++ b/testing/tests/ha/both-active/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="venus carol dave" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon carol dave" diff --git a/testing/tests/ike/rw-cert/evaltest.dat b/testing/tests/ike/rw-cert/evaltest.dat index c8fcb2370..e431ce533 100644 --- a/testing/tests/ike/rw-cert/evaltest.dat +++ b/testing/tests/ike/rw-cert/evaltest.dat @@ -10,8 +10,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ike/rw-cert/pretest.dat b/testing/tests/ike/rw-cert/pretest.dat index 587b6aeed..e50793830 100644 --- a/testing/tests/ike/rw-cert/pretest.dat +++ b/testing/tests/ike/rw-cert/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ike/rw-cert/test.conf b/testing/tests/ike/rw-cert/test.conf index 845a6dcd7..51bf2b7f2 100644 --- a/testing/tests/ike/rw-cert/test.conf +++ b/testing/tests/ike/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ike/rw_v1-net_v2/evaltest.dat b/testing/tests/ike/rw_v1-net_v2/evaltest.dat index f12b19e3d..847a2d92d 100644 --- a/testing/tests/ike/rw_v1-net_v2/evaltest.dat +++ b/testing/tests/ike/rw_v1-net_v2/evaltest.dat @@ -2,13 +2,13 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ike/rw_v1-net_v2/pretest.dat b/testing/tests/ike/rw_v1-net_v2/pretest.dat index 03b8dc218..f61a4cb51 100644 --- a/testing/tests/ike/rw_v1-net_v2/pretest.dat +++ b/testing/tests/ike/rw_v1-net_v2/pretest.dat @@ -1,5 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward moon::ipsec start sun::ipsec start carol::ipsec start diff --git a/testing/tests/ike/rw_v1-net_v2/test.conf b/testing/tests/ike/rw_v1-net_v2/test.conf index 983881e5d..864f944d7 100644 --- a/testing/tests/ike/rw_v1-net_v2/test.conf +++ b/testing/tests/ike/rw_v1-net_v2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="carol moon sun" diff --git a/testing/tests/ikev1/alg-3des-md5/evaltest.dat b/testing/tests/ikev1/alg-3des-md5/evaltest.dat index a553ff168..abd29e97e 100644 --- a/testing/tests/ikev1/alg-3des-md5/evaltest.dat +++ b/testing/tests/ikev1/alg-3des-md5/evaltest.dat @@ -4,12 +4,12 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED::YES carol::ipsec status 2> /dev/null::home.*INSTALLED::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*3DES_CBC/HMAC_MD5_96,::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_MD5_96,::YES moon:: ip xfrm state::enc cbc(des3_ede)::YES carol::ip xfrm state::enc cbc(des3_ede)::YES -moon:: ip xfrm state::auth hmac(md5)::YES -carol::ip xfrm state::auth hmac(md5)::YES +moon:: ip xfrm state::auth-trunc hmac(md5)::YES +carol::ip xfrm state::auth-trunc hmac(md5)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES diff --git a/testing/tests/ikev1/alg-3des-md5/posttest.dat b/testing/tests/ikev1/alg-3des-md5/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-3des-md5/posttest.dat +++ b/testing/tests/ikev1/alg-3des-md5/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-3des-md5/pretest.dat b/testing/tests/ikev1/alg-3des-md5/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-3des-md5/pretest.dat +++ b/testing/tests/ikev1/alg-3des-md5/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-3des-md5/test.conf b/testing/tests/ikev1/alg-3des-md5/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-3des-md5/test.conf +++ b/testing/tests/ikev1/alg-3des-md5/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/alg-blowfish/evaltest.dat b/testing/tests/ikev1/alg-blowfish/evaltest.dat index 3787bdb68..cd83c56b4 100644 --- a/testing/tests/ikev1/alg-blowfish/evaltest.dat +++ b/testing/tests/ikev1/alg-blowfish/evaltest.dat @@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_384_192,::YES dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA2_256_128,::YES carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES diff --git a/testing/tests/ikev1/alg-blowfish/posttest.dat b/testing/tests/ikev1/alg-blowfish/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/alg-blowfish/posttest.dat +++ b/testing/tests/ikev1/alg-blowfish/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-blowfish/pretest.dat b/testing/tests/ikev1/alg-blowfish/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/alg-blowfish/pretest.dat +++ b/testing/tests/ikev1/alg-blowfish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/alg-blowfish/test.conf b/testing/tests/ikev1/alg-blowfish/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/alg-blowfish/test.conf +++ b/testing/tests/ikev1/alg-blowfish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat b/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat index c07c176b5..8230ee30c 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat +++ b/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024_160::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/alg-modp-subgroup/posttest.dat b/testing/tests/ikev1/alg-modp-subgroup/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/posttest.dat +++ b/testing/tests/ikev1/alg-modp-subgroup/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-modp-subgroup/pretest.dat b/testing/tests/ikev1/alg-modp-subgroup/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/pretest.dat +++ b/testing/tests/ikev1/alg-modp-subgroup/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/alg-modp-subgroup/test.conf b/testing/tests/ikev1/alg-modp-subgroup/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/test.conf +++ b/testing/tests/ikev1/alg-modp-subgroup/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/alg-sha256/evaltest.dat b/testing/tests/ikev1/alg-sha256/evaltest.dat index 7b5640af8..eba856742 100644 --- a/testing/tests/ikev1/alg-sha256/evaltest.dat +++ b/testing/tests/ikev1/alg-sha256/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES -moon:: ip xfrm state::auth hmac(sha256)::YES -carol::ip xfrm state::auth hmac(sha256)::YES +moon:: ip xfrm state::auth-trunc hmac(sha256)::YES +carol::ip xfrm state::auth-trunc hmac(sha256)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 200::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 200::YES diff --git a/testing/tests/ikev1/alg-sha256/posttest.dat b/testing/tests/ikev1/alg-sha256/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-sha256/posttest.dat +++ b/testing/tests/ikev1/alg-sha256/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-sha256/pretest.dat b/testing/tests/ikev1/alg-sha256/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-sha256/pretest.dat +++ b/testing/tests/ikev1/alg-sha256/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-sha256/test.conf b/testing/tests/ikev1/alg-sha256/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-sha256/test.conf +++ b/testing/tests/ikev1/alg-sha256/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/alg-sha384/evaltest.dat b/testing/tests/ikev1/alg-sha384/evaltest.dat index 21b3d5a4f..3b24217c5 100644 --- a/testing/tests/ikev1/alg-sha384/evaltest.dat +++ b/testing/tests/ikev1/alg-sha384/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES -moon:: ip xfrm state::auth hmac(sha384)::YES -carol::ip xfrm state::auth hmac(sha384)::YES +moon:: ip xfrm state::auth-trunc hmac(sha384)::YES +carol::ip xfrm state::auth-trunc hmac(sha384)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/ikev1/alg-sha384/posttest.dat b/testing/tests/ikev1/alg-sha384/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-sha384/posttest.dat +++ b/testing/tests/ikev1/alg-sha384/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-sha384/pretest.dat b/testing/tests/ikev1/alg-sha384/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-sha384/pretest.dat +++ b/testing/tests/ikev1/alg-sha384/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-sha384/test.conf b/testing/tests/ikev1/alg-sha384/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-sha384/test.conf +++ b/testing/tests/ikev1/alg-sha384/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/alg-sha512/evaltest.dat b/testing/tests/ikev1/alg-sha512/evaltest.dat index 7b94d2182..6bdceeb44 100644 --- a/testing/tests/ikev1/alg-sha512/evaltest.dat +++ b/testing/tests/ikev1/alg-sha512/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES -moon:: ip xfrm state::auth hmac(sha512)::YES -carol::ip xfrm state::auth hmac(sha512)::YES +moon:: ip xfrm state::auth-trunc hmac(sha512)::YES +carol::ip xfrm state::auth-trunc hmac(sha512)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES diff --git a/testing/tests/ikev1/alg-sha512/posttest.dat b/testing/tests/ikev1/alg-sha512/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-sha512/posttest.dat +++ b/testing/tests/ikev1/alg-sha512/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-sha512/pretest.dat b/testing/tests/ikev1/alg-sha512/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-sha512/pretest.dat +++ b/testing/tests/ikev1/alg-sha512/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-sha512/test.conf b/testing/tests/ikev1/alg-sha512/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-sha512/test.conf +++ b/testing/tests/ikev1/alg-sha512/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/compress/pretest.dat b/testing/tests/ikev1/compress/pretest.dat index 7d077c126..f5aa989fe 100644 --- a/testing/tests/ikev1/compress/pretest.dat +++ b/testing/tests/ikev1/compress/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev1/compress/test.conf b/testing/tests/ikev1/compress/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/ikev1/compress/test.conf +++ b/testing/tests/ikev1/compress/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/config-payload/evaltest.dat b/testing/tests/ikev1/config-payload/evaltest.dat index a429e9b32..b46dfddf6 100644 --- a/testing/tests/ikev1/config-payload/evaltest.dat +++ b/testing/tests/ikev1/config-payload/evaltest.dat @@ -5,13 +5,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::cat /etc/resolv.conf::nameserver PH_IP_WINNETOU .*from moon.strongswan.org::YES carol::cat /etc/resolv.conf::nameserver PH_IP_VENUS .*from moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES diff --git a/testing/tests/ikev1/config-payload/posttest.dat b/testing/tests/ikev1/config-payload/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/config-payload/posttest.dat +++ b/testing/tests/ikev1/config-payload/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/config-payload/pretest.dat b/testing/tests/ikev1/config-payload/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev1/config-payload/pretest.dat +++ b/testing/tests/ikev1/config-payload/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/config-payload/test.conf b/testing/tests/ikev1/config-payload/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/config-payload/test.conf +++ b/testing/tests/ikev1/config-payload/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/double-nat-net/evaltest.dat b/testing/tests/ikev1/double-nat-net/evaltest.dat index 05dc82d70..52c561964 100644 --- a/testing/tests/ikev1/double-nat-net/evaltest.dat +++ b/testing/tests/ikev1/double-nat-net/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/double-nat-net/posttest.dat b/testing/tests/ikev1/double-nat-net/posttest.dat index 484297418..63d4f98e7 100644 --- a/testing/tests/ikev1/double-nat-net/posttest.dat +++ b/testing/tests/ikev1/double-nat-net/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev1/double-nat-net/pretest.dat b/testing/tests/ikev1/double-nat-net/pretest.dat index 41b69aed6..17a4fe5eb 100644 --- a/testing/tests/ikev1/double-nat-net/pretest.dat +++ b/testing/tests/ikev1/double-nat-net/pretest.dat @@ -1,8 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -bob::echo 1 > /proc/sys/net/ipv4/ip_forward -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev1/double-nat-net/test.conf b/testing/tests/ikev1/double-nat-net/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev1/double-nat-net/test.conf +++ b/testing/tests/ikev1/double-nat-net/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev1/double-nat/evaltest.dat b/testing/tests/ikev1/double-nat/evaltest.dat index b080482f9..9ddad2de5 100644 --- a/testing/tests/ikev1/double-nat/evaltest.dat +++ b/testing/tests/ikev1/double-nat/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules b/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/double-nat/posttest.dat b/testing/tests/ikev1/double-nat/posttest.dat index 5d39e406d..aa806bfc9 100644 --- a/testing/tests/ikev1/double-nat/posttest.dat +++ b/testing/tests/ikev1/double-nat/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev1/double-nat/pretest.dat b/testing/tests/ikev1/double-nat/pretest.dat index 10ba6d735..65f18b756 100644 --- a/testing/tests/ikev1/double-nat/pretest.dat +++ b/testing/tests/ikev1/double-nat/pretest.dat @@ -1,7 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev1/double-nat/test.conf b/testing/tests/ikev1/double-nat/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev1/double-nat/test.conf +++ b/testing/tests/ikev1/double-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev1/dpd-clear/test.conf b/testing/tests/ikev1/dpd-clear/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev1/dpd-clear/test.conf +++ b/testing/tests/ikev1/dpd-clear/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/dpd-restart/test.conf b/testing/tests/ikev1/dpd-restart/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev1/dpd-restart/test.conf +++ b/testing/tests/ikev1/dpd-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/dynamic-initiator/evaltest.dat b/testing/tests/ikev1/dynamic-initiator/evaltest.dat index f22f1247f..61546f417 100644 --- a/testing/tests/ikev1/dynamic-initiator/evaltest.dat +++ b/testing/tests/ikev1/dynamic-initiator/evaltest.dat @@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES moon:: cat /var/log/daemon.log::deleting duplicate IKE_SA for.*carol@strongswan.org.*due to uniqueness policy::YES moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev1/dynamic-initiator/posttest.dat b/testing/tests/ikev1/dynamic-initiator/posttest.dat index 4dbf3d4a4..32ac12ddc 100644 --- a/testing/tests/ikev1/dynamic-initiator/posttest.dat +++ b/testing/tests/ikev1/dynamic-initiator/posttest.dat @@ -2,8 +2,6 @@ dave::ipsec stop carol::ipsec stop dave::sleep 1 moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +carol::iptables-restore < /etc/iptables.flush dave::rm /etc/ipsec.d/certs/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev1/dynamic-initiator/pretest.dat b/testing/tests/ikev1/dynamic-initiator/pretest.dat index 92681011f..9aadb2a4c 100644 --- a/testing/tests/ikev1/dynamic-initiator/pretest.dat +++ b/testing/tests/ikev1/dynamic-initiator/pretest.dat @@ -1,6 +1,4 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +carol::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start @@ -10,4 +8,4 @@ carol::sleep 1 carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT dave::ipsec up moon -dave::sleep 2 +dave::sleep 2 diff --git a/testing/tests/ikev1/dynamic-initiator/test.conf b/testing/tests/ikev1/dynamic-initiator/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/dynamic-initiator/test.conf +++ b/testing/tests/ikev1/dynamic-initiator/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/dynamic-responder/evaltest.dat b/testing/tests/ikev1/dynamic-responder/evaltest.dat index f22f1247f..61546f417 100644 --- a/testing/tests/ikev1/dynamic-responder/evaltest.dat +++ b/testing/tests/ikev1/dynamic-responder/evaltest.dat @@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES moon:: cat /var/log/daemon.log::deleting duplicate IKE_SA for.*carol@strongswan.org.*due to uniqueness policy::YES moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev1/dynamic-responder/posttest.dat b/testing/tests/ikev1/dynamic-responder/posttest.dat index 4dbf3d4a4..32ac12ddc 100644 --- a/testing/tests/ikev1/dynamic-responder/posttest.dat +++ b/testing/tests/ikev1/dynamic-responder/posttest.dat @@ -2,8 +2,6 @@ dave::ipsec stop carol::ipsec stop dave::sleep 1 moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +carol::iptables-restore < /etc/iptables.flush dave::rm /etc/ipsec.d/certs/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev1/dynamic-responder/pretest.dat b/testing/tests/ikev1/dynamic-responder/pretest.dat index c0f166ff4..8dc744f9a 100644 --- a/testing/tests/ikev1/dynamic-responder/pretest.dat +++ b/testing/tests/ikev1/dynamic-responder/pretest.dat @@ -1,6 +1,4 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +carol::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start @@ -10,4 +8,4 @@ moon::sleep 1 carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT dave::ipsec up moon -dave::sleep 2 +dave::sleep 2 diff --git a/testing/tests/ikev1/dynamic-responder/test.conf b/testing/tests/ikev1/dynamic-responder/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/dynamic-responder/test.conf +++ b/testing/tests/ikev1/dynamic-responder/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/dynamic-two-peers/evaltest.dat b/testing/tests/ikev1/dynamic-two-peers/evaltest.dat index 1d5ff68ec..82d2e7318 100644 --- a/testing/tests/ikev1/dynamic-two-peers/evaltest.dat +++ b/testing/tests/ikev1/dynamic-two-peers/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev1/dynamic-two-peers/posttest.dat b/testing/tests/ikev1/dynamic-two-peers/posttest.dat index e120b87db..7b2609846 100644 --- a/testing/tests/ikev1/dynamic-two-peers/posttest.dat +++ b/testing/tests/ikev1/dynamic-two-peers/posttest.dat @@ -3,6 +3,6 @@ dave::ipsec stop moon::sleep 1 moon::ipsec stop moon::mv /etc/hosts.ori /etc/hosts -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/dynamic-two-peers/pretest.dat b/testing/tests/ikev1/dynamic-two-peers/pretest.dat index 6596a2527..4bb2a4686 100644 --- a/testing/tests/ikev1/dynamic-two-peers/pretest.dat +++ b/testing/tests/ikev1/dynamic-two-peers/pretest.dat @@ -1,8 +1,8 @@ moon::mv /etc/hosts /etc/hosts.ori moon::mv /etc/hosts.stale /etc/hosts -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/dynamic-two-peers/test.conf b/testing/tests/ikev1/dynamic-two-peers/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/dynamic-two-peers/test.conf +++ b/testing/tests/ikev1/dynamic-two-peers/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat index 6f7c13704..648920105 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_CCM_12_128::YES carol::ipsec statusall 2> /dev/null::AES_CCM_12_128::YES carol::ip xfrm state::aead rfc4309(ccm(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/test.conf b/testing/tests/ikev1/esp-alg-aes-ccm/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-ccm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat index 9a8b46897..c86f58081 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_CTR_256/AES_XCBC_96::YES carol::ipsec statusall 2> /dev/null::AES_CTR_256/AES_XCBC_96::YES moon:: ip xfrm state::rfc3686(ctr(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/test.conf b/testing/tests/ikev1/esp-alg-aes-ctr/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-ctr/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat index 9d5fb7cc3..a7f52c72e 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_GCM_16_256::YES carol::ipsec statusall 2> /dev/null::AES_GCM_16_256::YES carol::ip xfrm state::aead rfc4106(gcm(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/test.conf b/testing/tests/ikev1/esp-alg-aes-gcm/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-gcm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat index 74150fb04..d5d3bc0d3 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ip xfrm state::aead rfc4543(gcm(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/test.conf b/testing/tests/ikev1/esp-alg-aes-gmac/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-gmac/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat index 6f5b89332..b466813fe 100644 --- a/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat @@ -2,10 +2,10 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::AES_CBC_256/AES_XCBC_96,::YES moon:: ipsec statusall 2> /dev/null::AES_CBC_256/AES_XCBC_96,::YES -carol::ip xfrm state::auth xcbc(aes)::YES -moon:: ip xfrm state::auth xcbc(aes)::YES +carol::ip xfrm state::auth-trunc xcbc(aes)::YES +moon:: ip xfrm state::auth-trunc xcbc(aes)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat b/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat index 7d077c126..f5aa989fe 100644 --- a/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf b/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-null/evaltest.dat b/testing/tests/ikev1/esp-alg-null/evaltest.dat index 937d85ed2..1b9c6c27e 100644 --- a/testing/tests/ikev1/esp-alg-null/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-null/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES moon:: ip xfrm state::enc ecb(cipher_null)::YES diff --git a/testing/tests/ikev1/esp-alg-null/posttest.dat b/testing/tests/ikev1/esp-alg-null/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-null/posttest.dat +++ b/testing/tests/ikev1/esp-alg-null/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-null/pretest.dat b/testing/tests/ikev1/esp-alg-null/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev1/esp-alg-null/pretest.dat +++ b/testing/tests/ikev1/esp-alg-null/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-null/test.conf b/testing/tests/ikev1/esp-alg-null/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-null/test.conf +++ b/testing/tests/ikev1/esp-alg-null/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/host2host-cert/evaltest.dat b/testing/tests/ikev1/host2host-cert/evaltest.dat index 53e5589ca..3305f4558 100644 --- a/testing/tests/ikev1/host2host-cert/evaltest.dat +++ b/testing/tests/ikev1/host2host-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/host2host-cert/posttest.dat b/testing/tests/ikev1/host2host-cert/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/host2host-cert/posttest.dat +++ b/testing/tests/ikev1/host2host-cert/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/host2host-cert/pretest.dat b/testing/tests/ikev1/host2host-cert/pretest.dat index 1fa70177c..3bce9f6e5 100644 --- a/testing/tests/ikev1/host2host-cert/pretest.dat +++ b/testing/tests/ikev1/host2host-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev1/host2host-cert/test.conf b/testing/tests/ikev1/host2host-cert/test.conf index 305a67316..55d6e9fd6 100644 --- a/testing/tests/ikev1/host2host-cert/test.conf +++ b/testing/tests/ikev1/host2host-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/host2host-transport/evaltest.dat b/testing/tests/ikev1/host2host-transport/evaltest.dat index 3021b5e04..fc49e57d8 100644 --- a/testing/tests/ikev1/host2host-transport/evaltest.dat +++ b/testing/tests/ikev1/host2host-transport/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/host2host-transport/posttest.dat b/testing/tests/ikev1/host2host-transport/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/host2host-transport/posttest.dat +++ b/testing/tests/ikev1/host2host-transport/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/host2host-transport/pretest.dat b/testing/tests/ikev1/host2host-transport/pretest.dat index e2d98f2eb..99789b90f 100644 --- a/testing/tests/ikev1/host2host-transport/pretest.dat +++ b/testing/tests/ikev1/host2host-transport/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/ikev1/host2host-transport/test.conf b/testing/tests/ikev1/host2host-transport/test.conf index cf2e704fd..5a286c84f 100644 --- a/testing/tests/ikev1/host2host-transport/test.conf +++ b/testing/tests/ikev1/host2host-transport/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/ip-pool-db/evaltest.dat b/testing/tests/ikev1/ip-pool-db/evaltest.dat index 941cb34c0..42e353084 100644 --- a/testing/tests/ikev1/ip-pool-db/evaltest.dat +++ b/testing/tests/ikev1/ip-pool-db/evaltest.dat @@ -6,7 +6,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES @@ -15,7 +15,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev1/ip-pool-db/posttest.dat b/testing/tests/ikev1/ip-pool-db/posttest.dat index 5b88b2163..c99f347e3 100644 --- a/testing/tests/ikev1/ip-pool-db/posttest.dat +++ b/testing/tests/ikev1/ip-pool-db/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ipsec pool --del bigpool 2> /dev/null moon::ipsec pool --del dns 2> /dev/null moon::ipsec pool --del nbns 2> /dev/null diff --git a/testing/tests/ikev1/ip-pool-db/pretest.dat b/testing/tests/ikev1/ip-pool-db/pretest.dat index 4a2add194..fce551c69 100644 --- a/testing/tests/ikev1/ip-pool-db/pretest.dat +++ b/testing/tests/ikev1/ip-pool-db/pretest.dat @@ -4,9 +4,9 @@ moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2> moon::ipsec pool --addattr dns --server PH_IP_WINNETOU 2> /dev/null moon::ipsec pool --addattr dns --server PH_IP_VENUS 2> /dev/null moon::ipsec pool --addattr nbns --server PH_IP_VENUS 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/ip-pool-db/test.conf b/testing/tests/ikev1/ip-pool-db/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/ip-pool-db/test.conf +++ b/testing/tests/ikev1/ip-pool-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/ip-pool/evaltest.dat b/testing/tests/ikev1/ip-pool/evaltest.dat index db46646a6..1fdc3f087 100644 --- a/testing/tests/ikev1/ip-pool/evaltest.dat +++ b/testing/tests/ikev1/ip-pool/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev1/ip-pool/posttest.dat b/testing/tests/ikev1/ip-pool/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev1/ip-pool/posttest.dat +++ b/testing/tests/ikev1/ip-pool/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/ip-pool/pretest.dat b/testing/tests/ikev1/ip-pool/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev1/ip-pool/pretest.dat +++ b/testing/tests/ikev1/ip-pool/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/ip-pool/test.conf b/testing/tests/ikev1/ip-pool/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/ip-pool/test.conf +++ b/testing/tests/ikev1/ip-pool/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat b/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat index c8e7adcb7..2eebc0f84 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/multi-level-ca-cr-init/test.conf b/testing/tests/ikev1/multi-level-ca-cr-init/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-init/test.conf +++ b/testing/tests/ikev1/multi-level-ca-cr-init/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat b/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf b/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf +++ b/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/multi-level-ca/pretest.dat b/testing/tests/ikev1/multi-level-ca/pretest.dat index 67c50c2ef..755564cbc 100644 --- a/testing/tests/ikev1/multi-level-ca/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/multi-level-ca/test.conf b/testing/tests/ikev1/multi-level-ca/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev1/multi-level-ca/test.conf +++ b/testing/tests/ikev1/multi-level-ca/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/nat-rw/evaltest.dat b/testing/tests/ikev1/nat-rw/evaltest.dat index e0b458dba..387dbae23 100644 --- a/testing/tests/ikev1/nat-rw/evaltest.dat +++ b/testing/tests/ikev1/nat-rw/evaltest.dat @@ -6,13 +6,13 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES moon:: sleep 6::no output expected::NO -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP-encap: ESP::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: isakmp-nat-keep-alive::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP-encap: ESP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP-encap: ESP::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: isakmp-nat-keep-alive::YES alice::cat /var/log/daemon.log::sending keep alive::YES venus::cat /var/log/daemon.log::sending keep alive::YES diff --git a/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/nat-rw/posttest.dat b/testing/tests/ikev1/nat-rw/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/ikev1/nat-rw/posttest.dat +++ b/testing/tests/ikev1/nat-rw/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev1/nat-rw/pretest.dat b/testing/tests/ikev1/nat-rw/pretest.dat index e365ff5c5..d701a1d61 100644 --- a/testing/tests/ikev1/nat-rw/pretest.dat +++ b/testing/tests/ikev1/nat-rw/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start diff --git a/testing/tests/ikev1/nat-rw/test.conf b/testing/tests/ikev1/nat-rw/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/ikev1/nat-rw/test.conf +++ b/testing/tests/ikev1/nat-rw/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev1/nat-virtual-ip/description.txt b/testing/tests/ikev1/nat-virtual-ip/description.txt new file mode 100644 index 000000000..31d24cda6 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/description.txt @@ -0,0 +1,6 @@ +The router <b>moon</b> sets up a connection to gateway <b>sun</b> in order +to reach the subnet hidden behind <b>sun</b>. The gateway <b>sun</b> assigns a +virtual IP address to router <b>moon</b>. A special updown script on <b>moon</b> +specified by <b>leftupdown=/etc/nat_updown</b> dynamically inserts a source NAT rule +which maps the IP address of client <b>alice</b> to the virtual IP of <b>moon</b>. +This allows <b>alice</b> to access client <b>bob</b> via the established IPsec tunnel. diff --git a/testing/tests/ikev1/nat-virtual-ip/evaltest.dat b/testing/tests/ikev1/nat-virtual-ip/evaltest.dat new file mode 100644 index 000000000..c60ffc772 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/evaltest.dat @@ -0,0 +1,8 @@ +moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES +sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES +moon:: cat /var/log/daemon.log::inserted NAT rule mapping PH_IP_ALICE to virtual IP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +bob::tcpdump::IP alice2.strongswan.org > bob.strongswan.org: ICMP::YES +bob::tcpdump::IP bob.strongswan.org > alice2.strongswan.org: ICMP::YES diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts b/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts new file mode 100644 index 000000000..ee854da09 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts @@ -0,0 +1,70 @@ +# /etc/hosts: This file describes a number of hostname-to-address +# mappings for the TCP/IP subsystem. It is mostly +# used at boot time, when no name servers are running. +# On small systems, this file can be used instead of a +# "named" name server. Just add the names, addresses +# and any aliases to this file... +# + +127.0.0.1 localhost + +192.168.0.254 uml0.strongswan.org uml0 +10.1.0.254 uml1.strongswan.org uml1 +10.2.0.254 uml1.strongswan.org uml2 + +10.1.0.10 alice.strongswan.org alice +10.1.0.20 venus.strongswan.org venus +10.1.0.1 moon1.strongswan.org moon1 +192.168.0.1 moon.strongswan.org moon +192.168.0.50 alice1.strongswan.org alice1 +192.168.0.100 carol.strongswan.org carol +10.3.0.1 carol1.strongswan.org carol1 +192.168.0.150 winnetou.strongswan.org winnetou crl.strongswan.org ocsp.strongswan.org ldap.strongswan.org +192.168.0.200 dave.strongswan.org dave +10.3.0.2 dave1.strongswan.org dave1 +192.168.0.2 sun.strongswan.org sun +10.2.0.1 sun1.strongswan.org sun1 +10.2.0.10 bob.strongswan.org bob +10.4.0.1 alice2.strongswan.org alice2 + +# IPv6 versions of localhost and co +::1 ip6-localhost ip6-loopback +fe00::0 ip6-localnet +ff00::0 ip6-mcastprefix +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters +ff02::3 ip6-allhosts + +# IPv6 solicited-node multicast addresses +ff02::1:ff00:1 ip6-mcast-1 +ff02::1:ff00:2 ip6-mcast-2 +ff02::1:ff00:10 ip6-mcast-10 +ff02::1:ff00:15 ip6-mcast-15 +ff02::1:ff00:20 ip6-mcast-20 + +# IPv6 site-local addresses +fec0::5 ip6-alice1.strongswan.org ip6-alice1 +fec1::10 ip6-alice.strongswan.org ip6-alice +fec1::20 ip6-venus.strongswan.org ip6-venus +fec1::1 ip6-moon1.strongswan.org ip6-moon1 +fec0::1 ip6-moon.strongswan.org ip6-moon +fec0::10 ip6-carol.strongswan.org ip6-carol +fec3::1 ip6-carol1.strongswan.org ip6-carol1 +fec0::15 ip6-winnetou.strongswan.org ip6-winnetou +fec0::20 ip6-dave.strongswan.org ip6-dave +fec3::2 ip6-dave1.strongswan.org ip6-dave1 +fec0::2 ip6-sun.strongswan.org ip6-sun +fec2::1 ip6-sun1.strongswan.org ip6-sun1 +fec2::10 ip6-bob.strongswan.org ip6-bob + +# IPv6 link-local HW derived addresses +fe80::fcfd:0aff:fe01:14 ip6-hw-venus.strongswan.org ip6-hw-venus +fe80::fcfd:0aff:fe01:0a ip6-hw-alice.strongswan.org ip6-hw-alice +fe80::fcfd:0aff:fe01:01 ip6-hw-moon1.strongswan.org ip6-hw-moon1 +fe80::fcfd:c0ff:fea8:01 ip6-hw-moon.strongswan.org ip6-hw-moon +fe80::fcfd:c0ff:fea8:64 ip6-hw-carol.strongswan.org ip6-hw-carol +fe80::fcfd:c0ff:fea8:96 ip6-hw-winnetou.strongswan.org ip6-hw-winnetou +fe80::fcfd:c0ff:fea8:c8 ip6-hw-dave.strongswan.org ip6-hw-dave +fe80::fcfd:c0ff:fea8:02 ip6-hw-sun.strongswan.org ip6-hw-sun +fe80::fcfd:0aff:fe02:01 ip6-hw-sun1.strongswan.org ip6-hw-sun1 +fe80::fcfd:0aff:fe02:0a ip6-hw-bob.strongswan.org ip6-hw-bob diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf new file mode 100644 index 000000000..28853ce75 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev1 + mobike=no + +conn net-net + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsourceip=%config + leftupdown=/etc/nat_updown + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown new file mode 100755 index 000000000..aab1df687 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown @@ -0,0 +1,152 @@ +#! /bin/sh +# NAT updown script +# +# Copyright (C) 2010 Andreas Steffen <andreas.steffen@strongswan.org> +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. + +# things that this script gets (from ipsec_pluto(8) man page) +# +# PLUTO_VERSION +# indicates what version of this interface is being +# used. This document describes version 1.1. This +# is upwardly compatible with version 1.0. +# +# PLUTO_VERB +# specifies the name of the operation to be performed +# (prepare-host, prepare-client, up-host, up-client, +# down-host, or down-client). If the address family +# for security gateway to security gateway communica- +# tions is IPv6, then a suffix of -v6 is added to the +# verb. +# +# PLUTO_CONNECTION +# is the name of the connection for which we are +# routing. +# +# PLUTO_NEXT_HOP +# is the next hop to which packets bound for the peer +# must be sent. +# +# PLUTO_INTERFACE +# is the name of the ipsec interface to be used. +# +# PLUTO_REQID +# is the requid of the ESP policy +# +# PLUTO_ME +# is the IP address of our host. +# +# PLUTO_MY_ID +# is the ID of our host. +# +# PLUTO_MY_CLIENT +# is the IP address / count of our client subnet. If +# the client is just the host, this will be the +# host's own IP address / max (where max is 32 for +# IPv4 and 128 for IPv6). +# +# PLUTO_MY_CLIENT_NET +# is the IP address of our client net. If the client +# is just the host, this will be the host's own IP +# address. +# +# PLUTO_MY_CLIENT_MASK +# is the mask for our client net. If the client is +# just the host, this will be 255.255.255.255. +# +# PLUTO_MY_SOURCEIP +# if non-empty, then the source address for the route will be +# set to this IP address. +# +# PLUTO_MY_PROTOCOL +# is the IP protocol that will be transported. +# +# PLUTO_MY_PORT +# is the UDP/TCP port to which the IPsec SA is +# restricted on our side. +# +# PLUTO_PEER +# is the IP address of our peer. +# +# PLUTO_PEER_ID +# is the ID of our peer. +# +# PLUTO_PEER_CA +# is the CA which issued the cert of our peer. +# +# PLUTO_PEER_CLIENT +# is the IP address / count of the peer's client sub- +# net. If the client is just the peer, this will be +# the peer's own IP address / max (where max is 32 +# for IPv4 and 128 for IPv6). +# +# PLUTO_PEER_CLIENT_NET +# is the IP address of the peer's client net. If the +# client is just the peer, this will be the peer's +# own IP address. +# +# PLUTO_PEER_CLIENT_MASK +# is the mask for the peer's client net. If the +# client is just the peer, this will be +# 255.255.255.255. +# +# PLUTO_PEER_PROTOCOL +# is the IP protocol that will be transported. +# +# PLUTO_PEER_PORT +# is the UDP/TCP port to which the IPsec SA is +# restricted on the peer side. +# + +# define a minimum PATH environment in case it is not set +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin" +export PATH + +# resolve octal escape sequences +PLUTO_MY_ID=`printf "$PLUTO_MY_ID"` +PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"` + +case "$PLUTO_VERB:$1" in +up-host:) + # connection to me coming up + # If you are doing a custom version, firewall commands go here. + ;; +down-host:) + # connection to me going down + # If you are doing a custom version, firewall commands go here. + ;; +up-client:) + # connection to my client subnet coming up + # If you are doing a custom version, firewall commands go here. + iptables -A FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j ACCEPT + iptables -A FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \ + -s $PLUTO_PEER_CLIENT -j ACCEPT + iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP + echo "inserted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2 + ;; +down-client:) + # connection to my client subnet going down + # If you are doing a custom version, firewall commands go here. + iptables -D FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j ACCEPT + iptables -D FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \ + -s $PLUTO_PEER_CLIENT -j ACCEPT + iptables -t nat -D POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP + echo "deleted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2 + ;; +*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2 + exit 1 + ;; +esac diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..8e685c862 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf @@ -0,0 +1,6 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown + multiple_authentication = no +} diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf new file mode 100644 index 000000000..ff030b5b5 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev1 + mobike=no + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsourceip=10.4.0.0/24 + auto=add diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf new file mode 100644 index 000000000..8e685c862 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf @@ -0,0 +1,6 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown + multiple_authentication = no +} diff --git a/testing/tests/ikev1/nat-virtual-ip/posttest.dat b/testing/tests/ikev1/nat-virtual-ip/posttest.dat new file mode 100644 index 000000000..11bd19da7 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +sun::ipsec stop +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::conntrack -F +moon::rm /etc/nat_updown diff --git a/testing/tests/ikev1/nat-virtual-ip/pretest.dat b/testing/tests/ikev1/nat-virtual-ip/pretest.dat new file mode 100644 index 000000000..eb0c28c7f --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/pretest.dat @@ -0,0 +1,8 @@ +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules +moon::conntrack -F +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up net-net +moon::sleep 1 diff --git a/testing/tests/ikev1/nat-virtual-ip/test.conf b/testing/tests/ikev1/nat-virtual-ip/test.conf new file mode 100644 index 000000000..f46f137b4 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun bob" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/net2net-cert/evaltest.dat b/testing/tests/ikev1/net2net-cert/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev1/net2net-cert/evaltest.dat +++ b/testing/tests/ikev1/net2net-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/net2net-cert/posttest.dat b/testing/tests/ikev1/net2net-cert/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev1/net2net-cert/posttest.dat +++ b/testing/tests/ikev1/net2net-cert/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/net2net-cert/pretest.dat b/testing/tests/ikev1/net2net-cert/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev1/net2net-cert/pretest.dat +++ b/testing/tests/ikev1/net2net-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev1/net2net-cert/test.conf b/testing/tests/ikev1/net2net-cert/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev1/net2net-cert/test.conf +++ b/testing/tests/ikev1/net2net-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/net2net-psk-fail/posttest.dat b/testing/tests/ikev1/net2net-psk-fail/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/net2net-psk-fail/posttest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/net2net-psk-fail/pretest.dat b/testing/tests/ikev1/net2net-psk-fail/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev1/net2net-psk-fail/pretest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev1/net2net-psk-fail/test.conf b/testing/tests/ikev1/net2net-psk-fail/test.conf index f6e064e7d..eb4822b5d 100644 --- a/testing/tests/ikev1/net2net-psk-fail/test.conf +++ b/testing/tests/ikev1/net2net-psk-fail/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/net2net-psk/evaltest.dat b/testing/tests/ikev1/net2net-psk/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev1/net2net-psk/evaltest.dat +++ b/testing/tests/ikev1/net2net-psk/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/net2net-psk/posttest.dat b/testing/tests/ikev1/net2net-psk/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/net2net-psk/posttest.dat +++ b/testing/tests/ikev1/net2net-psk/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/net2net-psk/pretest.dat b/testing/tests/ikev1/net2net-psk/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev1/net2net-psk/pretest.dat +++ b/testing/tests/ikev1/net2net-psk/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev1/net2net-psk/test.conf b/testing/tests/ikev1/net2net-psk/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev1/net2net-psk/test.conf +++ b/testing/tests/ikev1/net2net-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/protoport-dual/evaltest.dat b/testing/tests/ikev1/protoport-dual/evaltest.dat index a65460cc8..cf45f3b52 100644 --- a/testing/tests/ikev1/protoport-dual/evaltest.dat +++ b/testing/tests/ikev1/protoport-dual/evaltest.dat @@ -2,8 +2,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/protoport-dual/posttest.dat b/testing/tests/ikev1/protoport-dual/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/protoport-dual/posttest.dat +++ b/testing/tests/ikev1/protoport-dual/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/protoport-dual/pretest.dat b/testing/tests/ikev1/protoport-dual/pretest.dat index d3d0061c3..efb2e5712 100644 --- a/testing/tests/ikev1/protoport-dual/pretest.dat +++ b/testing/tests/ikev1/protoport-dual/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev1/protoport-dual/test.conf b/testing/tests/ikev1/protoport-dual/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/protoport-dual/test.conf +++ b/testing/tests/ikev1/protoport-dual/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat b/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat +++ b/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-cert-aggressive/posttest.dat b/testing/tests/ikev1/rw-cert-aggressive/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/posttest.dat +++ b/testing/tests/ikev1/rw-cert-aggressive/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-cert-aggressive/pretest.dat b/testing/tests/ikev1/rw-cert-aggressive/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/pretest.dat +++ b/testing/tests/ikev1/rw-cert-aggressive/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/rw-cert-aggressive/test.conf b/testing/tests/ikev1/rw-cert-aggressive/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/test.conf +++ b/testing/tests/ikev1/rw-cert-aggressive/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-cert-unity/evaltest.dat b/testing/tests/ikev1/rw-cert-unity/evaltest.dat index b6a860b86..c183f48e9 100644 --- a/testing/tests/ikev1/rw-cert-unity/evaltest.dat +++ b/testing/tests/ikev1/rw-cert-unity/evaltest.dat @@ -3,6 +3,6 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::10.2.1.1/32 === 192.168.0.0/24 PASS::YES carol::ipsec status 2> /dev/null::home.*10.2.1.1/32 === 10.1.0.0/16 10.2.1.0/24::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 10.2.1.0/24 === 10.2.1.1/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-cert-unity/test.conf b/testing/tests/ikev1/rw-cert-unity/test.conf index 25cff970f..09e6f6cdb 100644 --- a/testing/tests/ikev1/rw-cert-unity/test.conf +++ b/testing/tests/ikev1/rw-cert-unity/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/rw-cert/evaltest.dat b/testing/tests/ikev1/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/ikev1/rw-cert/evaltest.dat +++ b/testing/tests/ikev1/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-cert/posttest.dat b/testing/tests/ikev1/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-cert/posttest.dat +++ b/testing/tests/ikev1/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-cert/pretest.dat b/testing/tests/ikev1/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/rw-cert/pretest.dat +++ b/testing/tests/ikev1/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/rw-cert/test.conf b/testing/tests/ikev1/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-cert/test.conf +++ b/testing/tests/ikev1/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat b/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-psk-aggressive/posttest.dat b/testing/tests/ikev1/rw-psk-aggressive/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/posttest.dat +++ b/testing/tests/ikev1/rw-psk-aggressive/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-psk-aggressive/pretest.dat b/testing/tests/ikev1/rw-psk-aggressive/pretest.dat index 761abe274..44f41f995 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/pretest.dat +++ b/testing/tests/ikev1/rw-psk-aggressive/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/rw-psk-aggressive/test.conf b/testing/tests/ikev1/rw-psk-aggressive/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/test.conf +++ b/testing/tests/ikev1/rw-psk-aggressive/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat index ef964a234..77f548848 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-psk-fqdn/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat index 761abe274..44f41f995 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/pretest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/rw-psk-fqdn/test.conf b/testing/tests/ikev1/rw-psk-fqdn/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/test.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat index d56c5220f..df37719e9 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-psk-ipv4/pretest.dat b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat index 761abe274..44f41f995 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/pretest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/rw-psk-ipv4/test.conf b/testing/tests/ikev1/rw-psk-ipv4/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/test.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/virtual-ip/evaltest.dat b/testing/tests/ikev1/virtual-ip/evaltest.dat index dd3143ae7..0f5df71d7 100644 --- a/testing/tests/ikev1/virtual-ip/evaltest.dat +++ b/testing/tests/ikev1/virtual-ip/evaltest.dat @@ -14,12 +14,12 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::src PH_IP_CAROL1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::src PH_IP_DAVE1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/virtual-ip/posttest.dat b/testing/tests/ikev1/virtual-ip/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/virtual-ip/posttest.dat +++ b/testing/tests/ikev1/virtual-ip/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/virtual-ip/pretest.dat b/testing/tests/ikev1/virtual-ip/pretest.dat index 5ec37aae1..1765a83cd 100644 --- a/testing/tests/ikev1/virtual-ip/pretest.dat +++ b/testing/tests/ikev1/virtual-ip/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/virtual-ip/test.conf b/testing/tests/ikev1/virtual-ip/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/virtual-ip/test.conf +++ b/testing/tests/ikev1/virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat b/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat index 02ed911ba..cd4ebd8ec 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer.*carol::YE moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.2 to peer.*dave::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-psk-config/posttest.dat b/testing/tests/ikev1/xauth-id-psk-config/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/posttest.dat +++ b/testing/tests/ikev1/xauth-id-psk-config/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-psk-config/pretest.dat b/testing/tests/ikev1/xauth-id-psk-config/pretest.dat index 95a6be131..88a91ae86 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/pretest.dat +++ b/testing/tests/ikev1/xauth-id-psk-config/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/xauth-id-psk-config/test.conf b/testing/tests/ikev1/xauth-id-psk-config/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/test.conf +++ b/testing/tests/ikev1/xauth-id-psk-config/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat index 5b021a09a..34c124c95 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf b/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat index 198dd3782..7604a1527 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer.*carol::YE moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.2 to peer.*dave::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-id-rsa-config/test.conf b/testing/tests/ikev1/xauth-id-rsa-config/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/test.conf +++ b/testing/tests/ikev1/xauth-id-rsa-config/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat index 5b021a09a..34c124c95 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf b/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-psk/evaltest.dat b/testing/tests/ikev1/xauth-psk/evaltest.dat index 988a6c541..c6637cbfe 100644 --- a/testing/tests/ikev1/xauth-psk/evaltest.dat +++ b/testing/tests/ikev1/xauth-psk/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol@strongswan.org.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave@strongswan.org.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-psk/posttest.dat b/testing/tests/ikev1/xauth-psk/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-psk/posttest.dat +++ b/testing/tests/ikev1/xauth-psk/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-psk/pretest.dat b/testing/tests/ikev1/xauth-psk/pretest.dat index 95a6be131..88a91ae86 100644 --- a/testing/tests/ikev1/xauth-psk/pretest.dat +++ b/testing/tests/ikev1/xauth-psk/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/xauth-psk/test.conf b/testing/tests/ikev1/xauth-psk/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-psk/test.conf +++ b/testing/tests/ikev1/xauth-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat index 0591e22b6..d568273d1 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat @@ -5,6 +5,6 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/users index 4fb07b912..4fb07b912 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev1/xauth-rsa/evaltest.dat b/testing/tests/ikev1/xauth-rsa/evaltest.dat index 988a6c541..c6637cbfe 100644 --- a/testing/tests/ikev1/xauth-rsa/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol@strongswan.org.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave@strongswan.org.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-rsa/posttest.dat b/testing/tests/ikev1/xauth-rsa/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-rsa/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-rsa/pretest.dat b/testing/tests/ikev1/xauth-rsa/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-rsa/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-rsa/test.conf b/testing/tests/ikev1/xauth-rsa/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-rsa/test.conf +++ b/testing/tests/ikev1/xauth-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/after-2038-certs/evaltest.dat b/testing/tests/ikev2/after-2038-certs/evaltest.dat index 3efaa5a98..427aa74da 100644 --- a/testing/tests/ikev2/after-2038-certs/evaltest.dat +++ b/testing/tests/ikev2/after-2038-certs/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/after-2038-certs/posttest.dat b/testing/tests/ikev2/after-2038-certs/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/after-2038-certs/posttest.dat +++ b/testing/tests/ikev2/after-2038-certs/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/after-2038-certs/pretest.dat b/testing/tests/ikev2/after-2038-certs/pretest.dat index 4921d5097..baacc1605 100644 --- a/testing/tests/ikev2/after-2038-certs/pretest.dat +++ b/testing/tests/ikev2/after-2038-certs/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/after-2038-certs/test.conf b/testing/tests/ikev2/after-2038-certs/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/after-2038-certs/test.conf +++ b/testing/tests/ikev2/after-2038-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-3des-md5/evaltest.dat b/testing/tests/ikev2/alg-3des-md5/evaltest.dat index a553ff168..abd29e97e 100644 --- a/testing/tests/ikev2/alg-3des-md5/evaltest.dat +++ b/testing/tests/ikev2/alg-3des-md5/evaltest.dat @@ -4,12 +4,12 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED::YES carol::ipsec status 2> /dev/null::home.*INSTALLED::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*3DES_CBC/HMAC_MD5_96,::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_MD5_96,::YES moon:: ip xfrm state::enc cbc(des3_ede)::YES carol::ip xfrm state::enc cbc(des3_ede)::YES -moon:: ip xfrm state::auth hmac(md5)::YES -carol::ip xfrm state::auth hmac(md5)::YES +moon:: ip xfrm state::auth-trunc hmac(md5)::YES +carol::ip xfrm state::auth-trunc hmac(md5)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES diff --git a/testing/tests/ikev2/alg-3des-md5/posttest.dat b/testing/tests/ikev2/alg-3des-md5/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-3des-md5/posttest.dat +++ b/testing/tests/ikev2/alg-3des-md5/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-3des-md5/pretest.dat b/testing/tests/ikev2/alg-3des-md5/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-3des-md5/pretest.dat +++ b/testing/tests/ikev2/alg-3des-md5/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-3des-md5/test.conf b/testing/tests/ikev2/alg-3des-md5/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-3des-md5/test.conf +++ b/testing/tests/ikev2/alg-3des-md5/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-ccm/evaltest.dat b/testing/tests/ikev2/alg-aes-ccm/evaltest.dat index e2cf773ea..5a14b98d6 100644 --- a/testing/tests/ikev2/alg-aes-ccm/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-ccm/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES moon:: ipsec statusall 2> /dev/null::AES_CCM_12_128,::YES diff --git a/testing/tests/ikev2/alg-aes-ccm/posttest.dat b/testing/tests/ikev2/alg-aes-ccm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-ccm/posttest.dat +++ b/testing/tests/ikev2/alg-aes-ccm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-ccm/pretest.dat b/testing/tests/ikev2/alg-aes-ccm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-ccm/pretest.dat +++ b/testing/tests/ikev2/alg-aes-ccm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-ccm/test.conf b/testing/tests/ikev2/alg-aes-ccm/test.conf index acb73b06f..11423f723 100644 --- a/testing/tests/ikev2/alg-aes-ccm/test.conf +++ b/testing/tests/ikev2/alg-aes-ccm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-ctr/evaltest.dat b/testing/tests/ikev2/alg-aes-ctr/evaltest.dat index 177e0ea62..6a5203a2d 100644 --- a/testing/tests/ikev2/alg-aes-ctr/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-ctr/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES moon:: ipsec statusall 2> /dev/null::AES_CTR_128/AES_XCBC_96,::YES diff --git a/testing/tests/ikev2/alg-aes-ctr/posttest.dat b/testing/tests/ikev2/alg-aes-ctr/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-ctr/posttest.dat +++ b/testing/tests/ikev2/alg-aes-ctr/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-ctr/pretest.dat b/testing/tests/ikev2/alg-aes-ctr/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-ctr/pretest.dat +++ b/testing/tests/ikev2/alg-aes-ctr/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-ctr/test.conf b/testing/tests/ikev2/alg-aes-ctr/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-aes-ctr/test.conf +++ b/testing/tests/ikev2/alg-aes-ctr/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-gcm/evaltest.dat b/testing/tests/ikev2/alg-aes-gcm/evaltest.dat index 39f8b1cc4..ce27fcc05 100644 --- a/testing/tests/ikev2/alg-aes-gcm/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-gcm/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES carol::ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES moon:: ipsec statusall 2> /dev/null::AES_GCM_16_256,::YES diff --git a/testing/tests/ikev2/alg-aes-gcm/posttest.dat b/testing/tests/ikev2/alg-aes-gcm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-gcm/posttest.dat +++ b/testing/tests/ikev2/alg-aes-gcm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-gcm/pretest.dat b/testing/tests/ikev2/alg-aes-gcm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-gcm/pretest.dat +++ b/testing/tests/ikev2/alg-aes-gcm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-gcm/test.conf b/testing/tests/ikev2/alg-aes-gcm/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-aes-gcm/test.conf +++ b/testing/tests/ikev2/alg-aes-gcm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat index 7a9874528..f11018347 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat @@ -4,11 +4,11 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES -moon:: ip xfrm state::auth xcbc(aes)::YES -carol::ip xfrm state::auth xcbc(aes)::YES +moon:: ip xfrm state::auth-trunc xcbc(aes)::YES +carol::ip xfrm state::auth-trunc xcbc(aes)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/ikev2/alg-aes-xcbc/posttest.dat b/testing/tests/ikev2/alg-aes-xcbc/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/posttest.dat +++ b/testing/tests/ikev2/alg-aes-xcbc/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-xcbc/pretest.dat b/testing/tests/ikev2/alg-aes-xcbc/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/pretest.dat +++ b/testing/tests/ikev2/alg-aes-xcbc/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-xcbc/test.conf b/testing/tests/ikev2/alg-aes-xcbc/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/test.conf +++ b/testing/tests/ikev2/alg-aes-xcbc/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-blowfish/evaltest.dat b/testing/tests/ikev2/alg-blowfish/evaltest.dat index a458f0241..f76522c5c 100644 --- a/testing/tests/ikev2/alg-blowfish/evaltest.dat +++ b/testing/tests/ikev2/alg-blowfish/evaltest.dat @@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_256_128,::YES dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA1_96,::YES carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES diff --git a/testing/tests/ikev2/alg-blowfish/posttest.dat b/testing/tests/ikev2/alg-blowfish/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/alg-blowfish/posttest.dat +++ b/testing/tests/ikev2/alg-blowfish/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-blowfish/pretest.dat b/testing/tests/ikev2/alg-blowfish/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/alg-blowfish/pretest.dat +++ b/testing/tests/ikev2/alg-blowfish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/alg-blowfish/test.conf b/testing/tests/ikev2/alg-blowfish/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/alg-blowfish/test.conf +++ b/testing/tests/ikev2/alg-blowfish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat b/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat index 0acd6d2ce..5e4ab98b3 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat +++ b/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat @@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::DH group MODP_2048_224.*MODP_1024_160::YES dave:: cat /var/log/daemon.log::DH group MODP_2048_224.*MODP_2048_256::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024_160::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/alg-modp-subgroup/posttest.dat b/testing/tests/ikev2/alg-modp-subgroup/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/posttest.dat +++ b/testing/tests/ikev2/alg-modp-subgroup/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-modp-subgroup/pretest.dat b/testing/tests/ikev2/alg-modp-subgroup/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/pretest.dat +++ b/testing/tests/ikev2/alg-modp-subgroup/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/alg-modp-subgroup/test.conf b/testing/tests/ikev2/alg-modp-subgroup/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/test.conf +++ b/testing/tests/ikev2/alg-modp-subgroup/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/alg-sha256-96/evaltest.dat b/testing/tests/ikev2/alg-sha256-96/evaltest.dat index 4bbc82d9b..6c4e23710 100644 --- a/testing/tests/ikev2/alg-sha256-96/evaltest.dat +++ b/testing/tests/ikev2/alg-sha256-96/evaltest.dat @@ -6,10 +6,10 @@ moon:: cat /var/log/daemon.log::received strongSwan vendor ID::YES carol::cat /var/log/daemon.log::received strongSwan vendor ID::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_96,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_96,::YES -moon:: ip xfrm state::auth hmac(sha256)::YES -carol::ip xfrm state::auth hmac(sha256)::YES +moon:: ip xfrm state::auth-trunc hmac(sha256)::YES +carol::ip xfrm state::auth-trunc hmac(sha256)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/ikev2/alg-sha256-96/posttest.dat b/testing/tests/ikev2/alg-sha256-96/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha256-96/posttest.dat +++ b/testing/tests/ikev2/alg-sha256-96/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha256-96/pretest.dat b/testing/tests/ikev2/alg-sha256-96/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha256-96/pretest.dat +++ b/testing/tests/ikev2/alg-sha256-96/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha256-96/test.conf b/testing/tests/ikev2/alg-sha256-96/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha256-96/test.conf +++ b/testing/tests/ikev2/alg-sha256-96/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-sha256/evaltest.dat b/testing/tests/ikev2/alg-sha256/evaltest.dat index 7b5640af8..eba856742 100644 --- a/testing/tests/ikev2/alg-sha256/evaltest.dat +++ b/testing/tests/ikev2/alg-sha256/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES -moon:: ip xfrm state::auth hmac(sha256)::YES -carol::ip xfrm state::auth hmac(sha256)::YES +moon:: ip xfrm state::auth-trunc hmac(sha256)::YES +carol::ip xfrm state::auth-trunc hmac(sha256)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 200::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 200::YES diff --git a/testing/tests/ikev2/alg-sha256/posttest.dat b/testing/tests/ikev2/alg-sha256/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha256/posttest.dat +++ b/testing/tests/ikev2/alg-sha256/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha256/pretest.dat b/testing/tests/ikev2/alg-sha256/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha256/pretest.dat +++ b/testing/tests/ikev2/alg-sha256/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha256/test.conf b/testing/tests/ikev2/alg-sha256/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha256/test.conf +++ b/testing/tests/ikev2/alg-sha256/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-sha384/evaltest.dat b/testing/tests/ikev2/alg-sha384/evaltest.dat index 21b3d5a4f..3b24217c5 100644 --- a/testing/tests/ikev2/alg-sha384/evaltest.dat +++ b/testing/tests/ikev2/alg-sha384/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES -moon:: ip xfrm state::auth hmac(sha384)::YES -carol::ip xfrm state::auth hmac(sha384)::YES +moon:: ip xfrm state::auth-trunc hmac(sha384)::YES +carol::ip xfrm state::auth-trunc hmac(sha384)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/ikev2/alg-sha384/posttest.dat b/testing/tests/ikev2/alg-sha384/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha384/posttest.dat +++ b/testing/tests/ikev2/alg-sha384/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha384/pretest.dat b/testing/tests/ikev2/alg-sha384/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha384/pretest.dat +++ b/testing/tests/ikev2/alg-sha384/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha384/test.conf b/testing/tests/ikev2/alg-sha384/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha384/test.conf +++ b/testing/tests/ikev2/alg-sha384/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-sha512/evaltest.dat b/testing/tests/ikev2/alg-sha512/evaltest.dat index 7b94d2182..6bdceeb44 100644 --- a/testing/tests/ikev2/alg-sha512/evaltest.dat +++ b/testing/tests/ikev2/alg-sha512/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES -moon:: ip xfrm state::auth hmac(sha512)::YES -carol::ip xfrm state::auth hmac(sha512)::YES +moon:: ip xfrm state::auth-trunc hmac(sha512)::YES +carol::ip xfrm state::auth-trunc hmac(sha512)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES diff --git a/testing/tests/ikev2/alg-sha512/posttest.dat b/testing/tests/ikev2/alg-sha512/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha512/posttest.dat +++ b/testing/tests/ikev2/alg-sha512/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha512/pretest.dat b/testing/tests/ikev2/alg-sha512/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha512/pretest.dat +++ b/testing/tests/ikev2/alg-sha512/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha512/test.conf b/testing/tests/ikev2/alg-sha512/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha512/test.conf +++ b/testing/tests/ikev2/alg-sha512/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/any-interface/pretest.dat b/testing/tests/ikev2/any-interface/pretest.dat index b8e91194e..0a6ce8be4 100644 --- a/testing/tests/ikev2/any-interface/pretest.dat +++ b/testing/tests/ikev2/any-interface/pretest.dat @@ -1,5 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON winnetou::ip route add 10.2.0.0/16 via PH_IP_SUN alice::ipsec start diff --git a/testing/tests/ikev2/any-interface/test.conf b/testing/tests/ikev2/any-interface/test.conf index 25e5cd872..cc04d45e6 100644 --- a/testing/tests/ikev2/any-interface/test.conf +++ b/testing/tests/ikev2/any-interface/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice sun bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon sun bob" diff --git a/testing/tests/ikev2/compress/pretest.dat b/testing/tests/ikev2/compress/pretest.dat index 7d077c126..f5aa989fe 100644 --- a/testing/tests/ikev2/compress/pretest.dat +++ b/testing/tests/ikev2/compress/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/compress/test.conf b/testing/tests/ikev2/compress/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/ikev2/compress/test.conf +++ b/testing/tests/ikev2/compress/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/config-payload-swapped/evaltest.dat b/testing/tests/ikev2/config-payload-swapped/evaltest.dat index 3c41a596c..b6a1c96a6 100644 --- a/testing/tests/ikev2/config-payload-swapped/evaltest.dat +++ b/testing/tests/ikev2/config-payload-swapped/evaltest.dat @@ -3,13 +3,13 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES diff --git a/testing/tests/ikev2/config-payload-swapped/posttest.dat b/testing/tests/ikev2/config-payload-swapped/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/config-payload-swapped/posttest.dat +++ b/testing/tests/ikev2/config-payload-swapped/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/config-payload-swapped/pretest.dat b/testing/tests/ikev2/config-payload-swapped/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev2/config-payload-swapped/pretest.dat +++ b/testing/tests/ikev2/config-payload-swapped/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/config-payload-swapped/test.conf b/testing/tests/ikev2/config-payload-swapped/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/config-payload-swapped/test.conf +++ b/testing/tests/ikev2/config-payload-swapped/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/config-payload/evaltest.dat b/testing/tests/ikev2/config-payload/evaltest.dat index a429e9b32..b46dfddf6 100644 --- a/testing/tests/ikev2/config-payload/evaltest.dat +++ b/testing/tests/ikev2/config-payload/evaltest.dat @@ -5,13 +5,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::cat /etc/resolv.conf::nameserver PH_IP_WINNETOU .*from moon.strongswan.org::YES carol::cat /etc/resolv.conf::nameserver PH_IP_VENUS .*from moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES diff --git a/testing/tests/ikev2/config-payload/posttest.dat b/testing/tests/ikev2/config-payload/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/config-payload/posttest.dat +++ b/testing/tests/ikev2/config-payload/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/config-payload/pretest.dat b/testing/tests/ikev2/config-payload/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev2/config-payload/pretest.dat +++ b/testing/tests/ikev2/config-payload/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/config-payload/test.conf b/testing/tests/ikev2/config-payload/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/config-payload/test.conf +++ b/testing/tests/ikev2/config-payload/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/critical-extension/posttest.dat b/testing/tests/ikev2/critical-extension/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/critical-extension/posttest.dat +++ b/testing/tests/ikev2/critical-extension/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/critical-extension/pretest.dat b/testing/tests/ikev2/critical-extension/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/critical-extension/pretest.dat +++ b/testing/tests/ikev2/critical-extension/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/critical-extension/test.conf b/testing/tests/ikev2/critical-extension/test.conf index 41ee3037e..b286ef6eb 100644 --- a/testing/tests/ikev2/critical-extension/test.conf +++ b/testing/tests/ikev2/critical-extension/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/crl-from-cache/test.conf b/testing/tests/ikev2/crl-from-cache/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-from-cache/test.conf +++ b/testing/tests/ikev2/crl-from-cache/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 999d0d183..000000000 --- a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ldap crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..debcc2181 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow ldap crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 4f4f3228b..000000000 --- a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ldap crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..debcc2181 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow ldap crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/crl-ldap/posttest.dat b/testing/tests/ikev2/crl-ldap/posttest.dat index bddd87424..8474bd3aa 100644 --- a/testing/tests/ikev2/crl-ldap/posttest.dat +++ b/testing/tests/ikev2/crl-ldap/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop winnetou::/etc/init.d/slapd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/crls/* carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ikev2/crl-ldap/pretest.dat b/testing/tests/ikev2/crl-ldap/pretest.dat index 64fa8116b..8ffa9d3ed 100644 --- a/testing/tests/ikev2/crl-ldap/pretest.dat +++ b/testing/tests/ikev2/crl-ldap/pretest.dat @@ -1,6 +1,6 @@ winnetou::/etc/init.d/slapd start -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/crl-ldap/test.conf b/testing/tests/ikev2/crl-ldap/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-ldap/test.conf +++ b/testing/tests/ikev2/crl-ldap/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-revoked/test.conf b/testing/tests/ikev2/crl-revoked/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-revoked/test.conf +++ b/testing/tests/ikev2/crl-revoked/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-to-cache/test.conf b/testing/tests/ikev2/crl-to-cache/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-to-cache/test.conf +++ b/testing/tests/ikev2/crl-to-cache/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/default-keys/description.txt b/testing/tests/ikev2/default-keys/description.txt index 639e909da..889f8297a 100644 --- a/testing/tests/ikev2/default-keys/description.txt +++ b/testing/tests/ikev2/default-keys/description.txt @@ -1,8 +1,8 @@ Because of the missing <b>/etc/ipsec.secrets</b> file, roadwarrior <b>carol</b> and gateway <b>moon</b> each automatically generate a PKCS#1 RSA private key -and a self-signed X.509 certificate. Because the UML testing environment does -not offer enough entropy, the non-blocking /dev/urandom device is used in place -of /dev/random for generating the random primes. +and a self-signed X.509 certificate. Because the virtual testing environment +does not offer enough entropy, the non-blocking /dev/urandom device is used in +place of /dev/random for generating the random primes. <p> The self-signed certificates are then distributed to the peers via scp and are used to set up a road warrior connection initiated by <b>carol</b> diff --git a/testing/tests/ikev2/default-keys/evaltest.dat b/testing/tests/ikev2/default-keys/evaltest.dat index 1c206fff0..4df2d1e11 100644 --- a/testing/tests/ikev2/default-keys/evaltest.dat +++ b/testing/tests/ikev2/default-keys/evaltest.dat @@ -4,6 +4,6 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*CN=carol.*CN=moon::YES moon:: ipsec status 2> /dev/null::carol.*ESTABLISHED.*CN=moon.*CN=carol::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 5a262c084..000000000 --- a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,82 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A INPUT -p tcp --sport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..72a1c17c3 --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules @@ -0,0 +1,30 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --sport 22 -j ACCEPT +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT +-A OUTPUT -p tcp --dport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/default-keys/posttest.dat b/testing/tests/ikev2/default-keys/posttest.dat index 8cada5e7e..25f737ecc 100644 --- a/testing/tests/ikev2/default-keys/posttest.dat +++ b/testing/tests/ikev2/default-keys/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/default-keys/pretest.dat b/testing/tests/ikev2/default-keys/pretest.dat index 88f9a2ca9..ef5f67097 100644 --- a/testing/tests/ikev2/default-keys/pretest.dat +++ b/testing/tests/ikev2/default-keys/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules carol::rm /etc/ipsec.secrets carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* @@ -10,9 +10,10 @@ moon::rm /etc/ipsec.d/private/* moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/cacerts/* moon::ipsec start -moon::sleep 5 +moon::sleep 5 moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der -moon::ipsec reload -carol::ipsec reload +moon::ipsec reload +carol::ipsec reload +carol::sleep 1 carol::ipsec up home diff --git a/testing/tests/ikev2/default-keys/test.conf b/testing/tests/ikev2/default-keys/test.conf index 0baa48d90..ce84ce41a 100644 --- a/testing/tests/ikev2/default-keys/test.conf +++ b/testing/tests/ikev2/default-keys/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol" +VIRTHOSTS="alice moon carol" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dhcp-dynamic/evaltest.dat b/testing/tests/ikev2/dhcp-dynamic/evaltest.dat index 4b0ddace7..9e536870e 100644 --- a/testing/tests/ikev2/dhcp-dynamic/evaltest.dat +++ b/testing/tests/ikev2/dhcp-dynamic/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.50/32::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol3.