diff options
1400 files changed, 18258 insertions, 41153 deletions
@@ -46,6 +46,9 @@ strongswan-5.0.2 - The new rdrand plugin provides a high quality / high performance random source using the Intel rdrand instruction found on Ivy Bridge processors. +- The integration test environment was updated and now uses KVM and reproducible + guest images based on Debian. + strongswan-5.0.1 ---------------- @@ -422,7 +425,7 @@ strongswan-4.5.1 ./configure switch. - The new libstrongswan constraints plugin provides advanced X.509 constraint - checking. In addition to X.509 pathLen constraints, the plugin checks for + checking. In additon to X.509 pathLen constraints, the plugin checks for nameConstraints and certificatePolicies, including policyMappings and policyConstraints. The x509 certificate plugin and the pki tool have been enhanced to support these extensions. The new left/rightcertpolicy ipsec.conf diff --git a/testing/INSTALL b/testing/INSTALL deleted file mode 100644 index bb4272eaf..000000000 --- a/testing/INSTALL +++ /dev/null @@ -1,145 +0,0 @@ - - ------------------------------- - strongSwan UML - Installation - ------------------------------- - - -Contents --------- - - 1. Making the host system UML-capable - 2. Installing the required files - 3. Creating the UML testing environment - - -1. Making the host system UML-capable - ---------------------------------- - - UML instances can be run on both Linux 2.4 and Linux 2.6 kernels. - If you are using a vanilla kernel from kernel.org then you must first - apply the host SKAS patch available from - - http://www.user-mode-linux.org/~blaisorblade/patches/ - - and recompile and reboot your host kernel. Some Linux distributions as e.g. - SuSE already include the SKAS patch in their kernels. - - You will also need the UML utilities (uml_mconsole and uml_switch) - available from - - http://prdownloads.sourceforge.net/user-mode-linux/uml_utilities_20040406.tar.bz2 - - Many Linux distributions offer the UML utilities as a package. - - -2. Installing the required files - ----------------------------- - -First create a directory where you want the strongSwan UML testing environment -to be located.The default directory is "~/strongswan-testing". If you choose a -different location, please adapt the UMLTESTDIR variable in "testing.conf" -accordingly. - - mkdir ~/strongswan-testing - -Now copy the "testing" subdirectory coming with the strongSwan distribution to -the UML testing environment: - - cp -r testing ~/strongswan-testing - -Next you need to copy several files into the ~/strongswan-testing directory that -are required for the strongSwan testing environment: - - * A vanilla Linux kernel on which the UML kernel will be based on. - We recommend the use of - - http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.36.tar.bz2 - - * The Linux kernel 2.6.36 does not require any patches for the uml guest kernel - to successfully start up. - - * The matching .config file required to compile the UML kernel: - - http://download.strongswan.org/uml/.config-2.6.36 - - * A gentoo-based UML file system (compressed size 130 MBytes) found at - - http://download.strongswan.org/uml/gentoo-fs-20100830.tar.bz2 - - * The latest strongSwan distribution - - http://download.strongswan.org/strongswan-4.5.1.tar.bz2 - - -3. Creating the environment - ------------------------ - -Now change into the testing subdirectory - - cd ~/strongswan-testing/testing - -and make the UML testing environment: - - ./make-testing <hosts> - -The "make-testing" script calls a series of subscripts which can be -enabled or disabled individually by setting the corresponding flags -in "testing.conf": - - if [ $ENABLE_BUILD_UMLKERNEL = "yes" ] - then - scripts/build-umlkernel - fi - -builds an UML kernel out of the vanilla Linux kernel and the corresponding -UML kernel patch. - - if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ] - then - scripts/build-hostconfig - fi - -generates the default configurations for the UML hosts