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol3.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave3.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave3.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave3.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 058bebb2d..000000000 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow bootpc and bootps - iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT - iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT - - # allow broadcasts from eth1 - iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - iptables -A INPUT -j LOG --log-prefix " IN: " - iptables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..2d9a466b0 --- /dev/null +++ b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow bootpc and bootps +-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT +-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT + +# allow broadcasts from eth1 +-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf index 2176af702..7a178505f 100644 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf +++ b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf @@ -4,11 +4,11 @@ ddns-update-style none; subnet 10.1.0.0 netmask 255.255.0.0 { option domain-name "strongswan.org"; - option domain-name-servers 10.1.0.20; - option netbios-name-servers 10.1.0.10; - option routers 10.1.0.1; + option domain-name-servers PH_IP_VENUS; + option netbios-name-servers PH_IP_ALICE; + option routers PH_IP_MOON1; option broadcast-address 10.1.255.255; - next-server 10.1.0.20; + next-server PH_IP_VENUS; range 10.1.0.50 10.1.0.60; } diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf index 2d35dfd64..ec8c945a7 100644 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf +++ b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf @@ -1,7 +1,7 @@ interface=eth0 dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255 -dhcp-option=option:router,10.1.0.1 -dhcp-option=option:dns-server,10.1.0.20 -dhcp-option=option:netbios-ns,10.1.0.10 +dhcp-option=option:router,PH_IP_MOON1 +dhcp-option=option:dns-server,PH_IP_VENUS +dhcp-option=option:netbios-ns,PH_IP_ALICE dhcp-option=option:domain-name,strongswan.org log-dhcp diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd deleted file mode 100755 index 4044dcc35..000000000 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd +++ /dev/null @@ -1,24 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop" - -depend() { - need net - need logger -} - -start() { - ebegin "Starting DHCP server" - start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd - eend $? -} - -stop() { - ebegin "Stopping DHCP server" - start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid - rm -f /var/state/dhcp/dhcpd.leases - touch /var/state/dhcp/dhcpd.leases - eend $? -} diff --git a/testing/tests/ikev2/dhcp-dynamic/posttest.dat b/testing/tests/ikev2/dhcp-dynamic/posttest.dat index 1f5487596..f783127bf 100644 --- a/testing/tests/ikev2/dhcp-dynamic/posttest.dat +++ b/testing/tests/ikev2/dhcp-dynamic/posttest.dat @@ -2,9 +2,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop venus::cat /var/state/dhcp/dhcpd.leases -venus::/etc/init.d/dhcpd stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush alice::arp -d 10.1.0.50 alice::arp -d 10.1.0.51 diff --git a/testing/tests/ikev2/dhcp-dynamic/pretest.dat b/testing/tests/ikev2/dhcp-dynamic/pretest.dat index bd36b4fe3..5670a2e89 100644 --- a/testing/tests/ikev2/dhcp-dynamic/pretest.dat +++ b/testing/tests/ikev2/dhcp-dynamic/pretest.dat @@ -1,12 +1,12 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -venus::cat /etc/dhcpd.conf -venus::/etc/init.d/dhcpd start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +venus::cat /etc/dhcp/dhcpd.conf +venus::/etc/init.d/isc-dhcp-server start 2> /dev/null carol::ipsec start dave::ipsec start moon::ipsec start -carol::sleep 2 +carol::sleep 2 carol::ipsec up home dave::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/dhcp-dynamic/test.conf b/testing/tests/ikev2/dhcp-dynamic/test.conf index a2ad7b25f..fd8a59c90 100644 --- a/testing/tests/ikev2/dhcp-dynamic/test.conf +++ b/testing/tests/ikev2/dhcp-dynamic/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat b/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat index 830094c7a..c95b69a11 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat +++ b/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 058bebb2d..000000000 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow bootpc and bootps - iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT - iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT - - # allow broadcasts from eth1 - iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - iptables -A INPUT -j LOG --log-prefix " IN: " - iptables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..2d9a466b0 --- /dev/null +++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow bootpc and bootps +-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT +-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT + +# allow broadcasts from eth1 +-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcp/dhcpd.conf index 44ee681b6..334ea30e2 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf +++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcp/dhcpd.conf @@ -4,11 +4,11 @@ ddns-update-style none; subnet 10.1.0.0 netmask 255.255.0.0 { option domain-name "strongswan.org"; - option domain-name-servers 10.1.0.20; - option netbios-name-servers 10.1.0.10; - option routers 10.1.0.1; + option domain-name-servers PH_IP_VENUS; + option netbios-name-servers PH_IP_ALICE; + option routers PH_IP_MOON1; option broadcast-address 10.1.255.255; - next-server 10.1.0.20; + next-server PH_IP_VENUS; range 10.1.0.50 10.1.0.60; } @@ -22,4 +22,3 @@ host dave { option dhcp-client-identifier "dave@strongswan.org"; fixed-address 10.1.0.40; } - diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf index 5672236a0..aca225955 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf +++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf @@ -2,8 +2,8 @@ interface=eth0 dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255 dhcp-host=id:carol@strongswan.org,10.1.0.30 dhcp-host=id:dave@strongswan.org,10.1.0.40 -dhcp-option=option:router,10.1.0.1 -dhcp-option=option:dns-server,10.1.0.20 -dhcp-option=option:netbios-ns,10.1.0.10 +dhcp-option=option:router,PH_IP_MOON1 +dhcp-option=option:dns-server,PH_IP_VENUS +dhcp-option=option:netbios-ns,PH_IP_ALICE dhcp-option=option:domain-name,strongswan.org log-dhcp diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd deleted file mode 100755 index 4044dcc35..000000000 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd +++ /dev/null @@ -1,24 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop" - -depend() { - need net - need logger -} - -start() { - ebegin "Starting DHCP server" - start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd - eend $? -} - -stop() { - ebegin "Stopping DHCP server" - start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid - rm -f /var/state/dhcp/dhcpd.leases - touch /var/state/dhcp/dhcpd.leases - eend $? -} diff --git a/testing/tests/ikev2/dhcp-static-client-id/posttest.dat b/testing/tests/ikev2/dhcp-static-client-id/posttest.dat index e1aadc618..7fff9981b 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/posttest.dat +++ b/testing/tests/ikev2/dhcp-static-client-id/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -venus::/etc/init.d/dhcpd stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush alice::arp -d 10.1.0.30 alice::arp -d 10.1.0.40 diff --git a/testing/tests/ikev2/dhcp-static-client-id/pretest.dat b/testing/tests/ikev2/dhcp-static-client-id/pretest.dat index bd36b4fe3..5670a2e89 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/pretest.dat +++ b/testing/tests/ikev2/dhcp-static-client-id/pretest.dat @@ -1,12 +1,12 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -venus::cat /etc/dhcpd.conf -venus::/etc/init.d/dhcpd start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +venus::cat /etc/dhcp/dhcpd.conf +venus::/etc/init.d/isc-dhcp-server start 2> /dev/null carol::ipsec start dave::ipsec start moon::ipsec start -carol::sleep 2 +carol::sleep 2 carol::ipsec up home dave::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/dhcp-static-client-id/test.conf b/testing/tests/ikev2/dhcp-static-client-id/test.conf index a2ad7b25f..fd8a59c90 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/test.conf +++ b/testing/tests/ikev2/dhcp-static-client-id/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/dhcp-static-mac/evaltest.dat b/testing/tests/ikev2/dhcp-static-mac/evaltest.dat index 830094c7a..c95b69a11 100644 --- a/testing/tests/ikev2/dhcp-static-mac/evaltest.dat +++ b/testing/tests/ikev2/dhcp-static-mac/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 058bebb2d..000000000 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow bootpc and bootps - iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT - iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT - - # allow broadcasts from eth1 - iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - iptables -A INPUT -j LOG --log-prefix " IN: " - iptables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..2d9a466b0 --- /dev/null +++ b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow bootpc and bootps +-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT +-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT + +# allow broadcasts from eth1 +-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcp/dhcpd.conf index 20666f701..cdade2f2e 100644 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcpd.conf +++ b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcp/dhcpd.conf @@ -4,11 +4,11 @@ ddns-update-style none; subnet 10.1.0.0 netmask 255.255.0.0 { option domain-name "strongswan.org"; - option domain-name-servers 10.1.0.20; - option netbios-name-servers 10.1.0.10; - option routers 10.1.0.1; + option domain-name-servers PH_IP_VENUS; + option netbios-name-servers PH_IP_ALICE; + option routers PH_IP_MOON1; option broadcast-address 10.1.255.255; - next-server 10.1.0.20; + next-server PH_IP_VENUS; range 10.1.0.50 10.1.0.60; } @@ -22,4 +22,3 @@ host dave { hardware ethernet 7a:a7:35:78:bc:85; fixed-address 10.1.0.40; } - diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf index e3729081f..61d31a0ba 100644 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf +++ b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf @@ -2,8 +2,8 @@ interface=eth0 dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255 dhcp-host=7a:a7:8f:fc:db:3b,10.1.0.30 dhcp-host=7a:a7:35:78:bc:85,10.1.0.40 -dhcp-option=option:router,10.1.0.1 -dhcp-option=option:dns-server,10.1.0.20 -dhcp-option=option:netbios-ns,10.1.0.10 +dhcp-option=option:router,PH_IP_MOON1 +dhcp-option=option:dns-server,PH_IP_VENUS +dhcp-option=option:netbios-ns,PH_IP_ALICE dhcp-option=option:domain-name,strongswan.org log-dhcp diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd deleted file mode 100755 index 4044dcc35..000000000 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd +++ /dev/null @@ -1,24 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop" - -depend() { - need net - need logger -} - -start() { - ebegin "Starting DHCP server" - start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd - eend $? -} - -stop() { - ebegin "Stopping DHCP server" - start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid - rm -f /var/state/dhcp/dhcpd.leases - touch /var/state/dhcp/dhcpd.leases - eend $? -} diff --git a/testing/tests/ikev2/dhcp-static-mac/posttest.dat b/testing/tests/ikev2/dhcp-static-mac/posttest.dat index e1aadc618..7fff9981b 100644 --- a/testing/tests/ikev2/dhcp-static-mac/posttest.dat +++ b/testing/tests/ikev2/dhcp-static-mac/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -venus::/etc/init.d/dhcpd stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush alice::arp -d 10.1.0.30 alice::arp -d 10.1.0.40 diff --git a/testing/tests/ikev2/dhcp-static-mac/pretest.dat b/testing/tests/ikev2/dhcp-static-mac/pretest.dat index bd36b4fe3..5670a2e89 100644 --- a/testing/tests/ikev2/dhcp-static-mac/pretest.dat +++ b/testing/tests/ikev2/dhcp-static-mac/pretest.dat @@ -1,12 +1,12 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -venus::cat /etc/dhcpd.conf -venus::/etc/init.d/dhcpd start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +venus::cat /etc/dhcp/dhcpd.conf +venus::/etc/init.d/isc-dhcp-server start 2> /dev/null carol::ipsec start dave::ipsec start moon::ipsec start -carol::sleep 2 +carol::sleep 2 carol::ipsec up home dave::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/dhcp-static-mac/test.conf b/testing/tests/ikev2/dhcp-static-mac/test.conf index a2ad7b25f..fd8a59c90 100644 --- a/testing/tests/ikev2/dhcp-static-mac/test.conf +++ b/testing/tests/ikev2/dhcp-static-mac/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/double-nat-net/evaltest.dat b/testing/tests/ikev2/double-nat-net/evaltest.dat index 05dc82d70..52c561964 100644 --- a/testing/tests/ikev2/double-nat-net/evaltest.dat +++ b/testing/tests/ikev2/double-nat-net/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/double-nat-net/posttest.dat b/testing/tests/ikev2/double-nat-net/posttest.dat index 484297418..63d4f98e7 100644 --- a/testing/tests/ikev2/double-nat-net/posttest.dat +++ b/testing/tests/ikev2/double-nat-net/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/double-nat-net/pretest.dat b/testing/tests/ikev2/double-nat-net/pretest.dat index 41b69aed6..17a4fe5eb 100644 --- a/testing/tests/ikev2/double-nat-net/pretest.dat +++ b/testing/tests/ikev2/double-nat-net/pretest.dat @@ -1,8 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -bob::echo 1 > /proc/sys/net/ipv4/ip_forward -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev2/double-nat-net/test.conf b/testing/tests/ikev2/double-nat-net/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev2/double-nat-net/test.conf +++ b/testing/tests/ikev2/double-nat-net/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/double-nat/evaltest.dat b/testing/tests/ikev2/double-nat/evaltest.dat index b080482f9..9ddad2de5 100644 --- a/testing/tests/ikev2/double-nat/evaltest.dat +++ b/testing/tests/ikev2/double-nat/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules b/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/double-nat/posttest.dat b/testing/tests/ikev2/double-nat/posttest.dat index 5d39e406d..aa806bfc9 100644 --- a/testing/tests/ikev2/double-nat/posttest.dat +++ b/testing/tests/ikev2/double-nat/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/double-nat/pretest.dat b/testing/tests/ikev2/double-nat/pretest.dat index 10ba6d735..65f18b756 100644 --- a/testing/tests/ikev2/double-nat/pretest.dat +++ b/testing/tests/ikev2/double-nat/pretest.dat @@ -1,7 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev2/double-nat/test.conf b/testing/tests/ikev2/double-nat/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev2/double-nat/test.conf +++ b/testing/tests/ikev2/double-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/dpd-clear/test.conf b/testing/tests/ikev2/dpd-clear/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/dpd-clear/test.conf +++ b/testing/tests/ikev2/dpd-clear/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-hold/test.conf b/testing/tests/ikev2/dpd-hold/test.conf index 5442565f8..f8b62b953 100644 --- a/testing/tests/ikev2/dpd-hold/test.conf +++ b/testing/tests/ikev2/dpd-hold/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-restart/test.conf b/testing/tests/ikev2/dpd-restart/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/dpd-restart/test.conf +++ b/testing/tests/ikev2/dpd-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dynamic-initiator/evaltest.dat b/testing/tests/ikev2/dynamic-initiator/evaltest.dat index 9d050ecde..3db70be71 100644 --- a/testing/tests/ikev2/dynamic-initiator/evaltest.dat +++ b/testing/tests/ikev2/dynamic-initiator/evaltest.dat @@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES moon:: cat /var/log/daemon.log::destroying duplicate IKE_SA for.*carol@strongswan.org.*received INITIAL_CONTACT::YES moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/dynamic-initiator/posttest.dat b/testing/tests/ikev2/dynamic-initiator/posttest.dat index 4dbf3d4a4..83063a23f 100644 --- a/testing/tests/ikev2/dynamic-initiator/posttest.dat +++ b/testing/tests/ikev2/dynamic-initiator/posttest.dat @@ -2,8 +2,8 @@ dave::ipsec stop carol::ipsec stop dave::sleep 1 moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush dave::rm /etc/ipsec.d/certs/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/dynamic-initiator/pretest.dat b/testing/tests/ikev2/dynamic-initiator/pretest.dat index 92681011f..3e1cfce77 100644 --- a/testing/tests/ikev2/dynamic-initiator/pretest.dat +++ b/testing/tests/ikev2/dynamic-initiator/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/dynamic-initiator/test.conf b/testing/tests/ikev2/dynamic-initiator/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/dynamic-initiator/test.conf +++ b/testing/tests/ikev2/dynamic-initiator/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/dynamic-two-peers/evaltest.dat b/testing/tests/ikev2/dynamic-two-peers/evaltest.dat index 1d5ff68ec..82d2e7318 100644 --- a/testing/tests/ikev2/dynamic-two-peers/evaltest.dat +++ b/testing/tests/ikev2/dynamic-two-peers/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dynamic-two-peers/posttest.dat b/testing/tests/ikev2/dynamic-two-peers/posttest.dat index e120b87db..7b2609846 100644 --- a/testing/tests/ikev2/dynamic-two-peers/posttest.dat +++ b/testing/tests/ikev2/dynamic-two-peers/posttest.dat @@ -3,6 +3,6 @@ dave::ipsec stop moon::sleep 1 moon::ipsec stop moon::mv /etc/hosts.ori /etc/hosts -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/dynamic-two-peers/pretest.dat b/testing/tests/ikev2/dynamic-two-peers/pretest.dat index 6596a2527..4bb2a4686 100644 --- a/testing/tests/ikev2/dynamic-two-peers/pretest.dat +++ b/testing/tests/ikev2/dynamic-two-peers/pretest.dat @@ -1,8 +1,8 @@ moon::mv /etc/hosts /etc/hosts.ori moon::mv /etc/hosts.stale /etc/hosts -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/dynamic-two-peers/test.conf b/testing/tests/ikev2/dynamic-two-peers/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/dynamic-two-peers/test.conf +++ b/testing/tests/ikev2/dynamic-two-peers/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat index 74150fb04..d5d3bc0d3 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ip xfrm state::aead rfc4543(gcm(aes))::YES diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat +++ b/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat +++ b/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/test.conf b/testing/tests/ikev2/esp-alg-aes-gmac/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/test.conf +++ b/testing/tests/ikev2/esp-alg-aes-gmac/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat b/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat index a66edc5fe..366539936 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat @@ -2,10 +2,10 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::3DES_CBC/HMAC_MD5_128::YES carol::ipsec statusall 2> /dev/null::3DES_CBC/HMAC_MD5_128::YES -moon:: ip xfrm state::auth hmac(md5)::YES -carol::ip xfrm state::auth hmac(md5)::YES +moon:: ip xfrm state::auth-trunc hmac(md5)::YES +carol::ip xfrm state::auth-trunc hmac(md5)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 184::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 184::YES diff --git a/testing/tests/ikev2/esp-alg-md5-128/posttest.dat b/testing/tests/ikev2/esp-alg-md5-128/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/posttest.dat +++ b/testing/tests/ikev2/esp-alg-md5-128/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-md5-128/pretest.dat b/testing/tests/ikev2/esp-alg-md5-128/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/pretest.dat +++ b/testing/tests/ikev2/esp-alg-md5-128/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-md5-128/test.conf b/testing/tests/ikev2/esp-alg-md5-128/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/test.conf +++ b/testing/tests/ikev2/esp-alg-md5-128/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/esp-alg-null/evaltest.dat b/testing/tests/ikev2/esp-alg-null/evaltest.dat index 937d85ed2..1b9c6c27e 100644 --- a/testing/tests/ikev2/esp-alg-null/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-null/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES moon:: ip xfrm state::enc ecb(cipher_null)::YES diff --git a/testing/tests/ikev2/esp-alg-null/posttest.dat b/testing/tests/ikev2/esp-alg-null/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-null/posttest.dat +++ b/testing/tests/ikev2/esp-alg-null/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-null/pretest.dat b/testing/tests/ikev2/esp-alg-null/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev2/esp-alg-null/pretest.dat +++ b/testing/tests/ikev2/esp-alg-null/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-null/test.conf b/testing/tests/ikev2/esp-alg-null/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-null/test.conf +++ b/testing/tests/ikev2/esp-alg-null/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat b/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat index 52c27cba5..00c353686 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat @@ -2,10 +2,10 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_160::YES carol::ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_160::YES -moon:: ip xfrm state::auth hmac(sha1)::YES -carol::ip xfrm state::auth hmac(sha1)::YES +moon:: ip xfrm state::auth-trunc hmac(sha1)::YES +carol::ip xfrm state::auth-trunc hmac(sha1)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 204::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 204::YES diff --git a/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat b/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat +++ b/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat b/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat +++ b/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-sha1-160/test.conf b/testing/tests/ikev2/esp-alg-sha1-160/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/test.conf +++ b/testing/tests/ikev2/esp-alg-sha1-160/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/farp/evaltest.dat b/testing/tests/ikev2/farp/evaltest.dat index 21b10d170..891ec20d5 100644 --- a/testing/tests/ikev2/farp/evaltest.dat +++ b/testing/tests/ikev2/farp/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/farp/posttest.dat b/testing/tests/ikev2/farp/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/farp/posttest.dat +++ b/testing/tests/ikev2/farp/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/farp/pretest.dat b/testing/tests/ikev2/farp/pretest.dat index 709931e1b..f0254da6c 100644 --- a/testing/tests/ikev2/farp/pretest.dat +++ b/testing/tests/ikev2/farp/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules alice::arp -d 10.1.0.30 alice::arp -d 10.1.0.40 carol::ipsec start diff --git a/testing/tests/ikev2/farp/test.conf b/testing/tests/ikev2/farp/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/farp/test.conf +++ b/testing/tests/ikev2/farp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/force-udp-encaps/evaltest.dat b/testing/tests/ikev2/force-udp-encaps/evaltest.dat index d7fe707ab..36af646d2 100644 --- a/testing/tests/ikev2/force-udp-encaps/evaltest.dat +++ b/testing/tests/ikev2/force-udp-encaps/evaltest.dat @@ -3,6 +3,6 @@ sun:: ipsec status 2> /dev/null::nat.t.*ESTABLISHED.*sun.strongswan.org.*alice@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES alice::cat /var/log/daemon.log::faking NAT situation to enforce UDP encapsulation::YES -alice:: ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP alice.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > alice.strongswan.org.*: UDP::YES +alice:: ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP alice.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > alice.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 5bb63f5ac..000000000 --- a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,76 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/force-udp-encaps/posttest.dat b/testing/tests/ikev2/force-udp-encaps/posttest.dat index 979f2fcd0..03edb42cb 100644 --- a/testing/tests/ikev2/force-udp-encaps/posttest.dat +++ b/testing/tests/ikev2/force-udp-encaps/posttest.dat @@ -1,6 +1,6 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON winnetou::ip route del 10.1.0.0/16 via PH_IP_MOON diff --git a/testing/tests/ikev2/force-udp-encaps/pretest.dat b/testing/tests/ikev2/force-udp-encaps/pretest.dat index 6f00cd387..7be66867a 100644 --- a/testing/tests/ikev2/force-udp-encaps/pretest.dat +++ b/testing/tests/ikev2/force-udp-encaps/pretest.dat @@ -1,8 +1,7 @@ -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ip route add 10.1.0.0/16 via PH_IP_MOON winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON -moon::echo 1 > /proc/sys/net/ipv4/ip_forward alice::ipsec start sun::ipsec start alice::sleep 4 diff --git a/testing/tests/ikev2/force-udp-encaps/test.conf b/testing/tests/ikev2/force-udp-encaps/test.conf index d84149aaf..42fa97190 100644 --- a/testing/tests/ikev2/force-udp-encaps/test.conf +++ b/testing/tests/ikev2/force-udp-encaps/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/host2host-cert/evaltest.dat b/testing/tests/ikev2/host2host-cert/evaltest.dat index 53e5589ca..3305f4558 100644 --- a/testing/tests/ikev2/host2host-cert/evaltest.dat +++ b/testing/tests/ikev2/host2host-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-cert/posttest.dat b/testing/tests/ikev2/host2host-cert/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/host2host-cert/posttest.dat +++ b/testing/tests/ikev2/host2host-cert/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/host2host-cert/pretest.dat b/testing/tests/ikev2/host2host-cert/pretest.dat index 1fa70177c..3bce9f6e5 100644 --- a/testing/tests/ikev2/host2host-cert/pretest.dat +++ b/testing/tests/ikev2/host2host-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/host2host-cert/test.conf b/testing/tests/ikev2/host2host-cert/test.conf index 305a67316..55d6e9fd6 100644 --- a/testing/tests/ikev2/host2host-cert/test.conf +++ b/testing/tests/ikev2/host2host-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-swapped/evaltest.dat b/testing/tests/ikev2/host2host-swapped/evaltest.dat index 53e5589ca..3305f4558 100644 --- a/testing/tests/ikev2/host2host-swapped/evaltest.dat +++ b/testing/tests/ikev2/host2host-swapped/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-swapped/posttest.dat b/testing/tests/ikev2/host2host-swapped/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/host2host-swapped/posttest.dat +++ b/testing/tests/ikev2/host2host-swapped/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/host2host-swapped/pretest.dat b/testing/tests/ikev2/host2host-swapped/pretest.dat index 1fa70177c..3bce9f6e5 100644 --- a/testing/tests/ikev2/host2host-swapped/pretest.dat +++ b/testing/tests/ikev2/host2host-swapped/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/host2host-swapped/test.conf b/testing/tests/ikev2/host2host-swapped/test.conf index 305a67316..55d6e9fd6 100644 --- a/testing/tests/ikev2/host2host-swapped/test.conf +++ b/testing/tests/ikev2/host2host-swapped/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-transport/evaltest.dat b/testing/tests/ikev2/host2host-transport/evaltest.dat index 3021b5e04..fc49e57d8 100644 --- a/testing/tests/ikev2/host2host-transport/evaltest.dat +++ b/testing/tests/ikev2/host2host-transport/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-transport/posttest.dat b/testing/tests/ikev2/host2host-transport/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/host2host-transport/posttest.dat +++ b/testing/tests/ikev2/host2host-transport/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/host2host-transport/pretest.dat b/testing/tests/ikev2/host2host-transport/pretest.dat index e2d98f2eb..99789b90f 100644 --- a/testing/tests/ikev2/host2host-transport/pretest.dat +++ b/testing/tests/ikev2/host2host-transport/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/ikev2/host2host-transport/test.conf b/testing/tests/ikev2/host2host-transport/test.conf index cf2e704fd..5a286c84f 100644 --- a/testing/tests/ikev2/host2host-transport/test.conf +++ b/testing/tests/ikev2/host2host-transport/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/inactivity-timeout/evaltest.dat b/testing/tests/ikev2/inactivity-timeout/evaltest.dat index dceceaef6..221c59318 100644 --- a/testing/tests/ikev2/inactivity-timeout/evaltest.dat +++ b/testing/tests/ikev2/inactivity-timeout/evaltest.dat @@ -1,8 +1,8 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::sleep 15::NO carol::cat /var/log/daemon.log::deleting CHILD_SA after 10 seconds of inactivity::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED::NO carol::ipsec status 2> /dev/null::home.*INSTALLED::NO -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::NO +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/inactivity-timeout/posttest.dat b/testing/tests/ikev2/inactivity-timeout/posttest.dat index 94a400606..6ca9c5b35 100644 --- a/testing/tests/ikev2/inactivity-timeout/posttest.dat +++ b/testing/tests/ikev2/inactivity-timeout/posttest.dat @@ -1,4 +1,3 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/inactivity-timeout/pretest.dat b/testing/tests/ikev2/inactivity-timeout/pretest.dat index 3c3df0196..b949aaeaf 100644 --- a/testing/tests/ikev2/inactivity-timeout/pretest.dat +++ b/testing/tests/ikev2/inactivity-timeout/pretest.dat @@ -1,7 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start -carol::sleep 1 +carol::sleep 1 carol::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/inactivity-timeout/test.conf b/testing/tests/ikev2/inactivity-timeout/test.conf index acb73b06f..11423f723 100644 --- a/testing/tests/ikev2/inactivity-timeout/test.conf +++ b/testing/tests/ikev2/inactivity-timeout/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ip-pool-db/evaltest.dat b/testing/tests/ikev2/ip-pool-db/evaltest.dat index 941cb34c0..42e353084 100644 --- a/testing/tests/ikev2/ip-pool-db/evaltest.dat +++ b/testing/tests/ikev2/ip-pool-db/evaltest.dat @@ -6,7 +6,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES @@ -15,7 +15,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev2/ip-pool-db/posttest.dat b/testing/tests/ikev2/ip-pool-db/posttest.dat index 5b88b2163..c99f347e3 100644 --- a/testing/tests/ikev2/ip-pool-db/posttest.dat +++ b/testing/tests/ikev2/ip-pool-db/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ipsec pool --del bigpool 2> /dev/null moon::ipsec pool --del dns 2> /dev/null moon::ipsec pool --del nbns 2> /dev/null diff --git a/testing/tests/ikev2/ip-pool-db/pretest.dat b/testing/tests/ikev2/ip-pool-db/pretest.dat index 4a2add194..fce551c69 100644 --- a/testing/tests/ikev2/ip-pool-db/pretest.dat +++ b/testing/tests/ikev2/ip-pool-db/pretest.dat @@ -4,9 +4,9 @@ moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2> moon::ipsec pool --addattr dns --server PH_IP_WINNETOU 2> /dev/null moon::ipsec pool --addattr dns --server PH_IP_VENUS 2> /dev/null moon::ipsec pool --addattr nbns --server PH_IP_VENUS 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ip-pool-db/test.conf b/testing/tests/ikev2/ip-pool-db/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-pool-db/test.conf +++ b/testing/tests/ikev2/ip-pool-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-pool-wish/evaltest.dat b/testing/tests/ikev2/ip-pool-wish/evaltest.dat index fd15d5209..44310cd16 100644 --- a/testing/tests/ikev2/ip-pool-wish/evaltest.dat +++ b/testing/tests/ikev2/ip-pool-wish/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org.::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES moon:: cat /var/log/daemon.log::peer requested virtual IP PH_IP_CAROL1::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev2/ip-pool-wish/posttest.dat b/testing/tests/ikev2/ip-pool-wish/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/ip-pool-wish/posttest.dat +++ b/testing/tests/ikev2/ip-pool-wish/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/ip-pool-wish/pretest.dat b/testing/tests/ikev2/ip-pool-wish/pretest.dat index 1f4ff286a..1466fd2f2 100644 --- a/testing/tests/ikev2/ip-pool-wish/pretest.dat +++ b/testing/tests/ikev2/ip-pool-wish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ip-pool-wish/test.conf b/testing/tests/ikev2/ip-pool-wish/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-pool-wish/test.conf +++ b/testing/tests/ikev2/ip-pool-wish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-pool/evaltest.dat b/testing/tests/ikev2/ip-pool/evaltest.dat index db46646a6..8ea7960b5 100644 --- a/testing/tests/ikev2/ip-pool/evaltest.dat +++ b/testing/tests/ikev2/ip-pool/evaltest.dat @@ -3,19 +3,19 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES moon:: ipsec leases 10.3.0.0/28 2> /dev/null::2/14, 2 online::YES -moon:: ipsec leases 10.3.0.0/28 10.3.0.1 2> /dev/null::carol@strongswan.org::YES -moon:: ipsec leases 10.3.0.0/28 10.3.0.2 2> /dev/null::dave@strongswan.org::YES +moon:: ipsec leases 10.3.0.0/28 PH_IP_CAROL1 2> /dev/null::carol@strongswan.org::YES +moon:: ipsec leases 10.3.0.0/28 PH_IP_DAVE1 2> /dev/null::dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::ESP diff --git a/testing/tests/ikev2/ip-pool/posttest.dat b/testing/tests/ikev2/ip-pool/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/ip-pool/posttest.dat +++ b/testing/tests/ikev2/ip-pool/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/ip-pool/pretest.dat b/testing/tests/ikev2/ip-pool/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev2/ip-pool/pretest.dat +++ b/testing/tests/ikev2/ip-pool/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ip-pool/test.conf b/testing/tests/ikev2/ip-pool/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-pool/test.conf +++ b/testing/tests/ikev2/ip-pool/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-split-pools-db/test.conf b/testing/tests/ikev2/ip-split-pools-db/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-split-pools-db/test.conf +++ b/testing/tests/ikev2/ip-split-pools-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat index fd0413d11..fdc3d4d3f 100644 --- a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat @@ -28,10 +28,10 @@ carol::cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU to /etc/res dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU to /etc/resolv.conf::YES alice::cat /var/log/daemon.log::installing DNS server PH_IP_ALICE to /etc/resolv.conf::YES venus::cat /var/log/daemon.log::installing DNS server PH_IP_VENUS to /etc/resolv.conf::YES -alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES -dave:: ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES +alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +dave:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_req=1::YES +dave:: ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_req=1::YES alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES alice::tcpdump::IP moon1.strongswan.org > alice.strongswan.org: ESP::YES dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables deleted file mode 100755 index bb9d03acd..000000000 --- a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # masquerade crl fetches to winnetou - iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..a0ed9f0e6 --- /dev/null +++ b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules @@ -0,0 +1,43 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT + +*nat + +# masquerade crl fetches to winnetou +-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE + +COMMIT diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-db/posttest.dat b/testing/tests/ikev2/ip-two-pools-db/posttest.dat index 7b0393ebd..9c0bb5cae 100644 --- a/testing/tests/ikev2/ip-two-pools-db/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/posttest.dat @@ -3,11 +3,11 @@ venus::ipsec stop carol::ipsec stop dave::ipsec stop moon::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ip route del 10.3.0.0/16 via PH_IP_MOON moon::ip route del 10.4.0.0/16 via PH_IP_MOON1 moon::conntrack -F diff --git a/testing/tests/ikev2/ip-two-pools-db/pretest.dat b/testing/tests/ikev2/ip-two-pools-db/pretest.dat index e4eb8b0b9..3aba87994 100644 --- a/testing/tests/ikev2/ip-two-pools-db/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/pretest.dat @@ -8,11 +8,11 @@ moon::ipsec pool --addattr dns --server PH_IP_WINNETOU --pool extpool 2> /dev/nu moon::ipsec pool --statusattr 2> /dev/null moon::ip route add 10.3.0.0/16 via PH_IP_MOON moon::ip route add 10.4.0.0/16 via PH_IP_MOON1 -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules alice::ipsec start venus::ipsec start carol::ipsec start diff --git a/testing/tests/ikev2/ip-two-pools-db/test.conf b/testing/tests/ikev2/ip-two-pools-db/test.conf index ea1307b16..c88e11d28 100644 --- a/testing/tests/ikev2/ip-two-pools-db/test.conf +++ b/testing/tests/ikev2/ip-two-pools-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice venus carol dave" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus moon carol dave" diff --git a/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat b/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat index 3b09b32bd..0d7a36452 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat @@ -13,8 +13,8 @@ moon:: ipsec pool --status 2> /dev/null::intpool.*10.4.0.1.*10.4.1.244.*static.* moon:: ipsec pool --leases --filter pool=intpool,addr=10.4.0.1,id=alice@strongswan.org 2> /dev/null::online::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES -carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables deleted file mode 100755 index bb9d03acd..000000000 --- a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # masquerade crl fetches to winnetou - iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..a0ed9f0e6 --- /dev/null +++ b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules @@ -0,0 +1,43 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT + +*nat + +# masquerade crl fetches to winnetou +-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE + +COMMIT diff --git a/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat b/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat index db5e6237f..a3924b2f6 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop alice::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -alice::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +alice::iptables-restore < /etc/iptables.flush moon::conntrack -F moon::ipsec pool --del intpool 2> /dev/null moon::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat b/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat index b579464f2..b74c1e07a 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat @@ -1,9 +1,9 @@ moon::cat /etc/ipsec.d/tables.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db moon::ipsec pool --add intpool --start 10.4.0.1 --end 10.4.1.244 --timeout 0 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules carol::ipsec start moon::ipsec start alice::ipsec start diff --git a/testing/tests/ikev2/ip-two-pools-mixed/test.conf b/testing/tests/ikev2/ip-two-pools-mixed/test.conf index 329774c0a..1ed3473ab 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/test.conf +++ b/testing/tests/ikev2/ip-two-pools-mixed/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice carol" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon carol" diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat index 7a0c1ed6f..0bf3500b5 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat @@ -5,5 +5,5 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES carol::cat /var/log/daemon.log::installing new virtual IP fec3:\:1::YES carol::cat /var/log/daemon.log::TS 10.3.0.1/32 fec3:\:1/128 === 10.1.0.0/16 fec1:\:/16::YES -carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat index fafe030c1..bb20cae05 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat @@ -1,5 +1,4 @@ alice::ip -6 route del default via fec1:\:1 carol::ipsec stop -moon::echo 0 > /proc/sys/net/ipv6/conf/all/forwarding moon::ipsec stop moon::conntrack -F diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat index f97ff54b5..04139badf 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat @@ -1,5 +1,4 @@ alice::ip -6 route add default via fec1:\:1 -moon::echo 1 > /proc/sys/net/ipv6/conf/all/forwarding moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/test.conf b/testing/tests/ikev2/ip-two-pools-v4v6/test.conf index c86dd1d66..cd03759f0 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/test.conf +++ b/testing/tests/ikev2/ip-two-pools-v4v6/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="carol" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ip-two-pools/evaltest.dat b/testing/tests/ikev2/ip-two-pools/evaltest.dat index 5de62e447..fad3781d7 100644 --- a/testing/tests/ikev2/ip-two-pools/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools/evaltest.dat @@ -10,12 +10,12 @@ moon:: cat /var/log/daemon.log::adding virtual IP address pool.*10.4.0.0/28::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool.*10.3.0.0/28::YES moon:: ipsec leases 10.3.0.0/28 2> /dev/null::1/14, 1 online::YES moon:: ipsec leases 10.4.0.0/28 2> /dev/null::1/14, 1 online::YES -moon:: ipsec leases 10.3.0.0/28 10.3.0.1 2> /dev/null::carol@strongswan.org::YES +moon:: ipsec leases 10.3.0.0/28 PH_IP_CAROL1 2> /dev/null::carol@strongswan.org::YES moon:: ipsec leases 10.4.0.0/28 10.4.0.1 2> /dev/null::alice@strongswan.org::YES -carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES +carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES -carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables deleted file mode 100755 index bb9d03acd..000000000 --- a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # masquerade crl fetches to winnetou - iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..a0ed9f0e6 --- /dev/null +++ b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules @@ -0,0 +1,43 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT + +*nat + +# masquerade crl fetches to winnetou +-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE + +COMMIT diff --git a/testing/tests/ikev2/ip-two-pools/posttest.dat b/testing/tests/ikev2/ip-two-pools/posttest.dat index f41bb0fbc..2fbc2c3a0 100644 --- a/testing/tests/ikev2/ip-two-pools/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools/posttest.dat @@ -1,8 +1,8 @@ alice::ipsec stop carol::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -alice::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +alice::iptables-restore < /etc/iptables.flush moon::conntrack -F moon::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/ikev2/ip-two-pools/pretest.dat b/testing/tests/ikev2/ip-two-pools/pretest.dat index db422a105..4e8b639f4 100644 --- a/testing/tests/ikev2/ip-two-pools/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules carol::ipsec start moon::ipsec start alice::ipsec start diff --git a/testing/tests/ikev2/ip-two-pools/test.conf b/testing/tests/ikev2/ip-two-pools/test.conf index 329774c0a..1ed3473ab 100644 --- a/testing/tests/ikev2/ip-two-pools/test.conf +++ b/testing/tests/ikev2/ip-two-pools/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice carol" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon carol" diff --git a/testing/tests/ikev2/mobike-nat/evaltest.dat b/testing/tests/ikev2/mobike-nat/evaltest.dat index aded7a040..c71e3f7c1 100644 --- a/testing/tests/ikev2/mobike-nat/evaltest.dat +++ b/testing/tests/ikev2/mobike-nat/evaltest.dat @@ -2,14 +2,14 @@ alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN:: sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::/etc/init.d/net.eth1 stop::No output expected::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ifdown eth1::No output expected::NO alice::sleep 1::No output expected::NO alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_MOON::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES moon::tcpdump::moon.strongswan.org.*sun.strongswan.org.*: UDP-encap: ESP.*seq=0x2::YES diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables deleted file mode 100755 index cf0d65c58..000000000 --- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,87 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf index efbce1fb2..ffb7f563a 100644 --- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf @@ -10,7 +10,7 @@ conn %default keyexchange=ikev2 conn mobike - left=PH_IP_ALICE1 + left=192.168.0.50 leftsourceip=%config leftcert=aliceCert.pem leftid=alice@strongswan.org diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..6dd261f20 --- /dev/null +++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules @@ -0,0 +1,38 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 642c414d5..000000000 --- a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..0a7d1fa40 --- /dev/null +++ b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-nat/posttest.dat b/testing/tests/ikev2/mobike-nat/posttest.dat index cd0d4df25..f4e5316c9 100644 --- a/testing/tests/ikev2/mobike-nat/posttest.dat +++ b/testing/tests/ikev2/mobike-nat/posttest.dat @@ -1,6 +1,6 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/mobike-nat/pretest.dat b/testing/tests/ikev2/mobike-nat/pretest.dat index 08c2be95c..86ac6e7e0 100644 --- a/testing/tests/ikev2/mobike-nat/pretest.dat +++ b/testing/tests/ikev2/mobike-nat/pretest.dat @@ -1,12 +1,11 @@ -alice::/etc/init.d/net.eth1 start -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +alice::ifup eth1 +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::conntrack -F -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start sun::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up mobike alice::sleep 1 diff --git a/testing/tests/ikev2/mobike-nat/test.conf b/testing/tests/ikev2/mobike-nat/test.conf index 24a0cf3a4..70c64c503 100644 --- a/testing/tests/ikev2/mobike-nat/test.conf +++ b/testing/tests/ikev2/mobike-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="bob moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat b/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat index c4c7b0b6f..17593ef82 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat +++ b/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat @@ -1,15 +1,15 @@ -alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::YES -sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES +alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES +sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::/etc/init.d/net.eth1 stop::No output expected::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ifdown eth1::No output expected::NO alice::sleep 1::No output expected::NO alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES moon::tcpdump::alice.strongswan.org.*sun.strongswan.org.*: ESP.*seq=0x2::YES diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables deleted file mode 100755 index cf0d65c58..000000000 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,87 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf index efbce1fb2..ffb7f563a 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf @@ -10,7 +10,7 @@ conn %default keyexchange=ikev2 conn mobike - left=PH_IP_ALICE1 + left=192.168.0.50 leftsourceip=%config leftcert=aliceCert.pem leftid=alice@strongswan.org diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..a238c8d19 --- /dev/null +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules @@ -0,0 +1,38 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 642c414d5..000000000 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf index eeee6ffb0..2b0c8aebd 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf @@ -14,7 +14,7 @@ conn mobike leftcert=sunCert.pem leftid=@sun.strongswan.org leftsubnet=10.2.0.0/16 - right=PH_IP_ALICE1 + right=192.168.0.50 rightsourceip=10.3.0.3 rightid=alice@strongswan.org auto=add diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..d86a461ac --- /dev/null +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-virtual-ip/posttest.dat b/testing/tests/ikev2/mobike-virtual-ip/posttest.dat index 32fdf0053..95c963091 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/posttest.dat +++ b/testing/tests/ikev2/mobike-virtual-ip/posttest.dat @@ -1,5 +1,5 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON diff --git a/testing/tests/ikev2/mobike-virtual-ip/pretest.dat b/testing/tests/ikev2/mobike-virtual-ip/pretest.dat index 6666e7794..067c1a1ec 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/pretest.dat +++ b/testing/tests/ikev2/mobike-virtual-ip/pretest.dat @@ -1,10 +1,9 @@ -alice::/etc/init.d/net.eth1 start -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::ifup eth1 +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ip route add 10.1.0.0/16 via PH_IP_MOON alice::ipsec start sun::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up mobike alice::sleep 1 diff --git a/testing/tests/ikev2/mobike-virtual-ip/test.conf b/testing/tests/ikev2/mobike-virtual-ip/test.conf index 24a0cf3a4..70c64c503 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/test.conf +++ b/testing/tests/ikev2/mobike-virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="bob moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/mobike/evaltest.dat b/testing/tests/ikev2/mobike/evaltest.dat index ebf5ad4cf..e3464040e 100644 --- a/testing/tests/ikev2/mobike/evaltest.dat +++ b/testing/tests/ikev2/mobike/evaltest.dat @@ -1,15 +1,15 @@ -alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::YES -sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES -alice::ipsec statusall 2> /dev/null::PH_IP_ALICE1/32 === 10.2.0.0/16::YES -sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === PH_IP_ALICE1/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::/etc/init.d/net.eth1 stop::No output expected::NO +alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES +sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES +alice::ipsec statusall 2> /dev/null::192.168.0.50/32 === 10.2.0.0/16::YES +sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 192.168.0.50/32::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ifdown eth1::No output expected::NO alice::sleep 1::No output expected::NO alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES alice::ipsec statusall 2> /dev/null::PH_IP_ALICE/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === PH_IP_ALICE/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES moon::tcpdump::alice.strongswan.org.*sun.strongswan.org: ESP.*seq=0x2::YES diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables deleted file mode 100755 index cf0d65c58..000000000 --- a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,87 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf index 66cbce781..95683fdc3 100644 --- a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf @@ -10,7 +10,7 @@ conn %default keyexchange=ikev2 conn mobike - left=PH_IP_ALICE1 + left=192.168.0.50 leftcert=aliceCert.pem leftid=alice@strongswan.org right=PH_IP_SUN diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..a238c8d19 --- /dev/null +++ b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules @@ -0,0 +1,38 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 6934b1948..000000000 --- a/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,90 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf index f3fa9209c..f7693106f 100644 --- a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf @@ -14,6 +14,6 @@ conn mobike leftcert=sunCert.pem leftid=@sun.strongswan.org leftsubnet=10.2.0.0/16 - right=PH_IP_ALICE1 + right=192.168.0.50 rightid=alice@strongswan.org auto=add diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..d86a461ac --- /dev/null +++ b/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike/posttest.dat b/testing/tests/ikev2/mobike/posttest.dat index 32fdf0053..95c963091 100644 --- a/testing/tests/ikev2/mobike/posttest.dat +++ b/testing/tests/ikev2/mobike/posttest.dat @@ -1,5 +1,5 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON diff --git a/testing/tests/ikev2/mobike/pretest.dat b/testing/tests/ikev2/mobike/pretest.dat index 6666e7794..067c1a1ec 100644 --- a/testing/tests/ikev2/mobike/pretest.dat +++ b/testing/tests/ikev2/mobike/pretest.dat @@ -1,10 +1,9 @@ -alice::/etc/init.d/net.eth1 start -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::ifup eth1 +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ip route add 10.1.0.0/16 via PH_IP_MOON alice::ipsec start sun::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up mobike alice::sleep 1 diff --git a/testing/tests/ikev2/mobike/test.conf b/testing/tests/ikev2/mobike/test.conf index 24a0cf3a4..70c64c503 100644 --- a/testing/tests/ikev2/mobike/test.conf +++ b/testing/tests/ikev2/mobike/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="bob moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat index 4a72b4392..65a003d23 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat @@ -6,7 +6,7 @@ moon:: cat /var/log/daemon.log::received EAP identity .*228060123456001::YES moon:: cat /var/log/daemon.log::authentication of .*228060123456001@strongswan.org.* with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-mult.*ESTABLISHED.*228060123456001@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*228060123456001@strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::cat /var/log/daemon.log::authentication of .*dave@strongswan.org.* with RSA signature successful::YES @@ -18,4 +18,4 @@ moon::cat /var/log/daemon.log::EAP method EAP_SIM failed for peer 22806012345600 moon::ipsec status 2> /dev/null::rw-mult.*ESTABLISHED.*228060123456002@strongswan.org::NO dave::cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES dave::ipsec status 2> /dev/null::home.*ESTABLISHED::NO -dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files new file mode 100644 index 000000000..10c26aa15 --- /dev/null +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files @@ -0,0 +1,3 @@ +sim_files { + simtriplets = "/etc/freeradius/triplets.dat" +} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/sites-available/default index dfceb037d..91425f812 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/sites-available/default @@ -59,4 +59,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/triplets.dat index 002ee94d1..aaabab89e 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/triplets.dat @@ -4,4 +4,3 @@ 228060123456002,33000000000000000000000000000000,33112233,335566778899AABB 228060123456002,34000000000000000000000000000000,34112233,345566778899AABB 228060123456002,35000000000000000000000000000000,35112233,355566778899AABB - diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/users b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat index dbe56013a..6a4da6631 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat @@ -1,7 +1,4 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat index b3fd4cbf1..2d54c6027 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat @@ -1,11 +1,8 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::cat /etc/raddb/clients.conf -alice::cat /etc/raddb/eap.conf -alice::cat /etc/raddb/proxy.conf -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +alice::cat /etc/freeradius/clients.conf +alice::cat /etc/freeradius/eap.conf +alice::cat /etc/freeradius/proxy.conf +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf index 70416826e..42d23a50b 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf @@ -1,21 +1,25 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" + +# Guest instances on which FreeRadius is started +# +RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat b/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat index c8e7adcb7..2eebc0f84 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-cr-init/test.conf b/testing/tests/ikev2/multi-level-ca-cr-init/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-init/test.conf +++ b/testing/tests/ikev2/multi-level-ca-cr-init/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat b/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf b/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf +++ b/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 4f4f3228b..000000000 --- a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ldap crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..debcc2181 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow ldap crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat b/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat index ec4ba6e10..6f0ec4b97 100644 --- a/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat +++ b/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat @@ -3,5 +3,5 @@ carol::ipsec stop dave::ipsec stop moon::rm /etc/ipsec.d/cacerts/* winnetou::/etc/init.d/slapd stop -moon::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat b/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat index 322f42102..41319ae4d 100644 --- a/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat @@ -1,5 +1,5 @@ winnetou::/etc/init.d/slapd start -moon::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-ldap/test.conf b/testing/tests/ikev2/multi-level-ca-ldap/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-ldap/test.conf +++ b/testing/tests/ikev2/multi-level-ca-ldap/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca-loop/pretest.dat b/testing/tests/ikev2/multi-level-ca-loop/pretest.dat index 0a0ec22bf..bb538c160 100644 --- a/testing/tests/ikev2/multi-level-ca-loop/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-loop/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::rm /etc/ipsec.d/cacerts/strongswanCert.pem carol::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-loop/test.conf b/testing/tests/ikev2/multi-level-ca-loop/test.conf index 3189fdfc7..a24ec4f1d 100644 --- a/testing/tests/ikev2/multi-level-ca-loop/test.conf +++ b/testing/tests/ikev2/multi-level-ca-loop/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat b/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat index 9f0232a7b..e209e60ff 100644 --- a/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/multi-level-ca-pathlen/test.conf b/testing/tests/ikev2/multi-level-ca-pathlen/test.conf index b118cb7dc..587964390 100644 --- a/testing/tests/ikev2/multi-level-ca-pathlen/test.conf +++ b/testing/tests/ikev2/multi-level-ca-pathlen/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou" +VIRTHOSTS="alice venus moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/multi-level-ca-revoked/test.conf b/testing/tests/ikev2/multi-level-ca-revoked/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/multi-level-ca-revoked/test.conf +++ b/testing/tests/ikev2/multi-level-ca-revoked/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/multi-level-ca-strict/pretest.dat b/testing/tests/ikev2/multi-level-ca-strict/pretest.dat index 67c50c2ef..755564cbc 100644 --- a/testing/tests/ikev2/multi-level-ca-strict/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-strict/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-strict/test.conf b/testing/tests/ikev2/multi-level-ca-strict/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-strict/test.conf +++ b/testing/tests/ikev2/multi-level-ca-strict/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca/pretest.dat b/testing/tests/ikev2/multi-level-ca/pretest.dat index 67c50c2ef..755564cbc 100644 --- a/testing/tests/ikev2/multi-level-ca/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca/test.conf b/testing/tests/ikev2/multi-level-ca/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca/test.conf +++ b/testing/tests/ikev2/multi-level-ca/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/nat-rw-mark/description.txt b/testing/tests/ikev2/nat-rw-mark/description.txt index 2a93d11d8..b8074e665 100644 --- a/testing/tests/ikev2/nat-rw-mark/description.txt +++ b/testing/tests/ikev2/nat-rw-mark/description.txt @@ -1,7 +1,7 @@ The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT -after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respectively. +after ESP decryption to map these subnets to PH_IP_CAROL10 and PH_IP_DAVE10, respectively. <p/> In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively, <b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using diff --git a/testing/tests/ikev2/nat-rw-mark/evaltest.dat b/testing/tests/ikev2/nat-rw-mark/evaltest.dat index db9e969d2..bb8e856cc 100644 --- a/testing/tests/ikev2/nat-rw-mark/evaltest.dat +++ b/testing/tests/ikev2/nat-rw-mark/evaltest.dat @@ -6,13 +6,13 @@ sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*alice@ sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4510.*: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4520.*: UDP::YES -bob::tcpdump::10.3.0.10 > bob.strongswan.org: ICMP echo request::YES -bob::tcpdump::10.3.0.20 > bob.strongswan.org: ICMP echo request::YES -bob::tcpdump::bob.strongswan.org > 10.3.0.10: ICMP echo reply::YES -bob::tcpdump::bob.strongswan.org > 10.3.0.20: ICMP echo reply::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4510.*: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4520.*: UDP::YES +bob::tcpdump::PH_IP_CAROL10 > bob.strongswan.org: ICMP echo request::YES +bob::tcpdump::PH_IP_DAVE10 > bob.strongswan.org: ICMP echo request::YES +bob::tcpdump::bob.strongswan.org > PH_IP_CAROL10: ICMP echo reply::YES +bob::tcpdump::bob.strongswan.org > PH_IP_DAVE10: ICMP echo reply::YES diff --git a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown index 0d22e684d..421335ffb 100755 --- a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown +++ b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown @@ -73,8 +73,12 @@ # just the host, this will be 255.255.255.255. # # PLUTO_MY_SOURCEIP -# if non-empty, then the source address for the route will be -# set to this IP address. +# PLUTO_MY_SOURCEIP4_$i +# PLUTO_MY_SOURCEIP6_$i +# contains IPv4/IPv6 virtual IP received from a responder, +# $i enumerates from 1 to the number of IP per address family. +# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first +# virtual IP, IPv4 or IPv6. # # PLUTO_MY_PROTOCOL # is the IP protocol that will be transported. @@ -128,9 +132,15 @@ # contains the remote UDP port in the case of ESP_IN_UDP # encapsulation # +# PLUTO_DNS4_$i +# PLUTO_DNS6_$i +# contains IPv4/IPv6 DNS server attribute received from a +# responder, $i enumerates from 1 to the number of servers per +# address family. +# # define a minimum PATH environment in case it is not set -PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin" export PATH # uncomment to log VPN connections diff --git a/testing/tests/ikev2/nat-rw-mark/posttest.dat b/testing/tests/ikev2/nat-rw-mark/posttest.dat index 89d5f534b..72dff4e10 100644 --- a/testing/tests/ikev2/nat-rw-mark/posttest.dat +++ b/testing/tests/ikev2/nat-rw-mark/posttest.dat @@ -2,10 +2,11 @@ sun::iptables -t mangle -v -n -L PREROUTING sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null -moon::iptables -t nat -F +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush moon::conntrack -F +sun::iptables-restore < /etc/iptables.flush sun::conntrack -F sun::rm /etc/mark_updown diff --git a/testing/tests/ikev2/nat-rw-mark/pretest.dat b/testing/tests/ikev2/nat-rw-mark/pretest.dat index 3ed13d5fa..6cddfd4fe 100644 --- a/testing/tests/ikev2/nat-rw-mark/pretest.dat +++ b/testing/tests/ikev2/nat-rw-mark/pretest.dat @@ -1,21 +1,20 @@ -sun::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 500 -j SNAT --to PH_IP_MOON:510 moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 500 -j SNAT --to PH_IP_MOON:520 moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4510 moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4520 -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to 10.3.0.10 -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to 10.3.0.20 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.10 -j MARK --set-mark 10 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.20 -j MARK --set-mark 20 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10 +sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 10 +sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 20 sun::ipsec start alice::ipsec start venus::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up nat-t -venus::sleep 2 +venus::sleep 2 venus::ipsec up nat-t venus::sleep 2 diff --git a/testing/tests/ikev2/nat-rw-mark/test.conf b/testing/tests/ikev2/nat-rw-mark/test.conf index ae3c190b8..105472cbe 100644 --- a/testing/tests/ikev2/nat-rw-mark/test.conf +++ b/testing/tests/ikev2/nat-rw-mark/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-rw-psk/evaltest.dat b/testing/tests/ikev2/nat-rw-psk/evaltest.dat index 051db978a..6ec29c779 100644 --- a/testing/tests/ikev2/nat-rw-psk/evaltest.dat +++ b/testing/tests/ikev2/nat-rw-psk/evaltest.dat @@ -3,7 +3,7 @@ venus::ipsec status 2> /dev/null::nat-t.*INSTALLED. TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_ALICE\]::YES sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_VENUS\]::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/nat-rw-psk/posttest.dat b/testing/tests/ikev2/nat-rw-psk/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/ikev2/nat-rw-psk/posttest.dat +++ b/testing/tests/ikev2/nat-rw-psk/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/nat-rw-psk/pretest.dat b/testing/tests/ikev2/nat-rw-psk/pretest.dat index 6a542ec8f..c5d091f32 100644 --- a/testing/tests/ikev2/nat-rw-psk/pretest.dat +++ b/testing/tests/ikev2/nat-rw-psk/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/nat-rw-psk/test.conf b/testing/tests/ikev2/nat-rw-psk/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/ikev2/nat-rw-psk/test.conf +++ b/testing/tests/ikev2/nat-rw-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-rw/evaltest.dat b/testing/tests/ikev2/nat-rw/evaltest.dat index e0b458dba..387dbae23 100644 --- a/testing/tests/ikev2/nat-rw/evaltest.dat +++ b/testing/tests/ikev2/nat-rw/evaltest.dat @@ -6,13 +6,13 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES moon:: sleep 6::no output expected::NO -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP-encap: ESP::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: isakmp-nat-keep-alive::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP-encap: ESP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP-encap: ESP::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: isakmp-nat-keep-alive::YES alice::cat /var/log/daemon.log::sending keep alive::YES venus::cat /var/log/daemon.log::sending keep alive::YES diff --git a/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/nat-rw/posttest.dat b/testing/tests/ikev2/nat-rw/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/ikev2/nat-rw/posttest.dat +++ b/testing/tests/ikev2/nat-rw/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/nat-rw/pretest.dat b/testing/tests/ikev2/nat-rw/pretest.dat index e365ff5c5..d701a1d61 100644 --- a/testing/tests/ikev2/nat-rw/pretest.dat +++ b/testing/tests/ikev2/nat-rw/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start diff --git a/testing/tests/ikev2/nat-rw/test.conf b/testing/tests/ikev2/nat-rw/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/ikev2/nat-rw/test.conf +++ b/testing/tests/ikev2/nat-rw/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-virtual-ip/evaltest.dat b/testing/tests/ikev2/nat-virtual-ip/evaltest.dat index 9c98e312a..c60ffc772 100644 --- a/testing/tests/ikev2/nat-virtual-ip/evaltest.dat +++ b/testing/tests/ikev2/nat-virtual-ip/evaltest.dat @@ -1,7 +1,7 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: cat /var/log/daemon.log::inserted NAT rule mapping PH_IP_ALICE to virtual IP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES bob::tcpdump::IP alice2.strongswan.org > bob.strongswan.org: ICMP::YES diff --git a/testing/tests/ikev2/nat-virtual-ip/posttest.dat b/testing/tests/ikev2/nat-virtual-ip/posttest.dat index ee30e2c59..11bd19da7 100644 --- a/testing/tests/ikev2/nat-virtual-ip/posttest.dat +++ b/testing/tests/ikev2/nat-virtual-ip/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::conntrack -F moon::rm /etc/nat_updown diff --git a/testing/tests/ikev2/nat-virtual-ip/pretest.dat b/testing/tests/ikev2/nat-virtual-ip/pretest.dat index abbca90d7..eb0c28c7f 100644 --- a/testing/tests/ikev2/nat-virtual-ip/pretest.dat +++ b/testing/tests/ikev2/nat-virtual-ip/pretest.dat @@ -1,7 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::conntrack -F -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/nat-virtual-ip/test.conf b/testing/tests/ikev2/nat-virtual-ip/test.conf index 1971a33ab..f46f137b4 100644 --- a/testing/tests/ikev2/nat-virtual-ip/test.conf +++ b/testing/tests/ikev2/nat-virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-cert/evaltest.dat b/testing/tests/ikev2/net2net-cert/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev2/net2net-cert/evaltest.dat +++ b/testing/tests/ikev2/net2net-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-cert/posttest.dat b/testing/tests/ikev2/net2net-cert/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/net2net-cert/posttest.dat +++ b/testing/tests/ikev2/net2net-cert/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-cert/pretest.dat b/testing/tests/ikev2/net2net-cert/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/net2net-cert/pretest.dat +++ b/testing/tests/ikev2/net2net-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-cert/test.conf b/testing/tests/ikev2/net2net-cert/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-cert/test.conf +++ b/testing/tests/ikev2/net2net-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-esn/posttest.dat b/testing/tests/ikev2/net2net-esn/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/net2net-esn/posttest.dat +++ b/testing/tests/ikev2/net2net-esn/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-esn/pretest.dat b/testing/tests/ikev2/net2net-esn/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/net2net-esn/pretest.dat +++ b/testing/tests/ikev2/net2net-esn/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-esn/test.conf b/testing/tests/ikev2/net2net-esn/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-esn/test.conf +++ b/testing/tests/ikev2/net2net-esn/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat b/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat index 97dd63c5a..460c659d9 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat +++ b/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*71:27:04:32:cd:76:3a:18: sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun <sun.strongswan.org>.*71:27:04:32:cd:76:3a:18:02:0a:c9:88:c0:e7:5a:ed::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-pgp-v3/posttest.dat b/testing/tests/ikev2/net2net-pgp-v3/posttest.dat index fafcde975..9a9513dc3 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/posttest.dat +++ b/testing/tests/ikev2/net2net-pgp-v3/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* sun::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/net2net-pgp-v3/pretest.dat b/testing/tests/ikev2/net2net-pgp-v3/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/pretest.dat +++ b/testing/tests/ikev2/net2net-pgp-v3/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-pgp-v3/test.conf b/testing/tests/ikev2/net2net-pgp-v3/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/test.conf +++ b/testing/tests/ikev2/net2net-pgp-v3/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat b/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat index 4615c3ed8..f74eb6a19 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat +++ b/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*b4: sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*b4:2f:31:fe:c8:0a:e3:26:4a:10:1c:85:97:7a:04:ac:8d:16:38:d3.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-pgp-v4/posttest.dat b/testing/tests/ikev2/net2net-pgp-v4/posttest.dat index fafcde975..9a9513dc3 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/posttest.dat +++ b/testing/tests/ikev2/net2net-pgp-v4/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* sun::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/net2net-pgp-v4/pretest.dat b/testing/tests/ikev2/net2net-pgp-v4/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/pretest.dat +++ b/testing/tests/ikev2/net2net-pgp-v4/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-pgp-v4/test.conf b/testing/tests/ikev2/net2net-pgp-v4/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/test.conf +++ b/testing/tests/ikev2/net2net-pgp-v4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat b/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat index 1556143cf..113c3d9c0 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat +++ b/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::dscp-be.*ESTABLISHED.*moon-be.*sun-be::YES moon:: ipsec status 2> /dev/null::dscp-ef.*ESTABLISHED.*moon-ef.*sun-ef::YES sun:: ipsec status 2> /dev/null::dscp-be.*ESTABLISHED.*sun-be.*moon-be::YES sun:: ipsec status 2> /dev/null::dscp-ef.*ESTABLISHED.*sun-ef.