alice, venus, moon, -carol, winnetou, dave, sun, and bob by replacing the wildcards PH_IP_ALICE, -etc. by the actual IP addresses defined in "testing.conf". - - if [ $ENABLE_BUILD_UMLROOTFS = "yes" ] - then - scripts/build-umlrootfs - fi - -takes the gentoo-based UML file system and compiles the latest strongSwan -distribution into it. - - if [ $ENABLE_BUILD_SSHKEYS = "yes" ] - then - scripts/build-sshkeys - fi - -adds the common RSA public key of the UML instances to your ~/.ssh/known_hosts -directory so that you can log onto the UML instances using ssh without typing -in a password. The "scripts/build-sshkeys" script should only be run once. - - if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ] - then - scripts/build-umlhostfs <hosts> - fi - -creates the customized UML file systems for the instances given as command line -arguments by adding the default host configurations to the UML root file system. -If the "make-starting" scripts is called without any arguments then by default -the UML file systems are created for the hosts alice, venus, moon, carol, -winnetou, dave, sun, and bob. Each UML root file system has as size defined by -the ROOTFSSIZE in testing.conf which by default is 544 MBytes. Thus all 8 UML -hosts plus the master copy will require a total of 5 GBytes of disk space. - - if [ $ENABLE_START_TESTING = "yes" ] - then - ./start-testing <hosts> - fi - -starts the automated testing. More details on the tests you'll find in the -README document. - ------------------------------------------------------------------------------ - diff --git a/testing/Makefile.am b/testing/Makefile.am index 2aa7d70bc..49831a570 100644 --- a/testing/Makefile.am +++ b/testing/Makefile.am @@ -1,11 +1,4 @@ -noinst_SCRIPTS = do-tests -CLEANFILES = do-tests -EXTRA_DIST = do-tests.in make-testing start-testing stop-testing \ - testing.conf ssh_config hosts images scripts tests INSTALL README - -do-tests : do-tests.in - sed \ - -e "s:\@routing_table\@:$(routing_table):" \ - $(srcdir)/$@.in > $@ - chmod +x $@ +EXTRA_DIST = do-tests make-testing start-testing stop-testing \ + testing.conf ssh_config config hosts images scripts tests \ + INSTALL README diff --git a/testing/README b/testing/README index 097b4264d..a62497269 100644 --- a/testing/README +++ b/testing/README @@ -1,158 +1,88 @@ - ------------------------------------ - strongSwan UML - Running the Tests - ------------------------------------ + ------------------------------ + strongSwan Integration Tests + ------------------------------ Contents -------- - 1. Starting up the UML testing environment - 2. Running the automated tests - 3. Manual testing + 1. Building the testing environment + 2. Starting up the testing environment + 3. Running the automated tests + 4. Manual testing -1. Starting up the UML testing environment - --------------------------------------- - -When the strongSwan UML testing environment has been put into place by -running the "make-testing" script then you are ready to start up the -UML instances by calling +1. Building the testing environment + -------------------------------- - ./start-testing <hosts> - -This main script first calls the subscript +The testing environment can be built with the "make-testing" script after +adjusting the variables in the testing.conf file. By default everything is +built when executing the script. Setting any of the ENABLE_BUILD_* variables +in the configuration file to "no" will not build those parts. - scripts/start-switches -that starts the three UML switches umlswitch0, umlswitch1, and umlswitch2 -which are connecting the UML instances among each other and via tun/tap -devices also make them accessible from the host system. - -Then depending on the setting of the UMLSTARTMODE variable defined -in "testing.conf", the UML instances given on the command line are started -up with different terminals: +2. Starting up the testing environment + ----------------------------------- -If you are running the KDE graphical environment then by setting +When the