*moon-ef::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-psk-dscp/posttest.dat b/testing/tests/ikev2/net2net-psk-dscp/posttest.dat index d070c1443..21a22bfb8 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/posttest.dat +++ b/testing/tests/ikev2/net2net-psk-dscp/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush alice::iptables -t mangle -F OUTPUT venus::iptables -t mangle -F OUTPUT bob::iptables -t mangle -F OUTPUT diff --git a/testing/tests/ikev2/net2net-psk-dscp/pretest.dat b/testing/tests/ikev2/net2net-psk-dscp/pretest.dat index 058c24f8f..0495890dd 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/pretest.dat +++ b/testing/tests/ikev2/net2net-psk-dscp/pretest.dat @@ -1,7 +1,7 @@ moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules alice::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class BE venus::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class EF moon::iptables -t mangle -A PREROUTING -m dscp --dscp-class BE -j MARK --set-mark 10 diff --git a/testing/tests/ikev2/net2net-psk-dscp/test.conf b/testing/tests/ikev2/net2net-psk-dscp/test.conf index 13a8a2a48..10c582c9b 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/test.conf +++ b/testing/tests/ikev2/net2net-psk-dscp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk-fail/posttest.dat b/testing/tests/ikev2/net2net-psk-fail/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-psk-fail/posttest.dat +++ b/testing/tests/ikev2/net2net-psk-fail/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-psk-fail/pretest.dat b/testing/tests/ikev2/net2net-psk-fail/pretest.dat index 976a196db..cb9282595 100644 --- a/testing/tests/ikev2/net2net-psk-fail/pretest.dat +++ b/testing/tests/ikev2/net2net-psk-fail/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-psk-fail/test.conf b/testing/tests/ikev2/net2net-psk-fail/test.conf index f6e064e7d..eb4822b5d 100644 --- a/testing/tests/ikev2/net2net-psk-fail/test.conf +++ b/testing/tests/ikev2/net2net-psk-fail/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk/evaltest.dat b/testing/tests/ikev2/net2net-psk/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev2/net2net-psk/evaltest.dat +++ b/testing/tests/ikev2/net2net-psk/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets index cbdddfb18..ba909a234 100644 --- a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets @@ -8,5 +8,5 @@ : PSK 'My "home" is my "castle"!' -192.168.0.1 : PSK "Andi's home" +PH_IP_MOON : PSK "Andi's home" diff --git a/testing/tests/ikev2/net2net-psk/posttest.dat b/testing/tests/ikev2/net2net-psk/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-psk/posttest.dat +++ b/testing/tests/ikev2/net2net-psk/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-psk/pretest.dat b/testing/tests/ikev2/net2net-psk/pretest.dat index 976a196db..cb9282595 100644 --- a/testing/tests/ikev2/net2net-psk/pretest.dat +++ b/testing/tests/ikev2/net2net-psk/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-psk/test.conf b/testing/tests/ikev2/net2net-psk/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-psk/test.conf +++ b/testing/tests/ikev2/net2net-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-pubkey/evaltest.dat b/testing/tests/ikev2/net2net-pubkey/evaltest.dat index e47e709e2..bc03a39fb 100644 --- a/testing/tests/ikev2/net2net-pubkey/evaltest.dat +++ b/testing/tests/ikev2/net2net-pubkey/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-pubkey/posttest.dat b/testing/tests/ikev2/net2net-pubkey/posttest.dat index 65b18b7ca..675b02976 100644 --- a/testing/tests/ikev2/net2net-pubkey/posttest.dat +++ b/testing/tests/ikev2/net2net-pubkey/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/private/moonKey.der sun::rm /etc/ipsec.d/private/sunKey.der moon::rm /etc/ipsec.d/certs/*.der diff --git a/testing/tests/ikev2/net2net-pubkey/pretest.dat b/testing/tests/ikev2/net2net-pubkey/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-pubkey/pretest.dat +++ b/testing/tests/ikev2/net2net-pubkey/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-pubkey/test.conf b/testing/tests/ikev2/net2net-pubkey/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-pubkey/test.conf +++ b/testing/tests/ikev2/net2net-pubkey/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-rfc3779/evaltest.dat b/testing/tests/ikev2/net2net-rfc3779/evaltest.dat index 59d0372dc..e8e1a46e4 100644 --- a/testing/tests/ikev2/net2net-rfc3779/evaltest.dat +++ b/testing/tests/ikev2/net2net-rfc3779/evaltest.dat @@ -1,15 +1,15 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: cat /var/log/daemon.log::subject address block 10.2.0.0/16 is contained in issuer address block 10.1.0.0..10.2.255.255::YES -moon:: cat /var/log/daemon.log::subject address block 192.168.0.2/32 is contained in issuer address block 192.168.0.0/24::YES +moon:: cat /var/log/daemon.log::subject address block PH_IP_SUN/32 is contained in issuer address block 192.168.0.0/24::YES moon:: cat /var/log/daemon.log::subject address block fec0:\:2/128 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES moon:: cat /var/log/daemon.log::subject address block fec2:\:/16 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES sun:: cat /var/log/daemon.log::subject address block 10.1.0.0/16 is contained in issuer address block 10.1.0.0..10.2.255.255::YES -sun:: cat /var/log/daemon.log::subject address block 192.168.0.1/32 is contained in issuer address block 192.168.0.0/24::YES +sun:: cat /var/log/daemon.log::subject address block PH_IP_MOON/32 is contained in issuer address block 192.168.0.0/24::YES sun:: cat /var/log/daemon.log::subject address block fec0:\:1/128 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES sun:: cat /var/log/daemon.log::subject address block fec1:\:/16 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES moon:: cat /var/log/daemon.log::TS 10.2.0.0/16 is contained in address block constraint 10.2.0.0/16::YES sun:: cat /var/log/daemon.log::TS 10.1.0.0/16 is contained in address block constraint 10.1.0.0/16::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-rfc3779/posttest.dat b/testing/tests/ikev2/net2net-rfc3779/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/net2net-rfc3779/posttest.dat +++ b/testing/tests/ikev2/net2net-rfc3779/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-rfc3779/pretest.dat b/testing/tests/ikev2/net2net-rfc3779/pretest.dat index 545a3690e..9fe2860b9 100644 --- a/testing/tests/ikev2/net2net-rfc3779/pretest.dat +++ b/testing/tests/ikev2/net2net-rfc3779/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-rfc3779/test.conf b/testing/tests/ikev2/net2net-rfc3779/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-rfc3779/test.conf +++ b/testing/tests/ikev2/net2net-rfc3779/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-route/evaltest.dat b/testing/tests/ikev2/net2net-route/evaltest.dat index 63d1cde24..77ab6e7c6 100644 --- a/testing/tests/ikev2/net2net-route/evaltest.dat +++ b/testing/tests/ikev2/net2net-route/evaltest.dat @@ -3,6 +3,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-route/posttest.dat b/testing/tests/ikev2/net2net-route/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-route/posttest.dat +++ b/testing/tests/ikev2/net2net-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-route/pretest.dat b/testing/tests/ikev2/net2net-route/pretest.dat index 2eef7de19..e4ee3fac2 100644 --- a/testing/tests/ikev2/net2net-route/pretest.dat +++ b/testing/tests/ikev2/net2net-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/ikev2/net2net-route/test.conf b/testing/tests/ikev2/net2net-route/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-route/test.conf +++ b/testing/tests/ikev2/net2net-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-rsa/evaltest.dat b/testing/tests/ikev2/net2net-rsa/evaltest.dat index e47e709e2..bc03a39fb 100644 --- a/testing/tests/ikev2/net2net-rsa/evaltest.dat +++ b/testing/tests/ikev2/net2net-rsa/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-rsa/posttest.dat b/testing/tests/ikev2/net2net-rsa/posttest.dat index a199946aa..f7fe7dc48 100644 --- a/testing/tests/ikev2/net2net-rsa/posttest.dat +++ b/testing/tests/ikev2/net2net-rsa/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/private/moonKey.der sun::rm /etc/ipsec.d/private/sunKey.der diff --git a/testing/tests/ikev2/net2net-rsa/pretest.dat b/testing/tests/ikev2/net2net-rsa/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-rsa/pretest.dat +++ b/testing/tests/ikev2/net2net-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-rsa/test.conf b/testing/tests/ikev2/net2net-rsa/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-rsa/test.conf +++ b/testing/tests/ikev2/net2net-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-same-nets/evaltest.dat b/testing/tests/ikev2/net2net-same-nets/evaltest.dat index 1ca7e2d60..3b479cefa 100644 --- a/testing/tests/ikev2/net2net-same-nets/evaltest.dat +++ b/testing/tests/ikev2/net2net-same-nets/evaltest.dat @@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.6.0.10::64 bytes from 10.6.0.10: icmp_seq=1::YES -bob:: ping -c 1 10.9.0.10::64 bytes from 10.9.0.10: icmp_seq=1::YES +alice::ping -c 1 10.6.0.10::64 bytes from 10.6.0.10: icmp_req=1::YES +bob:: ping -c 1 10.9.0.10::64 bytes from 10.9.0.10: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES bob::tcpdump::IP 10.9.0.10 > bob.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown b/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown index c64158a2f..bdba3fb05 100755 --- a/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown +++ b/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown @@ -73,8 +73,12 @@ # just the host, this will be 255.255.255.255. # # PLUTO_MY_SOURCEIP -# if non-empty, then the source address for the route will be -# set to this IP address. +# PLUTO_MY_SOURCEIP4_$i +# PLUTO_MY_SOURCEIP6_$i +# contains IPv4/IPv6 virtual IP received from a responder, +# $i enumerates from 1 to the number of IP per address family. +# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first +# virtual IP, IPv4 or IPv6. # # PLUTO_MY_PROTOCOL # is the IP protocol that will be transported. @@ -128,9 +132,15 @@ # contains the remote UDP port in the case of ESP_IN_UDP # encapsulation # +# PLUTO_DNS4_$i +# PLUTO_DNS6_$i +# contains IPv4/IPv6 DNS server attribute received from a +# responder, $i enumerates from 1 to the number of servers per +# address family. +# # define a minimum PATH environment in case it is not set -PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin" export PATH # check parameter(s) @@ -196,8 +206,8 @@ up-client:) iptables -t nat -A PREROUTING -i $INT_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ -d $OUT_NET -j NETMAP --to $SAME_NET iptables -I FORWARD 1 -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT -j ACCEPT - iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ - -s $SAME_NET -j NETMAP --to $IN_NET + iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ + -s $SAME_NET -j NETMAP --to $IN_NET fi ;; down-client:) @@ -215,7 +225,11 @@ down-client:) if [ -n "$PLUTO_MARK_OUT" ] then iptables -t mangle -D PREROUTING $SET_MARK_OUT + iptables -t nat -D PREROUTING -i $INT_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ + -d $OUT_NET -j NETMAP --to $SAME_NET iptables -D FORWARD -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT -j ACCEPT + iptables -t nat -D POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ + -s $SAME_NET -j NETMAP --to $IN_NET fi ;; *) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2 diff --git a/testing/tests/ikev2/net2net-same-nets/posttest.dat b/testing/tests/ikev2/net2net-same-nets/posttest.dat index e75e66650..b0225c37e 100644 --- a/testing/tests/ikev2/net2net-same-nets/posttest.dat +++ b/testing/tests/ikev2/net2net-same-nets/posttest.dat @@ -2,6 +2,6 @@ sun::iptables -t mangle -n -v -L PREROUTING sun::iptables -t nat -n -v -L moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::conntrack -F diff --git a/testing/tests/ikev2/net2net-same-nets/pretest.dat b/testing/tests/ikev2/net2net-same-nets/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/net2net-same-nets/pretest.dat +++ b/testing/tests/ikev2/net2net-same-nets/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-same-nets/test.conf b/testing/tests/ikev2/net2net-same-nets/test.conf index 1971a33ab..f46f137b4 100644 --- a/testing/tests/ikev2/net2net-same-nets/test.conf +++ b/testing/tests/ikev2/net2net-same-nets/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-start/evaltest.dat b/testing/tests/ikev2/net2net-start/evaltest.dat index dbd06104f..f003f822f 100644 --- a/testing/tests/ikev2/net2net-start/evaltest.dat +++ b/testing/tests/ikev2/net2net-start/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-start/posttest.dat b/testing/tests/ikev2/net2net-start/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-start/posttest.dat +++ b/testing/tests/ikev2/net2net-start/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-start/pretest.dat b/testing/tests/ikev2/net2net-start/pretest.dat index 8f3d17207..9d23c553e 100644 --- a/testing/tests/ikev2/net2net-start/pretest.dat +++ b/testing/tests/ikev2/net2net-start/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ipsec start sun::sleep 2 moon::ipsec start diff --git a/testing/tests/ikev2/net2net-start/test.conf b/testing/tests/ikev2/net2net-start/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-start/test.conf +++ b/testing/tests/ikev2/net2net-start/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index dda793f44..4e2cc2860 100755 --- a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ - -resp_no_certs -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-local-cert/test.conf b/testing/tests/ikev2/ocsp-local-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-local-cert/test.conf +++ b/testing/tests/ikev2/ocsp-local-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-multi-level/pretest.dat b/testing/tests/ikev2/ocsp-multi-level/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev2/ocsp-multi-level/pretest.dat +++ b/testing/tests/ikev2/ocsp-multi-level/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ocsp-multi-level/test.conf b/testing/tests/ikev2/ocsp-multi-level/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/ocsp-multi-level/test.conf +++ b/testing/tests/ikev2/ocsp-multi-level/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index 74d22b90d..429061376 100755 --- a/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey winnetouKey.pem -rsigner winnetouCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey winnetouKey.pem -rsigner winnetouCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-no-signer-cert/test.conf b/testing/tests/ikev2/ocsp-no-signer-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-no-signer-cert/test.conf +++ b/testing/tests/ikev2/ocsp-no-signer-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-revoked/test.conf b/testing/tests/ikev2/ocsp-revoked/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-revoked/test.conf +++ b/testing/tests/ikev2/ocsp-revoked/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index e998b6ad0..59c356302 100755 --- a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey strongswanKey.pem -rsigner strongswanCert.pem \ - -resp_no_certs -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey strongswanKey.pem -rsigner strongswanCert.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-root-cert/test.conf b/testing/tests/ikev2/ocsp-root-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-root-cert/test.conf +++ b/testing/tests/ikev2/ocsp-root-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-signer-cert/test.conf b/testing/tests/ikev2/ocsp-signer-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-signer-cert/test.conf +++ b/testing/tests/ikev2/ocsp-signer-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat b/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat +++ b/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ocsp-strict-ifuri/test.conf b/testing/tests/ikev2/ocsp-strict-ifuri/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/ocsp-strict-ifuri/test.conf +++ b/testing/tests/ikev2/ocsp-strict-ifuri/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index 92aa920aa..aa70321d5 100755 --- a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -6,9 +6,9 @@ echo "Content-type: application/ocsp-response" echo "" # simulate a delayed response -sleep 5 +sleep 5 -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-timeouts-good/test.conf b/testing/tests/ikev2/ocsp-timeouts-good/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-timeouts-good/test.conf +++ b/testing/tests/ikev2/ocsp-timeouts-good/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index 20c4b2a22..72aa7a6c4 100755 --- a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf +++ b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-dual/evaltest.dat b/testing/tests/ikev2/protoport-dual/evaltest.dat index a65460cc8..cf45f3b52 100644 --- a/testing/tests/ikev2/protoport-dual/evaltest.dat +++ b/testing/tests/ikev2/protoport-dual/evaltest.dat @@ -2,8 +2,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/protoport-dual/posttest.dat b/testing/tests/ikev2/protoport-dual/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/protoport-dual/posttest.dat +++ b/testing/tests/ikev2/protoport-dual/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/protoport-dual/pretest.dat b/testing/tests/ikev2/protoport-dual/pretest.dat index d3d0061c3..efb2e5712 100644 --- a/testing/tests/ikev2/protoport-dual/pretest.dat +++ b/testing/tests/ikev2/protoport-dual/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/protoport-dual/test.conf b/testing/tests/ikev2/protoport-dual/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/protoport-dual/test.conf +++ b/testing/tests/ikev2/protoport-dual/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-route/evaltest.dat b/testing/tests/ikev2/protoport-route/evaltest.dat index 83a5e1bde..75c547995 100644 --- a/testing/tests/ikev2/protoport-route/evaltest.dat +++ b/testing/tests/ikev2/protoport-route/evaltest.dat @@ -1,5 +1,5 @@ -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req::YES carol::ssh PH_IP_ALICE hostname::alice::YES carol::cat /var/log/daemon.log::creating acquire job::YES carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED::YES diff --git a/testing/tests/ikev2/protoport-route/posttest.dat b/testing/tests/ikev2/protoport-route/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/protoport-route/posttest.dat +++ b/testing/tests/ikev2/protoport-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/protoport-route/pretest.dat b/testing/tests/ikev2/protoport-route/pretest.dat index 0aded0f4d..5a15574d6 100644 --- a/testing/tests/ikev2/protoport-route/pretest.dat +++ b/testing/tests/ikev2/protoport-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/protoport-route/test.conf b/testing/tests/ikev2/protoport-route/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/protoport-route/test.conf +++ b/testing/tests/ikev2/protoport-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/reauth-early/evaltest.dat b/testing/tests/ikev2/reauth-early/evaltest.dat index 1d3a35916..dbc6f8d97 100644 --- a/testing/tests/ikev2/reauth-early/evaltest.dat +++ b/testing/tests/ikev2/reauth-early/evaltest.dat @@ -1,6 +1,6 @@ moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home\[2]: ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::cat /var/log/daemon.log::received AUTH_LIFETIME of 30s, scheduling reauthentication in 25s::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/reauth-early/posttest.dat b/testing/tests/ikev2/reauth-early/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/reauth-early/posttest.dat +++ b/testing/tests/ikev2/reauth-early/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/reauth-early/pretest.dat b/testing/tests/ikev2/reauth-early/pretest.dat index 7ed2423be..153ea7c43 100644 --- a/testing/tests/ikev2/reauth-early/pretest.dat +++ b/testing/tests/ikev2/reauth-early/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/reauth-early/test.conf b/testing/tests/ikev2/reauth-early/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/reauth-early/test.conf +++ b/testing/tests/ikev2/reauth-early/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/reauth-late/evaltest.dat b/testing/tests/ikev2/reauth-late/evaltest.dat index d86758f9a..205a4d9e7 100644 --- a/testing/tests/ikev2/reauth-late/evaltest.dat +++ b/testing/tests/ikev2/reauth-late/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home\[2]: ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::cat /var/log/daemon.log::scheduling reauthentication in 2[0-5]s::YES carol::cat /var/log/daemon.log::received AUTH_LIFETIME of 360[01]s, reauthentication already scheduled in 2[0-5]s::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/reauth-late/posttest.dat b/testing/tests/ikev2/reauth-late/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/reauth-late/posttest.dat +++ b/testing/tests/ikev2/reauth-late/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/reauth-late/pretest.dat b/testing/tests/ikev2/reauth-late/pretest.dat index 7ed2423be..153ea7c43 100644 --- a/testing/tests/ikev2/reauth-late/pretest.dat +++ b/testing/tests/ikev2/reauth-late/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/reauth-late/test.conf b/testing/tests/ikev2/reauth-late/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/reauth-late/test.conf +++ b/testing/tests/ikev2/reauth-late/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-cert/evaltest.dat b/testing/tests/ikev2/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/ikev2/rw-cert/evaltest.dat +++ b/testing/tests/ikev2/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-cert/posttest.dat b/testing/tests/ikev2/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-cert/posttest.dat +++ b/testing/tests/ikev2/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-cert/pretest.dat b/testing/tests/ikev2/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-cert/pretest.dat +++ b/testing/tests/ikev2/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-cert/test.conf b/testing/tests/ikev2/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-cert/test.conf +++ b/testing/tests/ikev2/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat index a39bf3afe..d59eef513 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat @@ -7,7 +7,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf b/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat index 2abfdd19b..0ea4e21ab 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat @@ -6,7 +6,7 @@ moon:: ipsec status 2> /dev/null::rw-eap-aka.*ESTABLISHED.*moon.strongswan.org.* carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap-aka.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/test.conf b/testing/tests/ikev2/rw-eap-aka-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-aka-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat b/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat index 9c6ae73e9..6a20b8e8c 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat @@ -15,8 +15,8 @@ moon:: ipsec status 2> /dev/null::rw-eap[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-eap[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-dynamic/posttest.dat b/testing/tests/ikev2/rw-eap-dynamic/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/posttest.dat +++ b/testing/tests/ikev2/rw-eap-dynamic/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-dynamic/pretest.dat b/testing/tests/ikev2/rw-eap-dynamic/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/pretest.dat +++ b/testing/tests/ikev2/rw-eap-dynamic/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-dynamic/test.conf b/testing/tests/ikev2/rw-eap-dynamic/test.conf index a71d09e9d..a5525e6aa 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/test.conf +++ b/testing/tests/ikev2/rw-eap-dynamic/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/description.txt b/testing/tests/ikev2/rw-eap-md5-class-radius/description.txt new file mode 100644 index 000000000..6860700db --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/description.txt @@ -0,0 +1,9 @@ +The roadwarriors <b>carol</b> an <b>dave</b> set up a connection to gateway +<b>moon</b>. At the outset the gateway authenticates itself to the client by +sending an IKEv2 <b>RSA signature</b> accompanied by a certificate. +<b>carol</b> and <b>dave</b> then use the <b>EAP-MD5</b> protocol to authenticate +against the gateway <b>moon</b>. The user credentials of <b>carol</b> +and <b>dave</b> are kept both on the local clients and the RADIUS server <b>alice</b>. +<b>carol</b> possesses the RADIUS class attribute <b>Research</b> and therefore obtains +access to the <b>research</b> subnet behind gateway <b>moon</b> whereas <b>dave</b> +belongs to the class <b>Accounting</b> and has access to the <b>acccess</b> subnet. diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat new file mode 100644 index 000000000..aa6d4291b --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat @@ -0,0 +1,26 @@ +carol::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with RSA signature successful::YES +moon ::cat /var/log/daemon.log::received EAP identity .*carol::YES +carol::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES +carol::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with EAP successful::YES +moon ::cat /var/log/daemon.log::authentication of .*PH_IP_CAROL.* with EAP successful::YES +moon ::ipsec status 2> /dev/null::research.*ESTABLISHED.*moon.strongswan.org.*PH_IP_CAROL::YES +carol::ipsec status 2> /dev/null::alice.*ESTABLISHED.*PH_IP_CAROL.*moon.strongswan.org::YES +moon ::ipsec status 2> /dev/null::research.*INSTALLED, TUNNEL::YES +carol::ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::YES +carol::ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::NO +dave ::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with RSA signature successful::YES +moon ::cat /var/log/daemon.log::received EAP identity .*dave::YES +dave ::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES +dave ::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with EAP successful::YES +moon ::cat /var/log/daemon.log::authentication of .*PH_IP_DAVE.* with EAP successful::YES +moon ::ipsec status 2> /dev/null::accounting.*ESTABLISHED.*moon.strongswan.org.*PH_IP_DAVE::YES +dave ::ipsec status 2> /dev/null::alice.*ESTABLISHED.*PH_IP_DAVE.*moon.strongswan.org::YES +moon ::ipsec status 2> /dev/null::accounting.*INSTALLED, TUNNEL::YES +dave ::ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::NO +dave ::ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/proxy.conf index 783587b55..783587b55 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/sites-available/default index 2de32a6f2..a67a5dcb4 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/sites-available/default @@ -40,4 +40,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users new file mode 100644 index 000000000..62d459115 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users @@ -0,0 +1,4 @@ +carol Cleartext-Password := "Ar3etTnp" + Class = "Research" +dave Cleartext-Password := "W7R0g3do" + Class = "Accounting" diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..53e2be638 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn alice + rightsubnet=10.1.0.10/32 + also=home + auto=add + +conn venus + rightsubnet=10.1.0.20/32 + also=home + auto=add + +conn home + left=%any + leftauth=eap + leftfirewall=yes + eap_identity=carol + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightauth=pubkey diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..23d79cf2e --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol : EAP "Ar3etTnp" diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..b1b418060 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-md5 eap-identity updown +} diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.conf new file mode 100644 index 000000000..9428f323a --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn alice + rightsubnet=10.1.0.10/32 + also=home + auto=add + +conn venus + rightsubnet=10.1.0.20/32 + also=home + auto=add + +conn home + left=%any + leftauth=eap + leftfirewall=yes + eap_identity=dave + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightauth=pubkey diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..02e0c9963 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave : EAP "W7R0g3do" diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/strongswan.conf new file mode 100644 index 000000000..b1b418060 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-md5 eap-identity updown +} diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.conf new file mode 100644 index 000000000..9dcbcca75 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.conf @@ -0,0 +1,33 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn research + rightgroups=Research + leftsubnet=10.1.0.0/28 + also=rw-eap + auto=add + +conn accounting + rightgroups=Accounting + leftsubnet=10.1.0.16/28 + also=rw-eap + auto=add + +conn rw-eap + left=PH_IP_MOON + leftid=@moon.strongswan.org + leftcert=moonCert.pem + leftauth=pubkey + leftfirewall=yes + rightsendcert=never + rightauth=eap-radius + eap_identity=%any + right=%any diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..e86d6aa5c --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey.pem diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..4297a3056 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/strongswan.conf @@ -0,0 +1,12 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-radius eap-identity updown + plugins { + eap-radius { + class_group = yes + secret = gv6URkSs + server = PH_IP_ALICE + } + } +} diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat new file mode 100644 index 000000000..670d2e72f --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat @@ -0,0 +1,7 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat new file mode 100644 index 000000000..a2704e833 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat @@ -0,0 +1,13 @@ +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::radiusd +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up alice +carol::ipsec up venus +dave::ipsec up alice +dave::ipsec up venus +dave::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf new file mode 100644 index 000000000..5dfb41723 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf @@ -0,0 +1,26 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice venus moon carol winnetou moon" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" + +# Guest instances on which FreeRadius is started +# +RADIUSHOSTS="alice" + diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat index a239b56e7..42d2c319e 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat @@ -2,13 +2,13 @@ carol::cat /var/log/daemon.log::configured EAP-Identity carol::YES carol::cat /var/log/daemon.log::added EAP secret for carol moon.strongswan.org::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES -moon:: cat /var/log/daemon.log::authentication of '192.168.0.100' with EAP successful::YES +moon:: cat /var/log/daemon.log::authentication of 'PH_IP_CAROL' with EAP successful::YES moon:: cat /var/log/daemon.log::received EAP identity.*carol::YES -moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[192.168.0.100]::YES -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*moon.strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[PH_IP_CAROL]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat index 9c301f484..180537f5f 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf b/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat index 73f606be3..8f813395a 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat @@ -7,7 +7,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/proxy.conf index 783587b55..783587b55 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/sites-available/default index 2de32a6f2..a67a5dcb4 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/sites-available/default @@ -40,4 +40,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat index 525d987af..a8019b3e7 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat @@ -6,6 +6,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat index dd67704eb..84f41fd93 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat @@ -5,7 +5,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/test.conf b/testing/tests/ikev2/rw-eap-md5-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat index eafd09b80..010f48315 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat @@ -3,11 +3,11 @@ carol::cat /var/log/daemon.log::server requested EAP_MSCHAPV2 authentication::YE carol::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with EAP successful::YES moon:: cat /var/log/daemon.log::received EAP identity.*carol::YES moon:: cat /var/log/daemon.log::authentication of .*PH_IP_CAROL.* with EAP successful::YES -moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[192.168.0.100]::YES -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*moon.strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[PH_IP_CAROL]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat index 871d3b931..4ed5257b1 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat @@ -18,6 +18,6 @@ moon:: ipsec status 2> /dev/null::rw-eap[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-eap[{]2}.*INSTALLED::NO carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat b/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat +++ b/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat b/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat +++ b/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-peap-md5/test.conf b/testing/tests/ikev2/rw-eap-peap-md5/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/test.conf +++ b/testing/tests/ikev2/rw-eap-peap-md5/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat index 643b2c39d..fc75e1c9a 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@stronswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf b/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat index 81244bd85..95c29b7f5 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/eap.conf index df50901d5..11d3e2acd 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/eap.conf @@ -1,7 +1,7 @@ eap { md5 { } - default_eap_type = peap + default_eap_type = peap tls { private_key_file = /etc/raddb/certs/aaaKey.pem certificate_file = /etc/raddb/certs/aaaCert.pem diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat b/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat b/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat index cbe1ae229..3e7fc0bb1 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-peap-radius/test.conf b/testing/tests/ikev2/rw-eap-peap-radius/test.conf index e6a786a94..20d586309 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-peap-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol winnetou dave moon" +VIRTHOSTS="alice carol winnetou dave moon" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat index 7f1def4a5..f1a68bc19 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat @@ -7,6 +7,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files new file mode 100644 index 000000000..10c26aa15 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files @@ -0,0 +1,3 @@ +sim_files { + simtriplets = "/etc/freeradius/triplets.dat" +} diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/proxy.conf index 783587b55..783587b55 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/sites-available/default index 92896b11e..893529324 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/sites-available/default @@ -40,4 +40,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/triplets.dat index c167ba940..c167ba940 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/triplets.dat diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat index 0da980c07..b9117af36 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat index f2654766a..f434ddfc6 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat @@ -4,7 +4,7 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES @@ -12,4 +12,4 @@ moon:: cat /var/log/daemon.log::EAP method EAP_SIM failed for peer dave@strongsw moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files new file mode 100644 index 000000000..10c26aa15 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files @@ -0,0 +1,3 @@ +sim_files { + simtriplets = "/etc/freeradius/triplets.dat" +} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/sites-available/default index 126d61d05..fbdf75f4c 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/triplets.dat index fd0eb19b9..3e9a644eb 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/triplets.dat @@ -4,4 +4,3 @@ carol@strongswan.org,32000000000000000000000000000000,32112233,325566778899AABB dave@strongswan.org,33000000000000000000000000000000,33112233,335566778899AABB dave@strongswan.org,34000000000000000000000000000000,34112233,345566778899AABB dave@strongswan.org,35000000000000000000000000000000,35112233,355566778899AABB - diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat index 5a51733dc..0b3e901c2 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat @@ -1,11 +1,11 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf index bb6b68687..29bfaa78c 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat index 8e12c29d0..21cfe429a 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat @@ -4,7 +4,7 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES @@ -12,4 +12,4 @@ moon:: cat /var/log/daemon.log::EAP method EAP_SIM failed for peer dave@strongsw moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/sites-available/default index dfceb037d..91425f812 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/sites-available/default @@ -59,4 +59,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/triplets.dat index fd0eb19b9..3e9a644eb 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/triplets.dat @@ -4,4 +4,3 @@ carol@strongswan.org,32000000000000000000000000000000,32112233,325566778899AABB dave@strongswan.org,33000000000000000000000000000000,33112233,335566778899AABB dave@strongswan.org,34000000000000000000000000000000,34112233,345566778899AABB dave@strongswan.org,35000000000000000000000000000000,35112233,355566778899AABB - diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat index b3fd4cbf1..c17bec0f7 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat @@ -1,11 +1,11 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::cat /etc/raddb/clients.conf -alice::cat /etc/raddb/eap.conf -alice::cat /etc/raddb/proxy.conf -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::cat /etc/freeradius/clients.conf +alice::cat /etc/freeradius/eap.conf +alice::cat /etc/freeradius/proxy.conf +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-sim-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-radius/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-radius/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat index ade9306cf..ab27b4510 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat @@ -5,6 +5,6 @@ moon:: ipsec status 2> /dev/null::rw-eap-sim.*ESTABLISHED.*moon.strongswan.org.* carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap-sim.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat index 23c7a62b2..ae464b51c 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::cat /etc/ipsec.d/triplets.dat carol::cat /etc/ipsec.d/triplets.dat moon::ipsec start diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/test.conf b/testing/tests/ikev2/rw-eap-sim-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat index 4db0a30b4..314769b3e 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat @@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, C moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=carol@d.strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat index 085b19509..e8156ea70 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat +++ b/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/cacerts/* moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat index 35d35dc86..3d680ab78 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat +++ b/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat @@ -1,7 +1,7 @@ moon::rm /etc/ipsec.d/cacerts/strongswanCert.pem carol::rm /etc/ipsec.d/cacerts/strongswanCert.pem -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/test.conf b/testing/tests/ikev2/rw-eap-tls-fragments/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/test.conf +++ b/testing/tests/ikev2/rw-eap-tls-fragments/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat index 96417face..a436131bf 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat @@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN= moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, CN=carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat +++ b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat +++ b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-tls-only/test.conf b/testing/tests/ikev2/rw-eap-tls-only/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/test.conf +++ b/testing/tests/ikev2/rw-eap-tls-only/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat index 21190669e..7584e14dc 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat @@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN= moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, CN=carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/eap.conf index 92f96ad66..92f96ad66 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/sites-available/default index 990184919..18ebf9e9d 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/sites-available/default @@ -39,4 +39,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat b/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat b/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-tls-radius/test.conf b/testing/tests/ikev2/rw-eap-tls-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-tls-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat index 941bb2985..d22dd18db 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@stronswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat index 369596177..589d478e7 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat @@ -1,10 +1,10 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +carol::sleep 2 carol::ipsec up home dave::ipsec up home -dave::sleep 1 +dave::sleep 2 diff --git a/testing/tests/ikev2/rw-eap-ttls-only/test.conf b/testing/tests/ikev2/rw-eap-ttls-only/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/test.conf +++ b/testing/tests/ikev2/rw-eap-ttls-only/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat index 941bb2985..d22dd18db 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@stronswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat index ff08ae792..a471a2cfa 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat @@ -14,7 +14,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@strongswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/eap.conf index c91cd40fb..c91cd40fb 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat index cbe1ae229..3e7fc0bb1 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/test.conf b/testing/tests/ikev2/rw-eap-ttls-radius/test.conf index e6a786a94..20d586309 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-ttls-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol winnetou dave moon" +VIRTHOSTS="alice carol winnetou dave moon" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-hash-and-url/evaltest.dat b/testing/tests/ikev2/rw-hash-and-url/evaltest.dat index c52036028..7a9a70939 100644 --- a/testing/tests/ikev2/rw-hash-and-url/evaltest.dat +++ b/testing/tests/ikev2/rw-hash-and-url/evaltest.dat @@ -10,8 +10,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-hash-and-url/posttest.dat b/testing/tests/ikev2/rw-hash-and-url/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-hash-and-url/posttest.dat +++ b/testing/tests/ikev2/rw-hash-and-url/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-hash-and-url/pretest.dat b/testing/tests/ikev2/rw-hash-and-url/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-hash-and-url/pretest.dat +++ b/testing/tests/ikev2/rw-hash-and-url/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-hash-and-url/test.conf b/testing/tests/ikev2/rw-hash-and-url/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-hash-and-url/test.conf +++ b/testing/tests/ikev2/rw-hash-and-url/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-mark-in-out/description.txt b/testing/tests/ikev2/rw-mark-in-out/description.txt index 4c35081b1..3012fc656 100644 --- a/testing/tests/ikev2/rw-mark-in-out/description.txt +++ b/testing/tests/ikev2/rw-mark-in-out/description.txt @@ -1,7 +1,7 @@ The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the router <b>moon</b> set up tunnels to gateway <b>sun</b>. Since both roadwarriors possess the same 10.1.0.0/25 subnet, -gateway <b>sun</b> uses Source NAT after ESP decryption to map these subnets to 10.3.0.10 -and 10.3.0.20, respectively. +gateway <b>sun</b> uses Source NAT after ESP decryption to map these subnets to PH_IP_CAROL10 +and PH_IP_DAVE10, respectively. <p/> In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively, <b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using diff --git a/testing/tests/ikev2/rw-mark-in-out/evaltest.dat b/testing/tests/ikev2/rw-mark-in-out/evaltest.dat index 4a93dc921..26b26204c 100644 --- a/testing/tests/ikev2/rw-mark-in-out/evaltest.dat +++ b/testing/tests/ikev2/rw-mark-in-out/evaltest.dat @@ -3,9 +3,9 @@ venus::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*alice@strongswan.org::YES sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES -sun:: ipsec statusall 2>::venus.*10.2.0.0/16 === 10.1.0.0/25::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES moon::tcpdump::IP alice.strongswan.org > sun.strongswan.org: ESP::YES moon::tcpdump::IP venus.strongswan.org > sun.strongswan.org: ESP::YES moon::tcpdump::IP sun.strongswan.org > alice.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 5594bbf52..000000000 --- a/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown b/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown index 0d22e684d..421335ffb 100755 --- a/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown +++ b/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown @@ -73,8 +73,12 @@ # just the host, this will be 255.255.255.255. # # PLUTO_MY_SOURCEIP -# if non-empty, then the source address for the route will be -# set to this IP address. +# PLUTO_MY_SOURCEIP4_$i +# PLUTO_MY_SOURCEIP6_$i +# contains IPv4/IPv6 virtual IP received from a responder, +# $i enumerates from 1 to the number of IP per address family. +# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first +# virtual IP, IPv4 or IPv6. # # PLUTO_MY_PROTOCOL # is the IP protocol that will be transported. @@ -128,9 +132,15 @@ # contains the remote UDP port in the case of ESP_IN_UDP # encapsulation # +# PLUTO_DNS4_$i +# PLUTO_DNS6_$i +# contains IPv4/IPv6 DNS server attribute received from a +# responder, $i enumerates from 1 to the number of servers per +# address family. +# # define a minimum PATH environment in case it is not set -PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin" export PATH # uncomment to log VPN connections diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables b/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 5594bbf52..000000000 --- a/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-mark-in-out/posttest.dat b/testing/tests/ikev2/rw-mark-in-out/posttest.dat index fae79271b..283099acb 100644 --- a/testing/tests/ikev2/rw-mark-in-out/posttest.dat +++ b/testing/tests/ikev2/rw-mark-in-out/posttest.dat @@ -2,9 +2,9 @@ sun::iptables -t mangle -v -n -L PREROUTING sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON sun::conntrack -F sun::rm /etc/mark_updown diff --git a/testing/tests/ikev2/rw-mark-in-out/pretest.dat b/testing/tests/ikev2/rw-mark-in-out/pretest.dat index 3d9a5f340..8e9dd2f51 100644 --- a/testing/tests/ikev2/rw-mark-in-out/pretest.dat +++ b/testing/tests/ikev2/rw-mark-in-out/pretest.dat @@ -1,13 +1,12 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON sun::ip route add 10.1.0.0/16 via PH_IP_MOON -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to 10.3.0.10 -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to 10.3.0.20 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.10 -j MARK --set-mark 11 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.20 -j MARK --set-mark 21 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10 +sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 11 +sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 21 alice::ipsec start venus::ipsec start sun::ipsec start diff --git a/testing/tests/ikev2/rw-mark-in-out/test.conf b/testing/tests/ikev2/rw-mark-in-out/test.conf index ae3c190b8..105472cbe 100644 --- a/testing/tests/ikev2/rw-mark-in-out/test.conf +++ b/testing/tests/ikev2/rw-mark-in-out/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/rw-pkcs8/evaltest.dat b/testing/tests/ikev2/rw-pkcs8/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev2/rw-pkcs8/evaltest.dat +++ b/testing/tests/ikev2/rw-pkcs8/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-pkcs8/posttest.dat b/testing/tests/ikev2/rw-pkcs8/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-pkcs8/posttest.dat +++ b/testing/tests/ikev2/rw-pkcs8/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-pkcs8/pretest.dat b/testing/tests/ikev2/rw-pkcs8/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-pkcs8/pretest.dat +++ b/testing/tests/ikev2/rw-pkcs8/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-pkcs8/test.conf b/testing/tests/ikev2/rw-pkcs8/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-pkcs8/test.conf +++ b/testing/tests/ikev2/rw-pkcs8/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat index 683173c30..2fbcc474f 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat @@ -7,8 +7,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat +++ b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat index 282b2aec0..64ce593fb 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat +++ b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/rw-psk-fqdn/test.conf b/testing/tests/ikev2/rw-psk-fqdn/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/test.conf +++ b/testing/tests/ikev2/rw-psk-fqdn/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat index 1ad36fcaf..2bd97b76c 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat @@ -1,13 +1,13 @@ -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*\[192.168.0.1]::YES -dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.200].*\[192.168.0.1]::YES -moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*\[192.168.0.1].*\[192.168.0.100]::YES -moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*\[192.168.0.1].*\[192.168.0.200]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*\[PH_IP_MOON]::YES +dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_DAVE].*\[PH_IP_MOON]::YES +moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*\[PH_IP_MOON].*\[PH_IP_CAROL]::YES +moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*\[PH_IP_MOON].*\[PH_IP_DAVE]::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets index 18a074472..57ce85d61 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets @@ -1,3 +1,3 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file -192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx +PH_IP_CAROL : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets index e989540e9..111de272b 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets @@ -1,3 +1,3 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file -192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN +PH_IP_DAVE : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets index ab3fb129b..6706534eb 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets @@ -1,5 +1,5 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file -192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx +PH_IP_CAROL : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx -192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN +PH_IP_DAVE : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat +++ b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat index 282b2aec0..64ce593fb 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat +++ b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/rw-psk-ipv4/test.conf b/testing/tests/ikev2/rw-psk-ipv4/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/test.conf +++ b/testing/tests/ikev2/rw-psk-ipv4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat +++ b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat index 282b2aec0..64ce593fb 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat +++ b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/rw-psk-no-idr/test.conf b/testing/tests/ikev2/rw-psk-no-idr/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/test.conf +++ b/testing/tests/ikev2/rw-psk-no-idr/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat index 51e868760..ab398a3bb 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat @@ -1,13 +1,13 @@ moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES moon:: cat /var/log/daemon.log::authentication of 'PH_IP_MOON' (myself) with pre-shared key::YES moon:: ipsec status 2> /dev/null::rw-psk.*INSTALLED, TUNNEL::YES -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*\[192.168.0.1]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*\[PH_IP_MOON]::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES moon:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' (myself) with RSA signature successful::YES moon:: ipsec status 2> /dev/null::rw-rsasig.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat index e48d11e42..446f81426 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::rm /etc/ipsec.d/cacerts/* moon::ipsec start carol::ipsec start diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat index 9a1ab3f8f..1648c9557 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat @@ -9,8 +9,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-psk-rsa-split/test.conf b/testing/tests/ikev2/rw-psk-rsa-split/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/test.conf +++ b/testing/tests/ikev2/rw-psk-rsa-split/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-radius-accounting/evaltest.dat b/testing/tests/ikev2/rw-radius-accounting/evaltest.dat index 5c453f8b4..ccbc769e2 100644 --- a/testing/tests/ikev2/rw-radius-accounting/evaltest.dat +++ b/testing/tests/ikev2/rw-radius-accounting/evaltest.dat @@ -9,6 +9,6 @@ carol::ping -c 5 -s 1392 PH_IP_ALICE::1400 bytes from PH_IP_ALICE::YES carol::ipsec down home 2> /dev/null::no output expected::NO moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES -alice::cat /var/log/radius/radacct/10.1.0.1/*::User-Name =.*carol::YES -alice::cat /var/log/radius/radacct/10.1.0.1/*::Acct-Output-Octets = 7100::YES -alice::cat /var/log/radius/radacct/10.1.0.1/*::Acct-Input-Octets = 7100::YES +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::User-Name =.*carol::YES +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::Acct-Output-Octets = 7100::YES +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::Acct-Input-Octets = 7100::YES diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..623f42904 --- /dev/null +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = md5 + md5 { + } +} diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf new file mode 100644 index 000000000..783587b55 --- /dev/null +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf @@ -0,0 +1,5 @@ +realm LOCAL { + type = radius + authhost = LOCAL + accthost = LOCAL +} diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default new file mode 100644 index 000000000..a67a5dcb4 --- /dev/null +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default @@ -0,0 +1,42 @@ +authorize { + eap { + ok = return + } + files +} + +authenticate { + eap +} + +preacct { + preprocess + acct_unique + suffix + files +} + +accounting { + detail + unix + radutmp + attr_filter.accounting_response +} + +session { + radutmp +} + +post-auth { + exec + Post-Auth-Type REJECT { + attr_filter.access_reject + } +} + +pre-proxy { +} + +post-proxy { + eap +} diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 962a418d9..000000000 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,88 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow RADIUS accounting protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1813 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1813 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..b9560a38e --- /dev/null +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules @@ -0,0 +1,36 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +# allow RADIUS accounting protocol with alice +-A INPUT -i eth1 -p udp --sport 1813 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1813 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-radius-accounting/posttest.dat b/testing/tests/ikev2/rw-radius-accounting/posttest.dat index b1f971402..98f7a6954 100644 --- a/testing/tests/ikev2/rw-radius-accounting/posttest.dat +++ b/testing/tests/ikev2/rw-radius-accounting/posttest.dat @@ -1,7 +1,6 @@ carol::ipsec stop moon::ipsec stop -alice::/etc/init.d/radiusd stop -alice::cat /var/log/radius/radacct/10.1.0.1/* -carol::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null - +alice::killall radiusd +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/* +carol::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-radius-accounting/pretest.dat b/testing/tests/ikev2/rw-radius-accounting/pretest.dat index 30c8bd573..9f437fe85 100644 --- a/testing/tests/ikev2/rw-radius-accounting/pretest.dat +++ b/testing/tests/ikev2/rw-radius-accounting/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::rm /var/log/radius/radacct/10.1.0.1/* -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::rm /var/log/freeradius/radacct/PH_IP_MOON1/* +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-radius-accounting/test.conf b/testing/tests/ikev2/rw-radius-accounting/test.conf index f2d20e984..6dbb1c7fd 100644 --- a/testing/tests/ikev2/rw-radius-accounting/test.conf +++ b/testing/tests/ikev2/rw-radius-accounting/test.conf @@ -1,25 +1,25 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-whitelist/evaltest.dat b/testing/tests/ikev2/rw-whitelist/evaltest.dat index d6f71d7c0..9418d6ee1 100644 --- a/testing/tests/ikev2/rw-whitelist/evaltest.dat +++ b/testing/tests/ikev2/rw-whitelist/evaltest.dat @@ -3,10 +3,10 @@ moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with RS moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES moon:: cat /var/log/daemon.log::peer identity 'dave@strongswan.org' not whitelisted::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log:: received AUTHENTICATION_FAILED notify error::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-whitelist/posttest.dat b/testing/tests/ikev2/rw-whitelist/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/rw-whitelist/posttest.dat +++ b/testing/tests/ikev2/rw-whitelist/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-whitelist/pretest.dat b/testing/tests/ikev2/rw-whitelist/pretest.dat index c4ac77d77..87760775a 100644 --- a/testing/tests/ikev2/rw-whitelist/pretest.dat +++ b/testing/tests/ikev2/rw-whitelist/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/rw-whitelist/test.conf b/testing/tests/ikev2/rw-whitelist/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/rw-whitelist/test.conf +++ b/testing/tests/ikev2/rw-whitelist/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/shunt-policies/evaltest.dat b/testing/tests/ikev2/shunt-policies/evaltest.dat index f40437e3e..a6e40a817 100644 --- a/testing/tests/ikev2/shunt-policies/evaltest.dat +++ b/testing/tests/ikev2/shunt-policies/evaltest.dat @@ -1,15 +1,15 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO +venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES venus::ssh PH_IP_BOB hostname::bob::YES diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 2b90a14c7..000000000 --- a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow icmp in local net - iptables -A INPUT -i eth1 -p icmp -j ACCEPT - iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf index 90a5d61b1..46ca4cdc3 100644 --- a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf @@ -18,7 +18,7 @@ conn local-net auto=route conn venus-icmp - leftsubnet=10.1.0.20/32 + leftsubnet=PH_IP_VENUS/32 rightsubnet=0.0.0.0/0 leftprotoport=icmp rightprotoport=icmp diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..af0f25209 --- /dev/null +++ b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow icmp in local net +-A INPUT -i eth1 -p icmp -j ACCEPT +-A OUTPUT -o eth1 -p icmp -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/shunt-policies/posttest.dat b/testing/tests/ikev2/shunt-policies/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/shunt-policies/posttest.dat +++ b/testing/tests/ikev2/shunt-policies/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/shunt-policies/pretest.dat b/testing/tests/ikev2/shunt-policies/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/shunt-policies/pretest.dat +++ b/testing/tests/ikev2/shunt-policies/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/shunt-policies/test.conf b/testing/tests/ikev2/shunt-policies/test.conf index cf2ef7424..6b7432ca6 100644 --- a/testing/tests/ikev2/shunt-policies/test.conf +++ b/testing/tests/ikev2/shunt-policies/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/strong-keys-certs/evaltest.dat b/testing/tests/ikev2/strong-keys-certs/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev2/strong-keys-certs/evaltest.dat +++ b/testing/tests/ikev2/strong-keys-certs/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/strong-keys-certs/posttest.dat b/testing/tests/ikev2/strong-keys-certs/posttest.dat index 9ccbaa1c2..3fd6a690e 100644 --- a/testing/tests/ikev2/strong-keys-certs/posttest.dat +++ b/testing/tests/ikev2/strong-keys-certs/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/private/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/strong-keys-certs/pretest.dat b/testing/tests/ikev2/strong-keys-certs/pretest.dat index de51ccdfa..dea5fc162 100644 --- a/testing/tests/ikev2/strong-keys-certs/pretest.dat +++ b/testing/tests/ikev2/strong-keys-certs/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/strong-keys-certs/test.conf b/testing/tests/ikev2/strong-keys-certs/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/strong-keys-certs/test.conf +++ b/testing/tests/ikev2/strong-keys-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/two-certs/evaltest.dat b/testing/tests/ikev2/two-certs/evaltest.dat index f50e7c30d..2b4476afa 100644 --- a/testing/tests/ikev2/two-certs/evaltest.dat +++ b/testing/tests/ikev2/two-certs/evaltest.dat @@ -1,11 +1,11 @@ moon:: cat /var/log/daemon.log::using certificate.*OU=Research, CN=carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::alice.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::signature validation failed, looking for another key::YES moon:: cat /var/log/daemon.log::using certificate.*OU=Research, SN=002, CN=carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::venus.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf index a0f44e312..9ec202e3d 100644 --- a/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf @@ -18,11 +18,11 @@ conn %default conn alice leftcert=carolCert.pem - rightsubnet=10.1.0.10/32 + rightsubnet=PH_IP_ALICE/32 auto=add conn venus leftcert=carolCert-002.pem - rightsubnet=10.1.0.20/32 + rightsubnet=PH_IP_VENUS/32 auto=add diff --git a/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf index dac656243..d8f1443ac 100644 --- a/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf @@ -23,10 +23,10 @@ conn %default keyexchange=ikev2 conn alice - leftsubnet=10.1.0.10/32 + leftsubnet=PH_IP_ALICE/32 auto=add conn venus - leftsubnet=10.1.0.20/32 + leftsubnet=PH_IP_VENUS/32 auto=add diff --git a/testing/tests/ikev2/two-certs/posttest.dat b/testing/tests/ikev2/two-certs/posttest.dat index a1f067838..eae8c27d4 100644 --- a/testing/tests/ikev2/two-certs/posttest.dat +++ b/testing/tests/ikev2/two-certs/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/two-certs/pretest.dat b/testing/tests/ikev2/two-certs/pretest.dat index 716cf71e8..fe2aaec19 100644 --- a/testing/tests/ikev2/two-certs/pretest.dat +++ b/testing/tests/ikev2/two-certs/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/two-certs/test.conf b/testing/tests/ikev2/two-certs/test.conf index d0306cd25..3f6afa02e 100644 --- a/testing/tests/ikev2/two-certs/test.conf +++ b/testing/tests/ikev2/two-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou" +VIRTHOSTS="alice venus moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/virtual-ip-override/posttest.dat b/testing/tests/ikev2/virtual-ip-override/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/virtual-ip-override/posttest.dat +++ b/testing/tests/ikev2/virtual-ip-override/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/virtual-ip-override/pretest.dat b/testing/tests/ikev2/virtual-ip-override/pretest.dat index 5ec37aae1..1765a83cd 100644 --- a/testing/tests/ikev2/virtual-ip-override/pretest.dat +++ b/testing/tests/ikev2/virtual-ip-override/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/virtual-ip-override/test.conf b/testing/tests/ikev2/virtual-ip-override/test.conf index 01c94f7fb..5139506ac 100644 --- a/testing/tests/ikev2/virtual-ip-override/test.conf +++ b/testing/tests/ikev2/virtual-ip-override/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/virtual-ip/evaltest.dat b/testing/tests/ikev2/virtual-ip/evaltest.dat index dd3143ae7..0f5df71d7 100644 --- a/testing/tests/ikev2/virtual-ip/evaltest.dat +++ b/testing/tests/ikev2/virtual-ip/evaltest.dat @@ -14,12 +14,12 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::src PH_IP_CAROL1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::src PH_IP_DAVE1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/virtual-ip/posttest.dat b/testing/tests/ikev2/virtual-ip/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/virtual-ip/posttest.dat +++ b/testing/tests/ikev2/virtual-ip/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/virtual-ip/pretest.dat b/testing/tests/ikev2/virtual-ip/pretest.dat index 5ec37aae1..1765a83cd 100644 --- a/testing/tests/ikev2/virtual-ip/pretest.dat +++ b/testing/tests/ikev2/virtual-ip/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/virtual-ip/test.conf b/testing/tests/ikev2/virtual-ip/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/virtual-ip/test.conf +++ b/testing/tests/ikev2/virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat index e3da87520..3c4832e5e 100644 --- a/testing/tests/ikev2/wildcards/pretest.dat +++ b/testing/tests/ikev2/wildcards/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/wildcards/test.conf +++ b/testing/tests/ikev2/wildcards/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev1/posttest.dat b/testing/tests/ipv6/host2host-ikev1/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/host2host-ikev1/posttest.dat +++ b/testing/tests/ipv6/host2host-ikev1/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/host2host-ikev1/pretest.dat b/testing/tests/ipv6/host2host-ikev1/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/host2host-ikev1/pretest.dat +++ b/testing/tests/ipv6/host2host-ikev1/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/host2host-ikev1/test.conf b/testing/tests/ipv6/host2host-ikev1/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/host2host-ikev1/test.conf +++ b/testing/tests/ipv6/host2host-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev2/posttest.dat b/testing/tests/ipv6/host2host-ikev2/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/host2host-ikev2/posttest.dat +++ b/testing/tests/ipv6/host2host-ikev2/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/host2host-ikev2/pretest.dat b/testing/tests/ipv6/host2host-ikev2/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/host2host-ikev2/pretest.dat +++ b/testing/tests/ipv6/host2host-ikev2/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/host2host-ikev2/test.conf b/testing/tests/ipv6/host2host-ikev2/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/host2host-ikev2/test.conf +++ b/testing/tests/ipv6/host2host-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ikev1/posttest.dat index 4c95e2afe..078fca541 100644 --- a/testing/tests/ipv6/net2net-ikev1/posttest.dat +++ b/testing/tests/ipv6/net2net-ikev1/posttest.dat @@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1" moon::"ip route del fec2:\:/16 via fec0:\:2" sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ikev1/pretest.dat index 8a8af2ccb..a14b3cf79 100644 --- a/testing/tests/ipv6/net2net-ikev1/pretest.dat +++ b/testing/tests/ipv6/net2net-ikev1/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" moon::"ip route add fec2:\:/16 via fec0:\:2" sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ikev1/test.conf b/testing/tests/ipv6/net2net-ikev1/test.conf index 991d884db..55b90befe 100644 --- a/testing/tests/ipv6/net2net-ikev1/test.conf +++ b/testing/tests/ipv6/net2net-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ikev2/posttest.dat index 4c95e2afe..078fca541 100644 --- a/testing/tests/ipv6/net2net-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-ikev2/posttest.dat @@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1" moon::"ip route del fec2:\:/16 via fec0:\:2" sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ikev2/pretest.dat index 8a8af2ccb..a14b3cf79 100644 --- a/testing/tests/ipv6/net2net-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-ikev2/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" moon::"ip route add fec2:\:/16 via fec0:\:2" sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ikev2/test.conf b/testing/tests/ipv6/net2net-ikev2/test.conf index 991d884db..55b90befe 100644 --- a/testing/tests/ipv6/net2net-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat index 3b3200418..151b73c27 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat index a88456d52..812ccd162 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 2 diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf index cab801a1c..8f8d9222d 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip4-in-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat index 3b3200418..151b73c27 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat index a88456d52..812ccd162 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 2 diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf index cab801a1c..8f8d9222d 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip4-in-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index d556762b7..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 21ff88d0d..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat index c78d884ee..078fca541 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat @@ -1,8 +1,10 @@ moon::ipsec stop sun::ipsec stop alice::"ip route del fec2:\:/16 via fec1:\:1" -moon::"ip route del fec2:\:/16 via fec0:\:2" -sun::"ip route del fec1:\:/16 via fec0:\:1" +moon::"ip route del fec2:\:/16 via fec0:\:2" +sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat index 7781f9b9f..58711bc06 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" -moon::"ip route add fec2:\:/16 via fec0:\:2" -sun::"ip route add fec1:\:/16 via fec0:\:1" +moon::"ip route add fec2:\:/16 via fec0:\:2" +sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf index d5d55c749..fe141076d 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6-in-ip4.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index d556762b7..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 21ff88d0d..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat index c78d884ee..078fca541 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat @@ -1,8 +1,10 @@ moon::ipsec stop sun::ipsec stop alice::"ip route del fec2:\:/16 via fec1:\:1" -moon::"ip route del fec2:\:/16 via fec0:\:2" -sun::"ip route del fec1:\:/16 via fec0:\:1" +moon::"ip route del fec2:\:/16 via fec0:\:2" +sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat index 7781f9b9f..58711bc06 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" -moon::"ip route add fec2:\:/16 via fec0:\:2" -sun::"ip route add fec1:\:/16 via fec0:\:1" +moon::"ip route add fec2:\:/16 via fec0:\:2" +sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf index d5d55c749..fe141076d 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6-in-ip4.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat b/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat index 4c95e2afe..078fca541 100644 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat @@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1" moon::"ip route del fec2:\:/16 via fec0:\:2" sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat b/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat index 8a8af2ccb..a14b3cf79 100644 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" moon::"ip route add fec2:\:/16 via fec0:\:2" sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf b/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf index 991d884db..55b90befe 100644 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev1/posttest.dat b/testing/tests/ipv6/rw-ikev1/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-ikev1/posttest.dat +++ b/testing/tests/ipv6/rw-ikev1/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-ikev1/pretest.dat b/testing/tests/ipv6/rw-ikev1/pretest.dat index 7da0c1028..f60be3887 100644 --- a/testing/tests/ipv6/rw-ikev1/pretest.dat +++ b/testing/tests/ipv6/rw-ikev1/pretest.dat @@ -1,13 +1,17 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ikev1/test.conf b/testing/tests/ipv6/rw-ikev1/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ikev1/test.conf +++ b/testing/tests/ipv6/rw-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev2/posttest.dat b/testing/tests/ipv6/rw-ikev2/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-ikev2/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-ikev2/pretest.dat b/testing/tests/ipv6/rw-ikev2/pretest.dat index 7da0c1028..f60be3887 100644 --- a/testing/tests/ipv6/rw-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-ikev2/pretest.dat @@ -1,13 +1,17 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ikev2/test.conf b/testing/tests/ipv6/rw-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ikev2/test.conf +++ b/testing/tests/ipv6/rw-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index f5bd956ad..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat index 179b8fe58..ebe5e2a80 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat @@ -1,7 +1,10 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec3:\:/16 via fec1:\:1" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat index ca544e373..e73bde487 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat @@ -1,11 +1,15 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec3:\:/16 via fec1:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt deleted file mode 100644 index 9609ae268..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt +++ /dev/null @@ -1,10 +0,0 @@ -The roadwarriors <b>carol</b> and <b>dave</b> set up an IPv6-in-IPv4 tunnel connection each -to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>. -Both <b>carol</b> and <b>dave</b> request a virtual IPv6 address from <b>moon</b> via -the IKEvi1 mode config payload. -<p/> -Upon the successful establishment of the ESP tunnels, <b>leftfirewall=yes</b> -automatically inserts ip6tables-based firewall rules that let pass the tunneled traffic. -In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> send -an IPv6 ICMP request to the client <b>alice</b> behind the gateway <b>moon</b> -using the ping6 command. diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat deleted file mode 100644 index f6dc9aa3e..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat +++ /dev/null @@ -1,15 +0,0 @@ -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES -moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES -moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES -carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES -moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES -dave:: ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES -moon::tcpdump::carol.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::moon.strongswan.org > carol.strongswan.org: ESP::YES -moon::tcpdump::dave.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::moon.strongswan.org > dave.strongswan.org: ESP::YES - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat deleted file mode 100644 index 179b8fe58..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -alice::"ip route del fec3:\:/16 via fec1:\:1" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat deleted file mode 100644 index ca544e373..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::"ip route add fec3:\:/16 via fec1:\:1" -moon::ipsec start -carol::ipsec start -dave::ipsec start -carol::sleep 1 -carol::ipsec up home -dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf deleted file mode 100644 index 80cf5e3a1..