strongSwan testing environment has been put into place by running +the "make-testing" script you are ready to start up the KVM instances by +executing the "start-testing" script. - UMLSTARTMODE=konsole - -the script - scripts/kstart-umls <hosts> - -is called which starts up each of the UML instances defined by <hosts> in -a KDE konsole. If - - UMLSTARTMODE=xterm - -is set then - - scripts/xstart-umls <hosts> - -starts up the UML instances in an xterm each. And with the choice - - UMLSTARTMODE=screen - -the instances are started up by - - scripts/start-umls <hosts> - -in the background but the Linux command "screen -r <host>" can be used to -connect a terminal to the UML instance <host> if desired. - - - if [ $ENABLE_DO_TESTS = "yes" ] - then - do-tests - fi - -either executes all the tests defined in the "testing/tests" directory -if the variable SELECTEDTESTSONLY in "testing.conf" is set to "no" or the -selected tests defined by the string in SELELECTEDTESTS if SELECTEDTESTSONLY -is set to "yes". - - if [ $ENABLE_STOP_TESTING = "yes" ] - then - stop-testing <hosts> - fi - -stops the both the UML switches and the UML instances designated by the -<hosts> argument. - - -2. Running the automated tests +3. Running the automated tests --------------------------- The script ./do-tests <testnames> -runs the automated tests. With an empty <testnames> argument the tests -as defined in "testing.conf" are executed, otherwise the tests enumerated -by the <testnames> argument will be run as shown in the example below. +runs the automated tests. If the <testnames> argument is omitted all tests +are executed, otherwise only the tests listed will be run as shown in the +example below: - ./do-tests net2net-psk net2net-cert + ./do-tests ikev2/net2net-psk ikev2/net2net-cert Each test is divided into the following phases: - * scripts/load-testconfig <testname> - loads the UML hosts with test specific settings if such are provided. - - * next the "pretest.dat" script found in each test directory is executed. - Among other commands, strongSwan is started on the IPsec hosts. + * Load the test-specific guest configuration if any is provided. - * the "evaltest.dat" script evaluates if the test has been successful. - - * the "posttest.dat" script terminates the test e.g. by stopping - strongSwan on the IPsec hosts. + * Next the "pretest.dat" script found in each test directory is executed. + Among other commands, strongSwan is started on the IPsec hosts. - * scripts/restore-defaults <testname> - restores the default settings on the UML hosts. + * The "evaltest.dat" script evaluates if the test has been successful. -The test results and configuration settings for all tests settings are stored -in a folder labeled with the current date in the directory - - ~/strongswan-testing/testresults - -the same results are also automatically transferred to the Apache server -running on UML instance "winnetou" and can be accessed via the URL + * The "posttest.dat" script terminates the test e.g. by stopping + strongSwan on the IPsec hosts. It is also responsible to cleaning up + things (e.g. firewall rules) set up in "pretest.dat". - http://192.168.0.150/testresults/ + * Restore the default configuration on every host (new files have to be + deleted manually in "posttest.dat"). +The test results and configuration files for all tests are stored in a +folder labeled with the current date and time in the $TESTRESULTSDIR directory. -3. Manual testing - -------------- - -The greates flexibility can be achieved with manual testing. Just set - - ENABLE_DO_TESTS="no" - ENABLE_STOP_TESTING="no" - -in "testing.conf" and start the UML instances that you want to experiment with -by calling +The same results are also automatically transferred to the Apache server +running on guest "winnetou" and can be accessed via the URL - ./start-testing <hosts> - -If you want to preload a test scenario with configurations differing from -the default values, e.g. when using Preshared Keys then you can do