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# UML instances used for this test - -# All UML instances that are required for this test -# -UMLHOSTS="alice moon carol winnetou dave" - -# Corresponding block diagram -# -DIAGRAM="a-m-c-w-d-ip6.png" - -# UML instances on which tcpdump is to be started -# -TCPDUMPHOSTS="moon" - -# UML instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index f5bd956ad..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat index 179b8fe58..ebe5e2a80 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat @@ -1,7 +1,10 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec3:\:/16 via fec1:\:1" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat index ca544e373..e73bde487 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat @@ -1,11 +1,15 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec3:\:/16 via fec1:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev1/posttest.dat b/testing/tests/ipv6/rw-psk-ikev1/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-psk-ikev1/posttest.dat +++ b/testing/tests/ipv6/rw-psk-ikev1/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-psk-ikev1/pretest.dat b/testing/tests/ipv6/rw-psk-ikev1/pretest.dat index e3040d125..93a96ec36 100644 --- a/testing/tests/ipv6/rw-psk-ikev1/pretest.dat +++ b/testing/tests/ipv6/rw-psk-ikev1/pretest.dat @@ -1,6 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" @@ -10,7 +13,8 @@ dave::rm /etc/ipsec.d/cacerts/* moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 1 diff --git a/testing/tests/ipv6/rw-psk-ikev1/test.conf b/testing/tests/ipv6/rw-psk-ikev1/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-psk-ikev1/test.conf +++ b/testing/tests/ipv6/rw-psk-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev2/posttest.dat b/testing/tests/ipv6/rw-psk-ikev2/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-psk-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-psk-ikev2/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-psk-ikev2/pretest.dat b/testing/tests/ipv6/rw-psk-ikev2/pretest.dat index e3040d125..93a96ec36 100644 --- a/testing/tests/ipv6/rw-psk-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-psk-ikev2/pretest.dat @@ -1,6 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" @@ -10,7 +13,8 @@ dave::rm /etc/ipsec.d/cacerts/* moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 1 diff --git a/testing/tests/ipv6/rw-psk-ikev2/test.conf b/testing/tests/ipv6/rw-psk-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-psk-ikev2/test.conf +++ b/testing/tests/ipv6/rw-psk-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat b/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat b/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat index 7da0c1028..f60be3887 100644 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat @@ -1,13 +1,17 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf b/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf +++ b/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 343fd49ed..000000000 --- a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certficate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev1/posttest.dat b/testing/tests/ipv6/transport-ikev1/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/transport-ikev1/posttest.dat +++ b/testing/tests/ipv6/transport-ikev1/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/transport-ikev1/pretest.dat b/testing/tests/ipv6/transport-ikev1/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/transport-ikev1/pretest.dat +++ b/testing/tests/ipv6/transport-ikev1/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/transport-ikev1/test.conf b/testing/tests/ipv6/transport-ikev1/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/transport-ikev1/test.conf +++ b/testing/tests/ipv6/transport-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b1e7073af..000000000 --- a/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certficate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev2/posttest.dat b/testing/tests/ipv6/transport-ikev2/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/transport-ikev2/posttest.dat +++ b/testing/tests/ipv6/transport-ikev2/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/transport-ikev2/pretest.dat b/testing/tests/ipv6/transport-ikev2/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/transport-ikev2/pretest.dat +++ b/testing/tests/ipv6/transport-ikev2/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/transport-ikev2/test.conf b/testing/tests/ipv6/transport-ikev2/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/transport-ikev2/test.conf +++ b/testing/tests/ipv6/transport-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat index 5b5c94fb1..4d614bf7e 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat +++ b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/openssl-ikev1/alg-camellia/posttest.dat b/testing/tests/openssl-ikev1/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/posttest.dat +++ b/testing/tests/openssl-ikev1/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/alg-camellia/pretest.dat b/testing/tests/openssl-ikev1/alg-camellia/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/pretest.dat +++ b/testing/tests/openssl-ikev1/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/openssl-ikev1/alg-camellia/test.conf b/testing/tests/openssl-ikev1/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/test.conf +++ b/testing/tests/openssl-ikev1/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat index 2ba48e5ce..ac7d8cd98 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/test.conf b/testing/tests/openssl-ikev1/alg-ecp-high/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/test.conf +++ b/testing/tests/openssl-ikev1/alg-ecp-high/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat index 6cf2438d4..178d541da 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_224::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/test.conf b/testing/tests/openssl-ikev1/alg-ecp-low/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/test.conf +++ b/testing/tests/openssl-ikev1/alg-ecp-low/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat index 244ea0331..69c893f0c 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat +++ b/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA successful::YES carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA successful::YES dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat +++ b/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat +++ b/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/test.conf b/testing/tests/openssl-ikev1/ecdsa-certs/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/test.conf +++ b/testing/tests/openssl-ikev1/ecdsa-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat b/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat index 3787bdb68..cd83c56b4 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat @@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_384_192,::YES dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA2_256_128,::YES carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES diff --git a/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat b/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat b/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/alg-blowfish/test.conf b/testing/tests/openssl-ikev2/alg-blowfish/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/test.conf +++ b/testing/tests/openssl-ikev2/alg-blowfish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat index 5b5c94fb1..4d614bf7e 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/openssl-ikev2/alg-camellia/posttest.dat b/testing/tests/openssl-ikev2/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-camellia/pretest.dat b/testing/tests/openssl-ikev2/alg-camellia/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/openssl-ikev2/alg-camellia/test.conf b/testing/tests/openssl-ikev2/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/test.conf +++ b/testing/tests/openssl-ikev2/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat index 2540eb106..375ed86a1 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat @@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::ECP_256.*ECP_384::YES dave:: cat /var/log/daemon.log::ECP_256.*ECP_521::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/test.conf b/testing/tests/openssl-ikev2/alg-ecp-high/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/test.conf +++ b/testing/tests/openssl-ikev2/alg-ecp-high/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat index f82159e7c..c46ed1dd2 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat @@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::ECP_192.*ECP_224::YES dave:: cat /var/log/daemon.log::ECP_192.*ECP_256::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_224::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/test.conf b/testing/tests/openssl-ikev2/alg-ecp-low/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/test.conf +++ b/testing/tests/openssl-ikev2/alg-ecp-low/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/critical-extension/posttest.dat b/testing/tests/openssl-ikev2/critical-extension/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/openssl-ikev2/critical-extension/posttest.dat +++ b/testing/tests/openssl-ikev2/critical-extension/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/critical-extension/pretest.dat b/testing/tests/openssl-ikev2/critical-extension/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/openssl-ikev2/critical-extension/pretest.dat +++ b/testing/tests/openssl-ikev2/critical-extension/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/openssl-ikev2/critical-extension/test.conf b/testing/tests/openssl-ikev2/critical-extension/test.conf index 41ee3037e..b286ef6eb 100644 --- a/testing/tests/openssl-ikev2/critical-extension/test.conf +++ b/testing/tests/openssl-ikev2/critical-extension/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat index 5918faa8c..0110bb996 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat @@ -10,8 +10,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA-384 signature successful::YES carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/test.conf b/testing/tests/openssl-ikev2/ecdsa-certs/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/test.conf +++ b/testing/tests/openssl-ikev2/ecdsa-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat index 52913759f..8a4215dcc 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat @@ -6,8 +6,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA-384 signature successful::YES carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf b/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/rw-cert/evaltest.dat b/testing/tests/openssl-ikev2/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/openssl-ikev2/rw-cert/evaltest.dat +++ b/testing/tests/openssl-ikev2/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/rw-cert/posttest.dat b/testing/tests/openssl-ikev2/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/rw-cert/posttest.dat +++ b/testing/tests/openssl-ikev2/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/rw-cert/pretest.dat b/testing/tests/openssl-ikev2/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/rw-cert/pretest.dat +++ b/testing/tests/openssl-ikev2/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/rw-cert/test.conf b/testing/tests/openssl-ikev2/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/rw-cert/test.conf +++ b/testing/tests/openssl-ikev2/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat index e476da03f..1ae780e4b 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat @@ -5,6 +5,6 @@ carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_ECDHE_ECDSA_W carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=ECDSA 521 bit, CN=moon.strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=ECDSA 256 bit, CN=carol@strongswan.org' with EAP successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf b/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/p2pnat/behind-same-nat/evaltest.dat b/testing/tests/p2pnat/behind-same-nat/evaltest.dat index 8c79a28c1..378520596 100644 --- a/testing/tests/p2pnat/behind-same-nat/evaltest.dat +++ b/testing/tests/p2pnat/behind-same-nat/evaltest.dat @@ -7,5 +7,5 @@ alice::ipsec status 2> /dev/null::peer.*ESTABLISHED.*alice@strongswan.org.*venus venus::ipsec status 2> /dev/null::peer.*ESTABLISHED.*venus.strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES venus::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 1eb88c15c..000000000 --- a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..da385d22a --- /dev/null +++ b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 40510ce60..000000000 --- a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE behind NAT - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 6fca87b4a..000000000 --- a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules new file mode 100644 index 000000000..da385d22a --- /dev/null +++ b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/behind-same-nat/posttest.dat b/testing/tests/p2pnat/behind-same-nat/posttest.dat index 36cd0f36d..a1d5b4612 100644 --- a/testing/tests/p2pnat/behind-same-nat/posttest.dat +++ b/testing/tests/p2pnat/behind-same-nat/posttest.dat @@ -1,8 +1,8 @@ venus::ipsec stop alice::ipsec stop carol::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush moon::conntrack -F diff --git a/testing/tests/p2pnat/behind-same-nat/pretest.dat b/testing/tests/p2pnat/behind-same-nat/pretest.dat index f1e33dc39..eb1d67fa2 100644 --- a/testing/tests/p2pnat/behind-same-nat/pretest.dat +++ b/testing/tests/p2pnat/behind-same-nat/pretest.dat @@ -1,7 +1,7 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +moon::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT @@ -10,5 +10,5 @@ carol::ipsec start carol::sleep 1 alice::ipsec start alice::sleep 1 -venus::ipsec start -venus::sleep 4 +venus::ipsec start +venus::sleep 4 diff --git a/testing/tests/p2pnat/behind-same-nat/test.conf b/testing/tests/p2pnat/behind-same-nat/test.conf index f98a0ab1b..fe44ff97b 100644 --- a/testing/tests/p2pnat/behind-same-nat/test.conf +++ b/testing/tests/p2pnat/behind-same-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou" +VIRTHOSTS="alice venus moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-med.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus carol" diff --git a/testing/tests/p2pnat/medsrv-psk/evaltest.dat b/testing/tests/p2pnat/medsrv-psk/evaltest.dat index 1b89c7ebe..2c6080775 100644 --- a/testing/tests/p2pnat/medsrv-psk/evaltest.dat +++ b/testing/tests/p2pnat/medsrv-psk/evaltest.dat @@ -6,7 +6,7 @@ alice::ipsec status 2> /dev/null::peer.*ESTABLISHED.*alice@strongswan.org.*bob@s bob:: ipsec status 2> /dev/null::peer.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES bob:: ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.*: UDP::YES moon::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables deleted file mode 100755 index c6371c745..000000000 --- a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 40510ce60..000000000 --- a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE behind NAT - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/medsrv-psk/posttest.dat b/testing/tests/p2pnat/medsrv-psk/posttest.dat index ca3cebc0a..4b696b90f 100644 --- a/testing/tests/p2pnat/medsrv-psk/posttest.dat +++ b/testing/tests/p2pnat/medsrv-psk/posttest.dat @@ -1,10 +1,10 @@ bob::ipsec stop alice::ipsec stop carol::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::conntrack -F sun::conntrack -F diff --git a/testing/tests/p2pnat/medsrv-psk/pretest.dat b/testing/tests/p2pnat/medsrv-psk/pretest.dat index fba7be01d..09b658318 100644 --- a/testing/tests/p2pnat/medsrv-psk/pretest.dat +++ b/testing/tests/p2pnat/medsrv-psk/pretest.dat @@ -1,8 +1,8 @@ -alice::/etc/init.d/iptables start 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT @@ -15,5 +15,5 @@ carol::ipsec start carol::sleep 1 bob::ipsec start bob::sleep 1 -alice::ipsec start -alice::sleep 4 +alice::ipsec start +alice::sleep 4 diff --git a/testing/tests/p2pnat/medsrv-psk/test.conf b/testing/tests/p2pnat/medsrv-psk/test.conf index 2dc4cd8c1..a1c6b8c15 100644 --- a/testing/tests/p2pnat/medsrv-psk/test.conf +++ b/testing/tests/p2pnat/medsrv-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou sun bob" +VIRTHOSTS="alice moon carol winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-c-w-s-b-med.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice carol bob" diff --git a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat index 9ca168e82..590b7fe9c 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat +++ b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES -moon:: ip xfrm state::auth xcbc(aes)::YES -carol::ip xfrm state::auth xcbc(aes)::YES +moon:: ip xfrm state::auth-trunc xcbc(aes)::YES +carol::ip xfrm state::auth-trunc xcbc(aes)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/pfkey/alg-aes-xcbc/posttest.dat b/testing/tests/pfkey/alg-aes-xcbc/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/posttest.dat +++ b/testing/tests/pfkey/alg-aes-xcbc/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/alg-aes-xcbc/pretest.dat b/testing/tests/pfkey/alg-aes-xcbc/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/pretest.dat +++ b/testing/tests/pfkey/alg-aes-xcbc/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/alg-aes-xcbc/test.conf b/testing/tests/pfkey/alg-aes-xcbc/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/test.conf +++ b/testing/tests/pfkey/alg-aes-xcbc/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/alg-sha384/evaltest.dat b/testing/tests/pfkey/alg-sha384/evaltest.dat index 21b3d5a4f..3b24217c5 100644 --- a/testing/tests/pfkey/alg-sha384/evaltest.dat +++ b/testing/tests/pfkey/alg-sha384/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES -moon:: ip xfrm state::auth hmac(sha384)::YES -carol::ip xfrm state::auth hmac(sha384)::YES +moon:: ip xfrm state::auth-trunc hmac(sha384)::YES +carol::ip xfrm state::auth-trunc hmac(sha384)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/pfkey/alg-sha384/posttest.dat b/testing/tests/pfkey/alg-sha384/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/alg-sha384/posttest.dat +++ b/testing/tests/pfkey/alg-sha384/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/alg-sha384/pretest.dat b/testing/tests/pfkey/alg-sha384/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/alg-sha384/pretest.dat +++ b/testing/tests/pfkey/alg-sha384/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/alg-sha384/test.conf b/testing/tests/pfkey/alg-sha384/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/alg-sha384/test.conf +++ b/testing/tests/pfkey/alg-sha384/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/alg-sha512/evaltest.dat b/testing/tests/pfkey/alg-sha512/evaltest.dat index 7b94d2182..6bdceeb44 100644 --- a/testing/tests/pfkey/alg-sha512/evaltest.dat +++ b/testing/tests/pfkey/alg-sha512/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES -moon:: ip xfrm state::auth hmac(sha512)::YES -carol::ip xfrm state::auth hmac(sha512)::YES +moon:: ip xfrm state::auth-trunc hmac(sha512)::YES +carol::ip xfrm state::auth-trunc hmac(sha512)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES diff --git a/testing/tests/pfkey/alg-sha512/posttest.dat b/testing/tests/pfkey/alg-sha512/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/alg-sha512/posttest.dat +++ b/testing/tests/pfkey/alg-sha512/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/alg-sha512/pretest.dat b/testing/tests/pfkey/alg-sha512/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/alg-sha512/pretest.dat +++ b/testing/tests/pfkey/alg-sha512/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/alg-sha512/test.conf b/testing/tests/pfkey/alg-sha512/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/alg-sha512/test.conf +++ b/testing/tests/pfkey/alg-sha512/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/esp-alg-null/evaltest.dat b/testing/tests/pfkey/esp-alg-null/evaltest.dat index 271e274c8..c50b188bb 100644 --- a/testing/tests/pfkey/esp-alg-null/evaltest.dat +++ b/testing/tests/pfkey/esp-alg-null/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES moon:: ip xfrm state::enc ecb(cipher_null)::YES diff --git a/testing/tests/pfkey/esp-alg-null/posttest.dat b/testing/tests/pfkey/esp-alg-null/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/esp-alg-null/posttest.dat +++ b/testing/tests/pfkey/esp-alg-null/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/esp-alg-null/pretest.dat b/testing/tests/pfkey/esp-alg-null/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/esp-alg-null/pretest.dat +++ b/testing/tests/pfkey/esp-alg-null/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/esp-alg-null/test.conf b/testing/tests/pfkey/esp-alg-null/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/esp-alg-null/test.conf +++ b/testing/tests/pfkey/esp-alg-null/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/host2host-transport/evaltest.dat b/testing/tests/pfkey/host2host-transport/evaltest.dat index 5ef5bed9c..fbd0c1c96 100644 --- a/testing/tests/pfkey/host2host-transport/evaltest.dat +++ b/testing/tests/pfkey/host2host-transport/evaltest.dat @@ -5,6 +5,6 @@ sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES moon::cat /var/log/daemon.log::parsed IKE_AUTH response.*N(USE_TRANSP)::YES moon::ip xfrm state::mode transport::YES sun:: ip xfrm state::mode transport::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/host2host-transport/posttest.dat b/testing/tests/pfkey/host2host-transport/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/pfkey/host2host-transport/posttest.dat +++ b/testing/tests/pfkey/host2host-transport/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/host2host-transport/pretest.dat b/testing/tests/pfkey/host2host-transport/pretest.dat index e2d98f2eb..99789b90f 100644 --- a/testing/tests/pfkey/host2host-transport/pretest.dat +++ b/testing/tests/pfkey/host2host-transport/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/pfkey/host2host-transport/test.conf b/testing/tests/pfkey/host2host-transport/test.conf index cf2e704fd..5a286c84f 100644 --- a/testing/tests/pfkey/host2host-transport/test.conf +++ b/testing/tests/pfkey/host2host-transport/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/pfkey/nat-rw/evaltest.dat b/testing/tests/pfkey/nat-rw/evaltest.dat index a0b9c678f..ac09e2d6b 100644 --- a/testing/tests/pfkey/nat-rw/evaltest.dat +++ b/testing/tests/pfkey/nat-rw/evaltest.dat @@ -6,7 +6,7 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/pfkey/nat-rw/posttest.dat b/testing/tests/pfkey/nat-rw/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/pfkey/nat-rw/posttest.dat +++ b/testing/tests/pfkey/nat-rw/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/pfkey/nat-rw/pretest.dat b/testing/tests/pfkey/nat-rw/pretest.dat index e365ff5c5..d701a1d61 100644 --- a/testing/tests/pfkey/nat-rw/pretest.dat +++ b/testing/tests/pfkey/nat-rw/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start diff --git a/testing/tests/pfkey/nat-rw/test.conf b/testing/tests/pfkey/nat-rw/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/pfkey/nat-rw/test.conf +++ b/testing/tests/pfkey/nat-rw/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/pfkey/net2net-route/evaltest.dat b/testing/tests/pfkey/net2net-route/evaltest.dat index 9adb31e97..1de6ca8e1 100644 --- a/testing/tests/pfkey/net2net-route/evaltest.dat +++ b/testing/tests/pfkey/net2net-route/evaltest.dat @@ -4,6 +4,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/net2net-route/posttest.dat b/testing/tests/pfkey/net2net-route/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/pfkey/net2net-route/posttest.dat +++ b/testing/tests/pfkey/net2net-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/net2net-route/pretest.dat b/testing/tests/pfkey/net2net-route/pretest.dat index 2eef7de19..e4ee3fac2 100644 --- a/testing/tests/pfkey/net2net-route/pretest.dat +++ b/testing/tests/pfkey/net2net-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/pfkey/net2net-route/test.conf b/testing/tests/pfkey/net2net-route/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/pfkey/net2net-route/test.conf +++ b/testing/tests/pfkey/net2net-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/pfkey/protoport-dual/evaltest.dat b/testing/tests/pfkey/protoport-dual/evaltest.dat index d2fc698f9..50b53cc00 100644 --- a/testing/tests/pfkey/protoport-dual/evaltest.dat +++ b/testing/tests/pfkey/protoport-dual/evaltest.dat @@ -4,8 +4,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/protoport-dual/posttest.dat b/testing/tests/pfkey/protoport-dual/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/protoport-dual/posttest.dat +++ b/testing/tests/pfkey/protoport-dual/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/protoport-dual/pretest.dat b/testing/tests/pfkey/protoport-dual/pretest.dat index d3d0061c3..efb2e5712 100644 --- a/testing/tests/pfkey/protoport-dual/pretest.dat +++ b/testing/tests/pfkey/protoport-dual/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/pfkey/protoport-dual/test.conf b/testing/tests/pfkey/protoport-dual/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/protoport-dual/test.conf +++ b/testing/tests/pfkey/protoport-dual/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/protoport-route/evaltest.dat b/testing/tests/pfkey/protoport-route/evaltest.dat index 09dfd8f42..9e970f055 100644 --- a/testing/tests/pfkey/protoport-route/evaltest.dat +++ b/testing/tests/pfkey/protoport-route/evaltest.dat @@ -1,5 +1,5 @@ -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req::YES carol::ssh PH_IP_ALICE hostname::alice::YES carol::cat /var/log/daemon.log::creating acquire job::YES carol::ipsec status 2> /dev/null::home-icmp.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES diff --git a/testing/tests/pfkey/protoport-route/posttest.dat b/testing/tests/pfkey/protoport-route/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/protoport-route/posttest.dat +++ b/testing/tests/pfkey/protoport-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/protoport-route/pretest.dat b/testing/tests/pfkey/protoport-route/pretest.dat index 0aded0f4d..5a15574d6 100644 --- a/testing/tests/pfkey/protoport-route/pretest.dat +++ b/testing/tests/pfkey/protoport-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/protoport-route/test.conf b/testing/tests/pfkey/protoport-route/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/protoport-route/test.conf +++ b/testing/tests/pfkey/protoport-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/rw-cert/evaltest.dat b/testing/tests/pfkey/rw-cert/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/pfkey/rw-cert/evaltest.dat +++ b/testing/tests/pfkey/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/rw-cert/posttest.dat b/testing/tests/pfkey/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/pfkey/rw-cert/posttest.dat +++ b/testing/tests/pfkey/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/rw-cert/pretest.dat b/testing/tests/pfkey/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/pfkey/rw-cert/pretest.dat +++ b/testing/tests/pfkey/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/pfkey/rw-cert/test.conf b/testing/tests/pfkey/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/pfkey/rw-cert/test.conf +++ b/testing/tests/pfkey/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/pfkey/shunt-policies/evaltest.dat b/testing/tests/pfkey/shunt-policies/evaltest.dat index 87368fb31..6ba3a988f 100644 --- a/testing/tests/pfkey/shunt-policies/evaltest.dat +++ b/testing/tests/pfkey/shunt-policies/evaltest.dat @@ -4,16 +4,16 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO +venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES venus::ssh PH_IP_BOB hostname::bob::YES diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 2b90a14c7..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow icmp in local net - iptables -A INPUT -i eth1 -p icmp -j ACCEPT - iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..af0f25209 --- /dev/null +++ b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow icmp in local net +-A INPUT -i eth1 -p icmp -j ACCEPT +-A OUTPUT -o eth1 -p icmp -j ACCEPT + +COMMIT diff --git a/testing/tests/pfkey/shunt-policies/posttest.dat b/testing/tests/pfkey/shunt-policies/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/pfkey/shunt-policies/posttest.dat +++ b/testing/tests/pfkey/shunt-policies/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/shunt-policies/pretest.dat b/testing/tests/pfkey/shunt-policies/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/pfkey/shunt-policies/pretest.dat +++ b/testing/tests/pfkey/shunt-policies/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/pfkey/shunt-policies/test.conf b/testing/tests/pfkey/shunt-policies/test.conf index cf2ef7424..6b7432ca6 100644 --- a/testing/tests/pfkey/shunt-policies/test.conf +++ b/testing/tests/pfkey/shunt-policies/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/ip-pool-db-expired/evaltest.dat b/testing/tests/sql/ip-pool-db-expired/evaltest.dat index 3239dfe1f..5ff5edbf8 100644 --- a/testing/tests/sql/ip-pool-db-expired/evaltest.dat +++ b/testing/tests/sql/ip-pool-db-expired/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/sql/ip-pool-db-expired/posttest.dat b/testing/tests/sql/ip-pool-db-expired/posttest.dat index 40b1a403e..1b963fcec 100644 --- a/testing/tests/sql/ip-pool-db-expired/posttest.dat +++ b/testing/tests/sql/ip-pool-db-expired/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/ip-pool-db-expired/pretest.dat b/testing/tests/sql/ip-pool-db-expired/pretest.dat index 4df33509f..391785a1c 100644 --- a/testing/tests/sql/ip-pool-db-expired/pretest.dat +++ b/testing/tests/sql/ip-pool-db-expired/pretest.dat @@ -8,9 +8,9 @@ moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db moon::ipsec pool --leases 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/ip-pool-db-expired/test.conf b/testing/tests/sql/ip-pool-db-expired/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-pool-db-expired/test.conf +++ b/testing/tests/sql/ip-pool-db-expired/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-pool-db-restart/evaltest.dat b/testing/tests/sql/ip-pool-db-restart/evaltest.dat index 58706fa48..f70e2d2de 100644 --- a/testing/tests/sql/ip-pool-db-restart/evaltest.dat +++ b/testing/tests/sql/ip-pool-db-restart/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired existing lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/sql/ip-pool-db-restart/posttest.dat b/testing/tests/sql/ip-pool-db-restart/posttest.dat index 40b1a403e..1b963fcec 100644 --- a/testing/tests/sql/ip-pool-db-restart/posttest.dat +++ b/testing/tests/sql/ip-pool-db-restart/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/ip-pool-db-restart/pretest.dat b/testing/tests/sql/ip-pool-db-restart/pretest.dat index b5108051c..20b1937b7 100644 --- a/testing/tests/sql/ip-pool-db-restart/pretest.dat +++ b/testing/tests/sql/ip-pool-db-restart/pretest.dat @@ -8,9 +8,9 @@ moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db moon::ipsec pool --leases 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/ip-pool-db-restart/test.conf b/testing/tests/sql/ip-pool-db-restart/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-pool-db-restart/test.conf +++ b/testing/tests/sql/ip-pool-db-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-pool-db/evaltest.dat b/testing/tests/sql/ip-pool-db/evaltest.dat index 3910ab9c2..cfa87ae3f 100644 --- a/testing/tests/sql/ip-pool-db/evaltest.dat +++ b/testing/tests/sql/ip-pool-db/evaltest.dat @@ -7,7 +7,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES @@ -18,7 +18,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/sql/ip-pool-db/posttest.dat b/testing/tests/sql/ip-pool-db/posttest.dat index 40b1a403e..1b963fcec 100644 --- a/testing/tests/sql/ip-pool-db/posttest.dat +++ b/testing/tests/sql/ip-pool-db/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/ip-pool-db/pretest.dat b/testing/tests/sql/ip-pool-db/pretest.dat index a5d786b3f..819aca3d9 100644 --- a/testing/tests/sql/ip-pool-db/pretest.dat +++ b/testing/tests/sql/ip-pool-db/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/ip-pool-db/test.conf b/testing/tests/sql/ip-pool-db/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-pool-db/test.conf +++ b/testing/tests/sql/ip-pool-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-split-pools-db-restart/test.conf b/testing/tests/sql/ip-split-pools-db-restart/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-split-pools-db-restart/test.conf +++ b/testing/tests/sql/ip-split-pools-db-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-split-pools-db/test.conf b/testing/tests/sql/ip-split-pools-db/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-split-pools-db/test.conf +++ b/testing/tests/sql/ip-split-pools-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/multi-level-ca/evaltest.dat b/testing/tests/sql/multi-level-ca/evaltest.dat index dfdd36a51..72a555d4b 100644 --- a/testing/tests/sql/multi-level-ca/evaltest.dat +++ b/testing/tests/sql/multi-level-ca/evaltest.dat @@ -14,8 +14,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/multi-level-ca/posttest.dat b/testing/tests/sql/multi-level-ca/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/multi-level-ca/posttest.dat +++ b/testing/tests/sql/multi-level-ca/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/multi-level-ca/pretest.dat b/testing/tests/sql/multi-level-ca/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/multi-level-ca/pretest.dat +++ b/testing/tests/sql/multi-level-ca/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/multi-level-ca/test.conf b/testing/tests/sql/multi-level-ca/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/multi-level-ca/test.conf +++ b/testing/tests/sql/multi-level-ca/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/net2net-cert/evaltest.dat b/testing/tests/sql/net2net-cert/evaltest.dat index dbd06104f..f003f822f 100644 --- a/testing/tests/sql/net2net-cert/evaltest.dat +++ b/testing/tests/sql/net2net-cert/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-cert/posttest.dat b/testing/tests/sql/net2net-cert/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-cert/posttest.dat +++ b/testing/tests/sql/net2net-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-cert/pretest.dat b/testing/tests/sql/net2net-cert/pretest.dat index 2ab18542f..a1777efb0 100644 --- a/testing/tests/sql/net2net-cert/pretest.dat +++ b/testing/tests/sql/net2net-cert/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/net2net-cert/test.conf b/testing/tests/sql/net2net-cert/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/sql/net2net-cert/test.conf +++ b/testing/tests/sql/net2net-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/net2net-psk/evaltest.dat b/testing/tests/sql/net2net-psk/evaltest.dat index dbd06104f..f003f822f 100644 --- a/testing/tests/sql/net2net-psk/evaltest.dat +++ b/testing/tests/sql/net2net-psk/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-psk/posttest.dat b/testing/tests/sql/net2net-psk/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-psk/posttest.dat +++ b/testing/tests/sql/net2net-psk/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-psk/pretest.dat b/testing/tests/sql/net2net-psk/pretest.dat index 2ab18542f..a1777efb0 100644 --- a/testing/tests/sql/net2net-psk/pretest.dat +++ b/testing/tests/sql/net2net-psk/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/net2net-psk/test.conf b/testing/tests/sql/net2net-psk/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/sql/net2net-psk/test.conf +++ b/testing/tests/sql/net2net-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/net2net-route-pem/evaltest.dat b/testing/tests/sql/net2net-route-pem/evaltest.dat index 719ba09ff..3fd32907c 100644 --- a/testing/tests/sql/net2net-route-pem/evaltest.dat +++ b/testing/tests/sql/net2net-route-pem/evaltest.dat @@ -10,7 +10,7 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-route-pem/posttest.dat b/testing/tests/sql/net2net-route-pem/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-route-pem/posttest.dat +++ b/testing/tests/sql/net2net-route-pem/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-route-pem/pretest.dat b/testing/tests/sql/net2net-route-pem/pretest.dat index 5a537e15b..8ca573ee5 100644 --- a/testing/tests/sql/net2net-route-pem/pretest.dat +++ b/testing/tests/sql/net2net-route-pem/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ipsec start moon::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/net2net-route-pem/test.conf b/testing/tests/sql/net2net-route-pem/test.conf index 13a8a2a48..10c582c9b 100644 --- a/testing/tests/sql/net2net-route-pem/test.conf +++ b/testing/tests/sql/net2net-route-pem/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/net2net-start-pem/evaltest.dat b/testing/tests/sql/net2net-start-pem/evaltest.dat index e6b8890f9..6534adc07 100644 --- a/testing/tests/sql/net2net-start-pem/evaltest.dat +++ b/testing/tests/sql/net2net-start-pem/evaltest.dat @@ -6,7 +6,7 @@ moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-start-pem/posttest.dat b/testing/tests/sql/net2net-start-pem/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-start-pem/posttest.dat +++ b/testing/tests/sql/net2net-start-pem/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-start-pem/pretest.dat b/testing/tests/sql/net2net-start-pem/pretest.dat index c09d50f08..1c71f0c14 100644 --- a/testing/tests/sql/net2net-start-pem/pretest.dat +++ b/testing/tests/sql/net2net-start-pem/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ipsec start moon::ipsec start moon::sleep 3 diff --git a/testing/tests/sql/net2net-start-pem/test.conf b/testing/tests/sql/net2net-start-pem/test.conf index 13a8a2a48..10c582c9b 100644 --- a/testing/tests/sql/net2net-start-pem/test.conf +++ b/testing/tests/sql/net2net-start-pem/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/rw-cert/evaltest.dat b/testing/tests/sql/rw-cert/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/sql/rw-cert/evaltest.dat +++ b/testing/tests/sql/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-cert/posttest.dat b/testing/tests/sql/rw-cert/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/rw-cert/posttest.dat +++ b/testing/tests/sql/rw-cert/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/rw-cert/pretest.dat b/testing/tests/sql/rw-cert/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-cert/pretest.dat +++ b/testing/tests/sql/rw-cert/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-cert/test.conf b/testing/tests/sql/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-cert/test.conf +++ b/testing/tests/sql/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat b/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat index 65a7c8e09..e1d33feb7 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat +++ b/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat @@ -5,7 +5,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw-eap-aka.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-eap-aka.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-eap-aka-rsa/posttest.dat b/testing/tests/sql/rw-eap-aka-rsa/posttest.dat index 23eeb0d17..584356d8e 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/posttest.dat +++ b/testing/tests/sql/rw-eap-aka-rsa/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* ~ diff --git a/testing/tests/sql/rw-eap-aka-rsa/pretest.dat b/testing/tests/sql/rw-eap-aka-rsa/pretest.dat index b78fd480f..8f2387ba1 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/pretest.dat +++ b/testing/tests/sql/rw-eap-aka-rsa/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql carol::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/sql/rw-eap-aka-rsa/test.conf b/testing/tests/sql/rw-eap-aka-rsa/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/test.conf +++ b/testing/tests/sql/rw-eap-aka-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/sql/rw-psk-ipv4/evaltest.dat b/testing/tests/sql/rw-psk-ipv4/evaltest.dat index 1ad36fcaf..eaf47395e 100644 --- a/testing/tests/sql/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/sql/rw-psk-ipv4/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-psk-ipv4/posttest.dat b/testing/tests/sql/rw-psk-ipv4/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/rw-psk-ipv4/posttest.dat +++ b/testing/tests/sql/rw-psk-ipv4/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/rw-psk-ipv4/pretest.dat b/testing/tests/sql/rw-psk-ipv4/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-psk-ipv4/pretest.dat +++ b/testing/tests/sql/rw-psk-ipv4/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-psk-ipv4/test.conf b/testing/tests/sql/rw-psk-ipv4/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-psk-ipv4/test.conf +++ b/testing/tests/sql/rw-psk-ipv4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 25074a0f1..000000000 --- a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,107 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow last UDP fragment - ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..7362b2e25 --- /dev/null +++ b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules @@ -0,0 +1,16 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 25074a0f1..000000000 --- a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,107 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow last UDP fragment - ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules new file mode 100644 index 000000000..7362b2e25 --- /dev/null +++ b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules @@ -0,0 +1,16 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 25074a0f1..000000000 --- a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,107 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow last UDP fragment - ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..7362b2e25 --- /dev/null +++ b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules @@ -0,0 +1,16 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/rw-psk-ipv6/posttest.dat b/testing/tests/sql/rw-psk-ipv6/posttest.dat index bdfd9ed00..ab753507f 100644 --- a/testing/tests/sql/rw-psk-ipv6/posttest.dat +++ b/testing/tests/sql/rw-psk-ipv6/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/sql/rw-psk-ipv6/pretest.dat b/testing/tests/sql/rw-psk-ipv6/pretest.dat index 253438dbf..587dd7f85 100644 --- a/testing/tests/sql/rw-psk-ipv6/pretest.dat +++ b/testing/tests/sql/rw-psk-ipv6/pretest.dat @@ -7,9 +7,12 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/sql/rw-psk-ipv6/test.conf b/testing/tests/sql/rw-psk-ipv6/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/sql/rw-psk-ipv6/test.conf +++ b/testing/tests/sql/rw-psk-ipv6/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-psk-rsa-split/evaltest.dat b/testing/tests/sql/rw-psk-rsa-split/evaltest.dat index 9a1ab3f8f..1648c9557 100644 --- a/testing/tests/sql/rw-psk-rsa-split/evaltest.dat +++ b/testing/tests/sql/rw-psk-rsa-split/evaltest.dat @@ -9,8 +9,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-psk-rsa-split/posttest.dat b/testing/tests/sql/rw-psk-rsa-split/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/rw-psk-rsa-split/posttest.dat +++ b/testing/tests/sql/rw-psk-rsa-split/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/rw-psk-rsa-split/pretest.dat b/testing/tests/sql/rw-psk-rsa-split/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-psk-rsa-split/pretest.dat +++ b/testing/tests/sql/rw-psk-rsa-split/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-psk-rsa-split/test.conf b/testing/tests/sql/rw-psk-rsa-split/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-psk-rsa-split/test.conf +++ b/testing/tests/sql/rw-psk-rsa-split/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-rsa-keyid/evaltest.dat b/testing/tests/sql/rw-rsa-keyid/evaltest.dat index 26f82653a..4f5cd724c 100644 --- a/testing/tests/sql/rw-rsa-keyid/evaltest.dat +++ b/testing/tests/sql/rw-rsa-keyid/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-rsa-keyid/posttest.dat b/testing/tests/sql/rw-rsa-keyid/posttest.dat index b10aeb3aa..892650ccb 100644 --- a/testing/tests/sql/rw-rsa-keyid/posttest.dat +++ b/testing/tests/sql/rw-rsa-keyid/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.db carol::rm /etc/ipsec.d/ipsec.db dave::rm /etc/ipsec.d/ipsec.db diff --git a/testing/tests/sql/rw-rsa-keyid/pretest.dat b/testing/tests/sql/rw-rsa-keyid/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-rsa-keyid/pretest.dat +++ b/testing/tests/sql/rw-rsa-keyid/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-rsa-keyid/test.conf b/testing/tests/sql/rw-rsa-keyid/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-rsa-keyid/test.conf +++ b/testing/tests/sql/rw-rsa-keyid/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-rsa/evaltest.dat b/testing/tests/sql/rw-rsa/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/sql/rw-rsa/evaltest.dat +++ b/testing/tests/sql/rw-rsa/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-rsa/posttest.dat b/testing/tests/sql/rw-rsa/posttest.dat index b10aeb3aa..892650ccb 100644 --- a/testing/tests/sql/rw-rsa/posttest.dat +++ b/testing/tests/sql/rw-rsa/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.db carol::rm /etc/ipsec.d/ipsec.db dave::rm /etc/ipsec.d/ipsec.db diff --git a/testing/tests/sql/rw-rsa/pretest.dat b/testing/tests/sql/rw-rsa/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-rsa/pretest.dat +++ b/testing/tests/sql/rw-rsa/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-rsa/test.conf b/testing/tests/sql/rw-rsa/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-rsa/test.conf +++ b/testing/tests/sql/rw-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/shunt-policies/evaltest.dat b/testing/tests/sql/shunt-policies/evaltest.dat index 70aea411e..51dd9610b 100644 --- a/testing/tests/sql/shunt-policies/evaltest.dat +++ b/testing/tests/sql/shunt-policies/evaltest.dat @@ -4,16 +4,16 @@ moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::local-net.*PASS::YES moon:: ipsec status 2> /dev/null::venus-icmp.*DROP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO +venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES venus::ssh PH_IP_BOB hostname::bob::YES diff --git a/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 2b90a14c7..000000000 --- a/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow icmp in local net - iptables -A INPUT -i eth1 -p icmp -j ACCEPT - iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..af0f25209 --- /dev/null +++ b/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow icmp in local net +-A INPUT -i eth1 -p icmp -j ACCEPT +-A OUTPUT -o eth1 -p icmp -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/shunt-policies/posttest.dat b/testing/tests/sql/shunt-policies/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/shunt-policies/posttest.dat +++ b/testing/tests/sql/shunt-policies/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/shunt-policies/pretest.dat b/testing/tests/sql/shunt-policies/pretest.dat index 2ab18542f..a1777efb0 100644 --- a/testing/tests/sql/shunt-policies/pretest.dat +++ b/testing/tests/sql/shunt-policies/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/shunt-policies/test.conf b/testing/tests/sql/shunt-policies/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/sql/shunt-policies/test.conf +++ b/testing/tests/sql/shunt-policies/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/tnc/tnccs-11-fhh/evaltest.dat b/testing/tests/tnc/tnccs-11-fhh/evaltest.dat index b6663ea5e..6b7c713ef 100644 --- a/testing/tests/tnc/tnccs-11-fhh/evaltest.dat +++ b/testing/tests/tnc/tnccs-11-fhh/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11-fhh/posttest.dat b/testing/tests/tnc/tnccs-11-fhh/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-11-fhh/posttest.dat +++ b/testing/tests/tnc/tnccs-11-fhh/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-11-fhh/pretest.dat b/testing/tests/tnc/tnccs-11-fhh/pretest.dat index c7a30ee7c..997c70a8e 100644 --- a/testing/tests/tnc/tnccs-11-fhh/pretest.dat +++ b/testing/tests/tnc/tnccs-11-fhh/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-11-fhh/test.conf b/testing/tests/tnc/tnccs-11-fhh/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-11-fhh/test.conf +++ b/testing/tests/tnc/tnccs-11-fhh/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat b/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat index b875eed49..d93407434 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat +++ b/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat @@ -9,6 +9,6 @@ dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/3 moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer dave@strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/eap.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf index 31556361e..31556361e 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/proxy.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default new file mode 100644 index 000000000..dd0825858 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default @@ -0,0 +1,43 @@ +authorize { + suffix + eap { + ok = return + } + files +} + +authenticate { + eap +} + +preacct { + preprocess + acct_unique + suffix + files +} + +accounting { + detail + unix + radutmp + attr_filter.accounting_response +} + +session { + radutmp +} + +post-auth { + exec + Post-Auth-Type REJECT { + attr_filter.access_reject + } +} + +pre-proxy { +} + +post-proxy { + eap +} diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel-second b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second index 2d4961288..2d4961288 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel-second +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/users b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/users +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary deleted file mode 100644 index 1a27a02fc..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary +++ /dev/null @@ -1,2 +0,0 @@ -$INCLUDE /usr/share/freeradius/dictionary -$INCLUDE /etc/raddb/dictionary.tnc diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc deleted file mode 100644 index f295467a9..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc +++ /dev/null @@ -1,5 +0,0 @@ -ATTRIBUTE TNC-Status 3001 integer - -VALUE TNC-Status Access 0 -VALUE TNC-Status Isolate 1 -VALUE TNC-Status None 2 diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default deleted file mode 100644 index 802fcfd8d..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default +++ /dev/null @@ -1,44 +0,0 @@ -authorize { - suffix - eap { - ok = return - } - files -} - -authenticate { - eap -} - -preacct { - preprocess - acct_unique - suffix - files -} - -accounting { - detail - unix - radutmp - attr_filter.accounting_response -} - -session { - radutmp -} - -post-auth { - exec - Post-Auth-Type REJECT { - attr_filter.access_reject - } -} - -pre-proxy { -} - -post-proxy { - eap -} - diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/tnc/tnccs-11-radius-block/posttest.dat b/testing/tests/tnc/tnccs-11-radius-block/posttest.dat index 51d8ca1b3..5e5a8514d 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/posttest.dat +++ b/testing/tests/tnc/tnccs-11-radius-block/posttest.dat @@ -2,8 +2,8 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop alice::killall radiusd -alice::rm /etc/raddb/sites-enabled/inner-tunnel-second -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush dave::/etc/init.d/apache2 stop 2> /dev/null diff --git a/testing/tests/tnc/tnccs-11-radius-block/pretest.dat b/testing/tests/tnc/tnccs-11-radius-block/pretest.dat index 0fa88dbc7..c8f2139a8 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/pretest.dat +++ b/testing/tests/tnc/tnccs-11-radius-block/pretest.dat @@ -1,9 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules dave::/etc/init.d/apache2 start 2> /dev/null -alice::ln -s /etc/raddb/sites-available/inner-tunnel-second /etc/raddb/sites-enabled/inner-tunnel-second -alice::cat /etc/raddb/sites-enabled/inner-tunnel-second +alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second +alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd moon::ipsec start carol::LEAK_DETECTIVE_DISABLE=1 ipsec start diff --git a/testing/tests/tnc/tnccs-11-radius-block/test.conf b/testing/tests/tnc/tnccs-11-radius-block/test.conf index bb6b68687..29bfaa78c 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/test.conf +++ b/testing/tests/tnc/tnccs-11-radius-block/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/tnc/tnccs-11-radius/evaltest.dat b/testing/tests/tnc/tnccs-11-radius/evaltest.dat index d72239e8e..e22b767f7 100644 --- a/testing/tests/tnc/tnccs-11-radius/evaltest.dat +++ b/testing/tests/tnc/tnccs-11-radius/evaltest.dat @@ -1,10 +1,10 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate':: moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf index 31556361e..31556361e 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default new file mode 100644 index 000000000..dd0825858 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default @@ -0,0 +1,43 @@ +authorize { + suffix + eap { + ok = return + } + files +} + +authenticate { + eap +} + +preacct { + preprocess + acct_unique + suffix + files +} + +accounting { + detail + unix + radutmp + attr_filter.accounting_response +} + +session { + radutmp +} + +post-auth { + exec + Post-Auth-Type REJECT { + attr_filter.access_reject + } +} + +pre-proxy { +} + +post-proxy { + eap +} diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second index f91bccc72..c5bde6a9e 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second @@ -17,14 +17,14 @@ session { post-auth { if (control:TNC-Status == "Access") { update reply { - Tunnel-Type := ESP + Tunnel-Type := ESP Filter-Id := "allow" } } elsif (control:TNC-Status == "Isolate") { update reply { - Tunnel-Type := ESP - Filter-Id := "isolate" + Tunnel-Type := ESP + Filter-Id := "isolate" } } diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/users b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary deleted file mode 100644 index 1a27a02fc..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary +++ /dev/null @@ -1,2 +0,0 @@ -$INCLUDE /usr/share/freeradius/dictionary -$INCLUDE /etc/raddb/dictionary.tnc diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc deleted file mode 100644 index f295467a9..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc +++ /dev/null @@ -1,5 +0,0 @@ -ATTRIBUTE TNC-Status 3001 integer - -VALUE TNC-Status Access 0 -VALUE TNC-Status Isolate 1 -VALUE TNC-Status None 2 diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default deleted file mode 100644 index 802fcfd8d..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default +++ /dev/null @@ -1,44 +0,0 @@ -authorize { - suffix - eap { - ok = return - } - files -} - -authenticate { - eap -} - -preacct { - preprocess - acct_unique - suffix - files -} - -accounting { - detail - unix - radutmp - attr_filter.accounting_response -} - -session { - radutmp -} - -post-auth { - exec - Post-Auth-Type REJECT { - attr_filter.access_reject - } -} - -pre-proxy { -} - -post-proxy { - eap -} - diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/tnc/tnccs-11-radius/posttest.dat b/testing/tests/tnc/tnccs-11-radius/posttest.dat index 86bd89dea..a64a9147c 100644 --- a/testing/tests/tnc/tnccs-11-radius/posttest.dat +++ b/testing/tests/tnc/tnccs-11-radius/posttest.dat @@ -2,7 +2,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop alice::killall radiusd -alice::rm /etc/raddb/sites-enabled/inner-tunnel-second -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-11-radius/pretest.dat b/testing/tests/tnc/tnccs-11-radius/pretest.dat index b5d284278..8f79c776a 100644 --- a/testing/tests/tnc/tnccs-11-radius/pretest.dat +++ b/testing/tests/tnc/tnccs-11-radius/pretest.dat @@ -1,8 +1,8 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::ln -s /etc/raddb/sites-available/inner-tunnel-second /etc/raddb/sites-enabled/inner-tunnel-second -alice::cat /etc/raddb/sites-enabled/inner-tunnel-second +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second +alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd alice::cat /etc/tnc_config carol::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-11-radius/test.conf b/testing/tests/tnc/tnccs-11-radius/test.conf index 2a52df203..f23a19329 100644 --- a/testing/tests/tnc/tnccs-11-radius/test.conf +++ b/testing/tests/tnc/tnccs-11-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/tnc/tnccs-11/evaltest.dat b/testing/tests/tnc/tnccs-11/evaltest.dat index b6663ea5e..6b7c713ef 100644 --- a/testing/tests/tnc/tnccs-11/evaltest.dat +++ b/testing/tests/tnc/tnccs-11/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11/posttest.dat b/testing/tests/tnc/tnccs-11/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-11/posttest.dat +++ b/testing/tests/tnc/tnccs-11/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-11/pretest.dat b/testing/tests/tnc/tnccs-11/pretest.dat index dd729cb0b..7bfcf0d07 100644 --- a/testing/tests/tnc/tnccs-11/pretest.dat +++ b/testing/tests/tnc/tnccs-11/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-11/test.conf b/testing/tests/tnc/tnccs-11/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-11/test.conf +++ b/testing/tests/tnc/tnccs-11/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-block/evaltest.dat b/testing/tests/tnc/tnccs-20-block/evaltest.dat index 881f442b7..03b576efa 100644 --- a/testing/tests/tnc/tnccs-20-block/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-block/evaltest.dat @@ -8,5 +8,5 @@ dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/3 moon:: cat /var/log/daemon.log::added group membership 'allow'::YES moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer dave@strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-block/posttest.dat b/testing/tests/tnc/tnccs-20-block/posttest.dat index 50bb7e117..2258e03ff 100644 --- a/testing/tests/tnc/tnccs-20-block/posttest.dat +++ b/testing/tests/tnc/tnccs-20-block/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush dave::/etc/init.d/apache2 stop 2> /dev/null diff --git a/testing/tests/tnc/tnccs-20-block/pretest.dat b/testing/tests/tnc/tnccs-20-block/pretest.dat index 7b0a42fcd..f5b3b2e8c 100644 --- a/testing/tests/tnc/tnccs-20-block/pretest.dat +++ b/testing/tests/tnc/tnccs-20-block/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules dave::/etc/init.d/apache2 start 2> /dev/null moon::cat /etc/tnc_config carol::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-block/test.conf b/testing/tests/tnc/tnccs-20-block/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-block/test.conf +++ b/testing/tests/tnc/tnccs-20-block/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat b/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-client-retry/posttest.dat b/testing/tests/tnc/tnccs-20-client-retry/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/posttest.dat +++ b/testing/tests/tnc/tnccs-20-client-retry/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-client-retry/pretest.dat b/testing/tests/tnc/tnccs-20-client-retry/pretest.dat index 208f9daa9..b2b243ba3 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/pretest.dat +++ b/testing/tests/tnc/tnccs-20-client-retry/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-client-retry/test.conf b/testing/tests/tnc/tnccs-20-client-retry/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/test.conf +++ b/testing/tests/tnc/tnccs-20-client-retry/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-fhh/evaltest.dat b/testing/tests/tnc/tnccs-20-fhh/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-fhh/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-fhh/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-fhh/posttest.dat b/testing/tests/tnc/tnccs-20-fhh/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-fhh/posttest.dat +++ b/testing/tests/tnc/tnccs-20-fhh/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-fhh/pretest.dat b/testing/tests/tnc/tnccs-20-fhh/pretest.dat index 76ad91f98..72c9b1665 100644 --- a/testing/tests/tnc/tnccs-20-fhh/pretest.dat +++ b/testing/tests/tnc/tnccs-20-fhh/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-fhh/test.conf b/testing/tests/tnc/tnccs-20-fhh/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-fhh/test.conf +++ b/testing/tests/tnc/tnccs-20-fhh/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-os/description.txt b/testing/tests/tnc/tnccs-20-os/description.txt new file mode 100644 index 000000000..b5d12fc8c --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/description.txt @@ -0,0 +1,23 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b> +using EAP-TTLS authentication only with the gateway presenting a server certificate and +the clients doing EAP-MD5 password-based authentication. +In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the +state of <b>carol</b>'s and <b>dave</b>'s operating system via the <b>TNCCS 2.0 </b> +client-server interface compliant with <b>RFC 5793 PB-TNC</b>. The OS IMC and OS IMV pair +is using the <b>IF-M 1.0</b> measurement protocol defined by <b>RFC 5792 PA-TNC</b> to +exchange PA-TNC attributes. +<p> +<b>carol</b> sends information on her operating system consisting of the PA-TNC attributes +<em>Product Information</em>, <em>String Version</em>, <em>Numeric Version</em>, +<em>Operational Status</em>, <em>Forwarding Enabled</em>, and +<em>Factory Default Password Enabled</em> up-front, whereas <b>dave</b> must be prompted +by the IMV to do so via an <em>Attribute Request</em> PA-TNC attribute. <b>carol</b> is +then prompted to send a list of installed packages using the <em>Installed Packages</em> +PA-TNC attribute whereas <b>dave</b>'s "Windows 1.2.3" operating system is not supported +and thus <b>dave</b> receives a <em>Remediation Instructions</em> PA-TNC attribute. +<p> +<b>carol</b> passes the health test and <b>dave</b> fails. Based on these assessments +which are communicated to the IMCs using the <em>Assessment Result</em> PA-TNC attribute, +the clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" +subnets, respectively. +</p> diff --git a/testing/tests/tnc/tnccs-20-os/evaltest.dat b/testing/tests/tnc/tnccs-20-os/evaltest.dat new file mode 100644 index 000000000..3c13e5ffa --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/evaltest.dat @@ -0,0 +1,19 @@ +carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES +carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES +carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES +dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES +dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES +dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES +moon:: cat /var/log/daemon.log::added group membership 'allow'::YES +moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES +moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES +moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES +moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES +moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO + diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.conf b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..e2bf349d9 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + charondebug="tnc 3, imc 3" + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftid=carol@strongswan.org + leftauth=eap + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightauth=any + rightsendcert=never + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.secrets b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..74942afda --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : EAP "Ar3etTnp" diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..34941e52c --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/strongswan.conf @@ -0,0 +1,19 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown + multiple_authentication=no + plugins { + eap-tnc { + protocol = tnccs-2.0 + } + } +} + +libimcv { + plugins { + imc-os { + push_info = yes + } + } +} diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/tnc_config b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/tnc_config new file mode 100644 index 000000000..25c28442f --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/tnc_config @@ -0,0 +1,3 @@ +#IMC configuration file for strongSwan client + +IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.conf b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.conf new file mode 100644 index 000000000..77446cbae --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + charondebug="tnc 3, imc 3" + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_DAVE + leftid=dave@strongswan.org + leftauth=eap + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightauth=any + rightsendcert=never + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.secrets b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..5496df7ad --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave@strongswan.org : EAP "W7R0g3do" diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/strongswan.conf new file mode 100644 index 000000000..149f51d65 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/strongswan.conf @@ -0,0 +1,26 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown + multiple_authentication=no + plugins { + eap-tnc { + protocol = tnccs-2.0 + } + tnc-imc { + preferred_language = de + } + } +} + +libimcv { + os_info { + name = Windows + version = 1.2.3 + } + plugins { + imc-os { + push_info = no + } + } +} diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/tnc_config b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/tnc_config new file mode 100644 index 000000000..25c28442f --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/tnc_config @@ -0,0 +1,3 @@ +#IMC configuration file for strongSwan client + +IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.conf b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.conf new file mode 100644 index 000000000..e21ef0d14 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.conf @@ -0,0 +1,34 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + charondebug="tnc 3, imv 3" + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw-allow + rightgroups=allow + leftsubnet=10.1.0.0/28 + also=rw-eap + auto=add + +conn rw-isolate + rightgroups=isolate + leftsubnet=10.1.0.16/28 + also=rw-eap + auto=add + +conn rw-eap + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftauth=eap-ttls + leftfirewall=yes + rightauth=eap-ttls + rightid=*@strongswan.org + rightsendcert=never + right=%any diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.secrets b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..2e277ccb0 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,6 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey.pem + +carol@strongswan.org : EAP "Ar3etTnp" +dave@strongswan.org : EAP "W7R0g3do" diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..b11617cb2 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf @@ -0,0 +1,24 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown + multiple_authentication=no + plugins { + eap-ttls { + phase2_method = md5 + phase2_piggyback = yes + phase2_tnc = yes + } + eap-tnc { + protocol = tnccs-2.0 + } + } +} + +libimcv { + plugins { + imv-os { + request_installed_packages = yes + } + } +} diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/tnc_config b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/tnc_config new file mode 100644 index 000000000..b75a9cb1e --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/tnc_config @@ -0,0 +1,3 @@ +#IMV configuration file for strongSwan client + +IMV "OS" /usr/local/lib/ipsec/imcvs/imv-os.so diff --git a/testing/tests/tnc/tnccs-20-os/posttest.dat b/testing/tests/tnc/tnccs-20-os/posttest.dat new file mode 100644 index 000000000..74b902c69 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/posttest.dat @@ -0,0 +1,7 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +carol::echo 1 > /proc/sys/net/ipv4/ip_forward diff --git a/testing/tests/tnc/tnccs-20-os/pretest.dat b/testing/tests/tnc/tnccs-20-os/pretest.dat new file mode 100644 index 000000000..8169afab2 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/pretest.dat @@ -0,0 +1,14 @@ +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +carol::echo 0 > /proc/sys/net/ipv4/ip_forward +moon::cat /etc/tnc_config +carol::cat /etc/tnc_config +dave::cat /etc/tnc_config +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home +dave::sleep 1 diff --git a/testing/tests/tnc/tnccs-20-os/test.conf b/testing/tests/tnc/tnccs-20-os/test.conf new file mode 100644 index 000000000..a8a05af19 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-os/test.conf @@ -0,0 +1,26 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" + +# Guest instances on which FreeRadius is started +# +RADIUSHOSTS= + diff --git a/testing/tests/tnc/tnccs-20-pdp/evaltest.dat b/testing/tests/tnc/tnccs-20-pdp/evaltest.dat index 83739b70a..e969774c5 100644 --- a/testing/tests/tnc/tnccs-20-pdp/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-pdp/evaltest.dat @@ -1,10 +1,10 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES carol::cat /var/log/daemon.log::PB-TNC access recommendation is .*Access Allowed::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is .*Quarantined::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES @@ -12,7 +12,7 @@ moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate':: moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2>/dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2>/dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/tnc/tnccs-20-pdp/posttest.dat b/testing/tests/tnc/tnccs-20-pdp/posttest.dat index 16218f385..e7eecd5f4 100644 --- a/testing/tests/tnc/tnccs-20-pdp/posttest.dat +++ b/testing/tests/tnc/tnccs-20-pdp/posttest.dat @@ -2,6 +2,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop alice::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-pdp/pretest.dat b/testing/tests/tnc/tnccs-20-pdp/pretest.dat index 9b9d6b699..32ed4d854 100644 --- a/testing/tests/tnc/tnccs-20-pdp/pretest.dat +++ b/testing/tests/tnc/tnccs-20-pdp/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules alice::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-pdp/test.conf b/testing/tests/tnc/tnccs-20-pdp/test.conf index 400628531..c4ca1a19f 100644 --- a/testing/tests/tnc/tnccs-20-pdp/test.conf +++ b/testing/tests/tnc/tnccs-20-pdp/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave alice" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat b/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-server-retry/posttest.dat b/testing/tests/tnc/tnccs-20-server-retry/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/posttest.dat +++ b/testing/tests/tnc/tnccs-20-server-retry/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-server-retry/pretest.dat b/testing/tests/tnc/tnccs-20-server-retry/pretest.dat index 208f9daa9..b2b243ba3 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/pretest.dat +++ b/testing/tests/tnc/tnccs-20-server-retry/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-server-retry/test.conf b/testing/tests/tnc/tnccs-20-server-retry/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/test.conf +++ b/testing/tests/tnc/tnccs-20-server-retry/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-tls/evaltest.dat b/testing/tests/tnc/tnccs-20-tls/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-tls/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-tls/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-tls/posttest.dat b/testing/tests/tnc/tnccs-20-tls/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-tls/posttest.dat +++ b/testing/tests/tnc/tnccs-20-tls/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-tls/pretest.dat b/testing/tests/tnc/tnccs-20-tls/pretest.dat index c332f131b..cac1cfafc 100644 --- a/testing/tests/tnc/tnccs-20-tls/pretest.dat +++ b/testing/tests/tnc/tnccs-20-tls/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-tls/test.conf b/testing/tests/tnc/tnccs-20-tls/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-tls/test.conf +++ b/testing/tests/tnc/tnccs-20-tls/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20/evaltest.dat b/testing/tests/tnc/tnccs-20/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20/evaltest.dat +++ b/testing/tests/tnc/tnccs-20/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf b/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf index a483d6df8..e2bf349d9 100644 --- a/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf +++ b/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf @@ -1,7 +1,7 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - charondebug="tnc 3, imc 2" + charondebug="tnc 3, imc 3" conn %default ikelifetime=60m diff --git a/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf b/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf index 11378131a..77446cbae 100644 --- a/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf +++ b/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf @@ -1,7 +1,7 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - charondebug="tnc 3, imc 2" + charondebug="tnc 3, imc 3" conn %default ikelifetime=60m diff --git a/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf b/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf index b1093d46d..e21ef0d14 100644 --- a/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf +++ b/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf @@ -1,7 +1,7 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - charondebug="tnc 3, imv 2" + charondebug="tnc 3, imv 3" conn %default ikelifetime=60m diff --git a/testing/tests/tnc/tnccs-20/posttest.dat b/testing/tests/tnc/tnccs-20/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20/posttest.dat +++ b/testing/tests/tnc/tnccs-20/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20/pretest.dat b/testing/tests/tnc/tnccs-20/pretest.dat index 208f9daa9..b2b243ba3 100644 --- a/testing/tests/tnc/tnccs-20/pretest.dat +++ b/testing/tests/tnc/tnccs-20/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20/test.conf b/testing/tests/tnc/tnccs-20/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20/test.conf +++ b/testing/tests/tnc/tnccs-20/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-dynamic/evaltest.dat b/testing/tests/tnc/tnccs-dynamic/evaltest.dat index 69baaf592..405298381 100644 --- a/testing/tests/tnc/tnccs-dynamic/evaltest.dat +++ b/testing/tests/tnc/tnccs-dynamic/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::TNCCS 1.1 protocol detected dynamically::YES @@ -20,8 +20,8 @@ moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP moon:: cat /var/log/daemon.log::removed TNCCS Connection ID 2::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-dynamic/posttest.dat b/testing/tests/tnc/tnccs-dynamic/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-dynamic/posttest.dat +++ b/testing/tests/tnc/tnccs-dynamic/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-dynamic/pretest.dat b/testing/tests/tnc/tnccs-dynamic/pretest.dat index a7a3bf412..60775a11e 100644 --- a/testing/tests/tnc/tnccs-dynamic/pretest.dat +++ b/testing/tests/tnc/tnccs-dynamic/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-dynamic/test.conf b/testing/tests/tnc/tnccs-dynamic/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-dynamic/test.conf +++ b/testing/tests/tnc/tnccs-dynamic/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= |