this -with the command + http://192.168.0.150/testresults/ - scripts/load-testconfig net2net-psk - -You can then log onto any UML instance using its konsole, xterm or screen -terminal as root with the default password - tuxmux - -You can then execute any commands the UML instances, including changing -and recompiling the strongSwan source code located in the /root directory. +4. Manual testing + -------------- -After you have finished testing, the default configuration settings can -restored with the command +Instead of running tests automatically with "do-tests" it is possible to +preload a test scenario with the script: - scripts/restore-defaults net2net-psk + scripts/load-testconfig <testname> +Individual configuration files can be changed and any command can be executed by +logging into a guest host directly (via SSH or a console window). No password +is required to login as root. The sources for every software built during +"make-testing" are mounted at /root/shared/, which allows you to change and +recompile these components. ------------------------------------------------------------------------------ +After you have finished testing, the default configuration can be restored +with the following command (newly created files have to be deleted manually) + scripts/restore-defaults diff --git a/testing/config/kernel/config-3.5 b/testing/config/kernel/config-3.5 new file mode 100644 index 000000000..9494331eb --- /dev/null +++ b/testing/config/kernel/config-3.5 @@ -0,0 +1,1817 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/x86_64 3.5.3 Kernel Configuration +# +CONFIG_64BIT=y +# CONFIG_X86_32 is not set +CONFIG_X86_64=y +CONFIG_X86=y +CONFIG_INSTRUCTION_DECODER=y +CONFIG_OUTPUT_FORMAT="elf64-x86-64" +CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig" +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_HAVE_LATENCYTOP_SUPPORT=y +CONFIG_MMU=y +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_NEED_SG_DMA_LENGTH=y +CONFIG_GENERIC_ISA_DMA=y +CONFIG_GENERIC_BUG=y +CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_ARCH_MAY_HAVE_PC_FDC=y +# CONFIG_RWSEM_GENERIC_SPINLOCK is not set +CONFIG_RWSEM_XCHGADD_ALGORITHM=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HAS_DEFAULT_IDLE=y +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_ARCH_HAS_CPU_AUTOPROBE=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_ZONE_DMA32=y +CONFIG_AUDIT_ARCH=y +CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11" +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" +CONFIG_HAVE_IRQ_WORK=y +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_EXTABLE_SORT=y + +# +# General setup +# +CONFIG_EXPERIMENTAL=y +CONFIG_BROKEN_ON_SMP=y +CONFIG_INIT_ENV_ARG_LIMIT=32 +CONFIG_CROSS_COMPILE="" +CONFIG_LOCALVERSION="" +CONFIG_LOCALVERSION_AUTO=y +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_BZIP2=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_BZIP2 is not set +# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_XZ is not set +# CONFIG_KERNEL_LZO is not set +CONFIG_DEFAULT_HOSTNAME="(none)" +CONFIG_SWAP=y +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y +CONFIG_BSD_PROCESS_ACCT=y +# CONFIG_BSD_PROCESS_ACCT_V3 is not set +# CONFIG_FHANDLE is not set +# CONFIG_TASKSTATS is not set +# CONFIG_AUDIT is not set +CONFIG_HAVE_GENERIC_HARDIRQS=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_HARDIRQS=y +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +CONFIG_CLOCKSOURCE_WATCHDOG=y +CONFIG_ARCH_CLOCKSOURCE_DATA=y +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_GENERIC_CLOCKEVENTS_BUILD=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CMOS_UPDATE=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y + +# +# RCU Subsystem +# +CONFIG_TINY_RCU=y +# CONFIG_PREEMPT_RCU is not set +# CONFIG_TREE_RCU_TRACE is not set +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_LOG_BUF_SHIFT=14 +CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y +# CONFIG_CGROUPS is not set +# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_NAMESPACES=y +# CONFIG_UTS_NS is not set +# CONFIG_IPC_NS is not set +# CONFIG_PID_NS is not set +# CONFIG_NET_NS is not set +# CONFIG_SCHED_AUTOGROUP is not set +# CONFIG_SYSFS_DEPRECATED is not set +# CONFIG_RELAY is not set +# CONFIG_BLK_DEV_INITRD is not set +CONFIG_CC_OPTIMIZE_FOR_SIZE=y +CONFIG_SYSCTL=y +CONFIG_ANON_INODES=y +# CONFIG_EXPERT is not set +# CONFIG_SYSCTL_SYSCALL is not set +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_ALL is not set +CONFIG_HOTPLUG=y +CONFIG_PRINTK=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_PCSPKR_PLATFORM=y +CONFIG_HAVE_PCSPKR_PLATFORM=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +CONFIG_VM_EVENT_COUNTERS=y +CONFIG_PCI_QUIRKS=y +CONFIG_COMPAT_BRK=y +CONFIG_SLAB=y +# CONFIG_SLUB is not set +# CONFIG_PROFILING is not set +CONFIG_HAVE_OPROFILE=y +CONFIG_OPROFILE_NMI_TIMER=y +# CONFIG_JUMP_LABEL is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_OPTPROBES=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_ATTRS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_DMA_API_DEBUG=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y +CONFIG_HAVE_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_PERF_EVENTS_NMI=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y + +# +# GCOV-based kernel profiling +# +# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set +CONFIG_SLABINFO=y +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +# CONFIG_MODULES is not set +CONFIG_BLOCK=y +# CONFIG_BLK_DEV_BSG is not set +# CONFIG_BLK_DEV_BSGLIB is not set +# CONFIG_BLK_DEV_INTEGRITY is not set + +# +# Partition Types +# +# CONFIG_PARTITION_ADVANCED is not set +CONFIG_MSDOS_PARTITION=y + +# +# IO Schedulers +# +CONFIG_IOSCHED_NOOP=y +CONFIG_IOSCHED_DEADLINE=y +CONFIG_IOSCHED_CFQ=y +# CONFIG_DEFAULT_DEADLINE is not set +CONFIG_DEFAULT_CFQ=y +# CONFIG_DEFAULT_NOOP is not set +CONFIG_DEFAULT_IOSCHED="cfq" +# CONFIG_INLINE_SPIN_TRYLOCK is not set +# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK is not set +# CONFIG_INLINE_SPIN_LOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK_IRQ is not set +# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set +# CONFIG_INLINE_SPIN_UNLOCK_BH is not set +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_READ_TRYLOCK is not set +# CONFIG_INLINE_READ_LOCK is not set +# CONFIG_INLINE_READ_LOCK_BH is not set +# CONFIG_INLINE_READ_LOCK_IRQ is not set +# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set +CONFIG_INLINE_READ_UNLOCK=y +# CONFIG_INLINE_READ_UNLOCK_BH is not set +CONFIG_INLINE_READ_UNLOCK_IRQ=y +# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_WRITE_TRYLOCK is not set +# CONFIG_INLINE_WRITE_LOCK is not set +# CONFIG_INLINE_WRITE_LOCK_BH is not set +# CONFIG_INLINE_WRITE_LOCK_IRQ is not set +# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set +CONFIG_INLINE_WRITE_UNLOCK=y +# CONFIG_INLINE_WRITE_UNLOCK_BH is not set +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set +# CONFIG_MUTEX_SPIN_ON_OWNER is not set +CONFIG_FREEZER=y + +# +# Processor type and features +# +CONFIG_ZONE_DMA=y +# CONFIG_SMP is not set +CONFIG_X86_MPPARSE=y +CONFIG_X86_EXTENDED_PLATFORM=y +CONFIG_SCHED_OMIT_FRAME_POINTER=y +CONFIG_PARAVIRT_GUEST=y +# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set +# CONFIG_XEN is not set +# CONFIG_XEN_PRIVILEGED_GUEST is not set +CONFIG_KVM_CLOCK=y +CONFIG_KVM_GUEST=y +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_CLOCK=y +# CONFIG_PARAVIRT_DEBUG is not set +CONFIG_NO_BOOTMEM=y +# CONFIG_MEMTEST is not set +# CONFIG_MK8 is not set +# CONFIG_MPSC is not set +CONFIG_MCORE2=y +# CONFIG_MATOM is not set +# CONFIG_GENERIC_CPU is not set +CONFIG_X86_INTERNODE_CACHE_SHIFT=6 +CONFIG_X86_CMPXCHG=y +CONFIG_X86_L1_CACHE_SHIFT=6 +CONFIG_X86_XADD=y +CONFIG_X86_WP_WORKS_OK=y +CONFIG_X86_INTEL_USERCOPY=y +CONFIG_X86_USE_PPRO_CHECKSUM=y +CONFIG_X86_P6_NOP=y +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=64 +CONFIG_X86_DEBUGCTLMSR=y +CONFIG_CPU_SUP_INTEL=y +CONFIG_CPU_SUP_AMD=y +CONFIG_CPU_SUP_CENTAUR=y +CONFIG_HPET_TIMER=y +CONFIG_DMI=y +CONFIG_GART_IOMMU=y +# CONFIG_CALGARY_IOMMU is not set +CONFIG_SWIOTLB=y +CONFIG_IOMMU_HELPER=y +CONFIG_NR_CPUS=1 +# CONFIG_IRQ_TIME_ACCOUNTING is not set +CONFIG_PREEMPT_NONE=y +# CONFIG_PREEMPT_VOLUNTARY is not set +# CONFIG_PREEMPT is not set +CONFIG_X86_LOCAL_APIC=y +CONFIG_X86_IO_APIC=y +# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set +# CONFIG_X86_MCE is not set +# CONFIG_I8K is not set +# CONFIG_MICROCODE is not set +# CONFIG_X86_MSR is not set +# CONFIG_X86_CPUID is not set +CONFIG_ARCH_PHYS_ADDR_T_64BIT=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +CONFIG_DIRECT_GBPAGES=y +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_DEFAULT=y +CONFIG_ARCH_SELECT_MEMORY_MODEL=y +CONFIG_ARCH_MEMORY_PROBE=y +CONFIG_ARCH_PROC_KCORE_TEXT=y +CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_SPARSEMEM_MANUAL=y +CONFIG_SPARSEMEM=y +CONFIG_HAVE_MEMORY_PRESENT=y +CONFIG_SPARSEMEM_EXTREME=y +CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y +CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y +CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_HAVE_MEMBLOCK=y +CONFIG_HAVE_MEMBLOCK_NODE_MAP=y +CONFIG_ARCH_DISCARD_MEMBLOCK=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTPLUG_SPARSE=y +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_PAGEFLAGS_EXTENDED=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +# CONFIG_COMPACTION is not set +CONFIG_MIGRATION=y +CONFIG_PHYS_ADDR_T_64BIT=y +CONFIG_ZONE_DMA_FLAG=1 +CONFIG_BOUNCE=y +CONFIG_VIRT_TO_BUS=y +# CONFIG_KSM is not set +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +# CONFIG_TRANSPARENT_HUGEPAGE is not set +CONFIG_CROSS_MEMORY_ATTACH=y +CONFIG_NEED_PER_CPU_KM=y +# CONFIG_CLEANCACHE is not set +# CONFIG_FRONTSWAP is not set +# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set +CONFIG_X86_RESERVE_LOW=64 +CONFIG_MTRR=y +CONFIG_MTRR_SANITIZER=y +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 +CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 +CONFIG_X86_PAT=y +CONFIG_ARCH_USES_PG_UNCACHED=y +CONFIG_ARCH_RANDOM=y +# CONFIG_EFI is not set +CONFIG_SECCOMP=y +# CONFIG_CC_STACKPROTECTOR is not set +# CONFIG_HZ_100 is not set +CONFIG_HZ_250=y +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 +CONFIG_SCHED_HRTICK=y +# CONFIG_KEXEC is not set +# CONFIG_CRASH_DUMP is not set +CONFIG_PHYSICAL_START=0x1000000 +CONFIG_RELOCATABLE=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +# CONFIG_CMDLINE_BOOL is not set +CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y +CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y + +# +# Power management and ACPI options +# +CONFIG_SUSPEND=y +CONFIG_SUSPEND_FREEZER=y +# CONFIG_HIBERNATION is not set +CONFIG_PM_SLEEP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +# CONFIG_PM_RUNTIME is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_ACPI=y +CONFIG_ACPI_SLEEP=y +# CONFIG_ACPI_PROCFS is not set +# CONFIG_ACPI_PROCFS_POWER is not set +# CONFIG_ACPI_EC_DEBUGFS is not set +CONFIG_ACPI_PROC_EVENT=y +CONFIG_ACPI_AC=y +CONFIG_ACPI_BATTERY=y +CONFIG_ACPI_BUTTON=y +CONFIG_ACPI_FAN=y +# CONFIG_ACPI_DOCK is not set +CONFIG_ACPI_PROCESSOR=y +# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set +CONFIG_ACPI_THERMAL=y +# CONFIG_ACPI_CUSTOM_DSDT is not set +CONFIG_ACPI_BLACKLIST_YEAR=0 +# CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_PCI_SLOT is not set +CONFIG_X86_PM_TIMER=y +# CONFIG_ACPI_CONTAINER is not set +# CONFIG_ACPI_HOTPLUG_MEMORY is not set +# CONFIG_ACPI_SBS is not set +# CONFIG_ACPI_HED is not set +# CONFIG_ACPI_BGRT is not set +# CONFIG_ACPI_APEI is not set +# CONFIG_SFI is not set + +# +# CPU Frequency scaling +# +# CONFIG_CPU_FREQ is not set +CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_GOV_LADDER=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_INTEL_IDLE is not set + +# +# Memory power savings +# +# CONFIG_I7300_IDLE is not set + +# +# Bus options (PCI etc.) +# +CONFIG_PCI=y +CONFIG_PCI_DIRECT=y +# CONFIG_PCI_MMCONFIG is not set +CONFIG_PCI_DOMAINS=y +# CONFIG_PCI_CNB20LE_QUIRK is not set +# CONFIG_PCIEPORTBUS is not set +CONFIG_ARCH_SUPPORTS_MSI=y +CONFIG_PCI_MSI=y +# CONFIG_PCI_DEBUG is not set +# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set +# CONFIG_PCI_STUB is not set +CONFIG_HT_IRQ=y +# CONFIG_PCI_IOV is not set +# CONFIG_PCI_PRI is not set +# CONFIG_PCI_PASID is not set +# CONFIG_PCI_IOAPIC is not set +CONFIG_PCI_LABEL=y +CONFIG_ISA_DMA_API=y +CONFIG_AMD_NB=y +# CONFIG_PCCARD is not set +# CONFIG_HOTPLUG_PCI is not set +# CONFIG_RAPIDIO is not set + +# +# Executable file formats / Emulations +# +CONFIG_BINFMT_ELF=y +CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +# CONFIG_HAVE_AOUT is not set +# CONFIG_BINFMT_MISC is not set +# CONFIG_IA32_EMULATION is not set +# CONFIG_COMPAT_FOR_U64_ALIGNMENT is not set +CONFIG_HAVE_TEXT_POKE_SMP=y +CONFIG_X86_DEV_DMA_OPS=y +CONFIG_NET=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_UNIX=y +# CONFIG_UNIX_DIAG is not set +CONFIG_XFRM=y +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_USER=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_IPCOMP=y +CONFIG_NET_KEY=y +CONFIG_NET_KEY_MIGRATE=y +CONFIG_INET=y +# CONFIG_IP_MULTICAST is not set +CONFIG_IP_ADVANCED_ROUTER=y +# CONFIG_IP_FIB_TRIE_STATS is not set +CONFIG_IP_MULTIPLE_TABLES=y +# CONFIG_IP_ROUTE_MULTIPATH is not set +# CONFIG_IP_ROUTE_VERBOSE is not set +CONFIG_IP_ROUTE_CLASSID=y +# CONFIG_IP_PNP is not set +# CONFIG_NET_IPIP is not set +# CONFIG_NET_IPGRE_DEMUX is not set +# CONFIG_ARPD is not set +# CONFIG_SYN_COOKIES is not set +CONFIG_INET_AH=y +CONFIG_INET_ESP=y +CONFIG_INET_IPCOMP=y +CONFIG_INET_XFRM_TUNNEL=y +CONFIG_INET_TUNNEL=y +CONFIG_INET_XFRM_MODE_TRANSPORT=y +CONFIG_INET_XFRM_MODE_TUNNEL=y +CONFIG_INET_XFRM_MODE_BEET=y +# CONFIG_INET_LRO is not set +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +# CONFIG_INET_UDP_DIAG is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +CONFIG_IPV6=y +# CONFIG_IPV6_PRIVACY is not set +# CONFIG_IPV6_ROUTER_PREF is not set +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_INET6_AH=y +CONFIG_INET6_ESP=y +CONFIG_INET6_IPCOMP=y +CONFIG_IPV6_MIP6=y +CONFIG_INET6_XFRM_TUNNEL=y +CONFIG_INET6_TUNNEL=y +CONFIG_INET6_XFRM_MODE_TRANSPORT=y +CONFIG_INET6_XFRM_MODE_TUNNEL=y +CONFIG_INET6_XFRM_MODE_BEET=y +# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set +# CONFIG_IPV6_SIT is not set +# CONFIG_IPV6_TUNNEL is not set +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_SUBTREES=y +# CONFIG_IPV6_MROUTE is not set +# CONFIG_NETWORK_SECMARK is not set +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +CONFIG_NETFILTER=y +# CONFIG_NETFILTER_DEBUG is not set +CONFIG_NETFILTER_ADVANCED=y + +# +# Core Netfilter Configuration +# +CONFIG_NETFILTER_NETLINK=y +# CONFIG_NETFILTER_NETLINK_ACCT is not set +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_CONNTRACK_MARK=y +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_EVENTS=y +# CONFIG_NF_CONNTRACK_TIMEOUT is not set +# CONFIG_NF_CONNTRACK_TIMESTAMP is not set +# CONFIG_NF_CT_PROTO_DCCP is not set +# CONFIG_NF_CT_PROTO_SCTP is not set +CONFIG_NF_CT_PROTO_UDPLITE=y +# CONFIG_NF_CONNTRACK_AMANDA is not set +# CONFIG_NF_CONNTRACK_FTP is not set +# CONFIG_NF_CONNTRACK_H323 is not set +# CONFIG_NF_CONNTRACK_IRC is not set +# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set +# CONFIG_NF_CONNTRACK_SNMP is not set +# CONFIG_NF_CONNTRACK_PPTP is not set +CONFIG_NF_CONNTRACK_SANE=y +# CONFIG_NF_CONNTRACK_SIP is not set +# CONFIG_NF_CONNTRACK_TFTP is not set +CONFIG_NF_CT_NETLINK=y +# CONFIG_NF_CT_NETLINK_TIMEOUT is not set +# CONFIG_NETFILTER_TPROXY is not set +CONFIG_NETFILTER_XTABLES=y + +# +# Xtables combined modules +# +CONFIG_NETFILTER_XT_MARK=y +CONFIG_NETFILTER_XT_CONNMARK=y +CONFIG_NETFILTER_XT_SET=y + +# +# Xtables targets +# +# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +# CONFIG_NETFILTER_XT_TARGET_CT is not set +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_HL=y +# CONFIG_NETFILTER_XT_TARGET_HMARK is not set +# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_NOTRACK=y +# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set +# CONFIG_NETFILTER_XT_TARGET_TEE is not set +CONFIG_NETFILTER_XT_TARGET_TRACE=y +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set + +# +# Xtables matches +# +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +# CONFIG_NETFILTER_XT_MATCH_CPU is not set +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ECN=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_HL=y +# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set +# CONFIG_NETFILTER_XT_MATCH_OSF is not set +# CONFIG_NETFILTER_XT_MATCH_OWNER is not set +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set +CONFIG_NETFILTER_XT_MATCH_REALM=y +# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +# CONFIG_NETFILTER_XT_MATCH_TIME is not set +CONFIG_NETFILTER_XT_MATCH_U32=y +CONFIG_IP_SET=y +CONFIG_IP_SET_MAX=256 +CONFIG_IP_SET_BITMAP_IP=y +CONFIG_IP_SET_BITMAP_IPMAC=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETPORT=y +# CONFIG_IP_SET_HASH_NETIFACE is not set +CONFIG_IP_SET_LIST_SET=y +# CONFIG_IP_VS is not set + +# +# IP: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_CONNTRACK_IPV4=y +CONFIG_NF_CONNTRACK_PROC_COMPAT=y +CONFIG_IP_NF_QUEUE=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +# CONFIG_IP_NF_MATCH_RPFILTER is not set +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_TARGET_REJECT=y +CONFIG_IP_NF_TARGET_ULOG=y +CONFIG_NF_NAT=y +CONFIG_NF_NAT_NEEDED=y +CONFIG_IP_NF_TARGET_MASQUERADE=y +CONFIG_IP_NF_TARGET_NETMAP=y +CONFIG_IP_NF_TARGET_REDIRECT=y +CONFIG_NF_NAT_PROTO_UDPLITE=y +# CONFIG_NF_NAT_FTP is not set +# CONFIG_NF_NAT_IRC is not set +# CONFIG_NF_NAT_TFTP is not set +# CONFIG_NF_NAT_AMANDA is not set +# CONFIG_NF_NAT_PPTP is not set +# CONFIG_NF_NAT_H323 is not set +# CONFIG_NF_NAT_SIP is not set +CONFIG_IP_NF_MANGLE=y +CONFIG_IP_NF_TARGET_CLUSTERIP=y +CONFIG_IP_NF_TARGET_ECN=y +CONFIG_IP_NF_TARGET_TTL=y +CONFIG_IP_NF_RAW=y +CONFIG_IP_NF_ARPTABLES=y +CONFIG_IP_NF_ARPFILTER=y +CONFIG_IP_NF_ARP_MANGLE=y + +# +# IPv6: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV6=y +CONFIG_NF_CONNTRACK_IPV6=y +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +# CONFIG_IP6_NF_MATCH_RPFILTER is not set +CONFIG_IP6_NF_MATCH_RT=y +CONFIG_IP6_NF_TARGET_HL=y +CONFIG_IP6_NF_FILTER=y +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_RAW=y +# CONFIG_IP_DCCP is not set +# CONFIG_IP_SCTP is not set +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +CONFIG_L2TP=y +# CONFIG_L2TP_V3 is not set +# CONFIG_BRIDGE is not set +# CONFIG_NET_DSA is not set +# CONFIG_VLAN_8021Q is not set +# CONFIG_DECNET is not set +# CONFIG_LLC2 is not set +# CONFIG_IPX is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_WAN_ROUTER is not set +# CONFIG_PHONET is not set +# CONFIG_IEEE802154 is not set +# CONFIG_NET_SCHED is not set +# CONFIG_DCB is not set +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +CONFIG_BQL=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_IRDA is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +CONFIG_FIB_RULES=y +CONFIG_WIRELESS=y +# CONFIG_CFG80211 is not set +# CONFIG_LIB80211 is not set + +# +# CFG80211 needs to be enabled for MAC80211 +# +# CONFIG_WIMAX is not set +# CONFIG_RFKILL is not set +CONFIG_NET_9P=y +CONFIG_NET_9P_VIRTIO=y +# CONFIG_NET_9P_DEBUG is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +CONFIG_HAVE_BPF_JIT=y + +# +# Device Drivers +# + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +# CONFIG_DEVTMPFS is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y +CONFIG_FW_LOADER=y +CONFIG_FIRMWARE_IN_KERNEL=y +CONFIG_EXTRA_FIRMWARE="" +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_SYS_HYPERVISOR is not set +# CONFIG_GENERIC_CPU_DEVICES is not set +# CONFIG_DMA_SHARED_BUFFER is not set +# CONFIG_CONNECTOR is not set +# CONFIG_MTD is not set +# CONFIG_PARPORT is not set +CONFIG_PNP=y +CONFIG_PNP_DEBUG_MESSAGES=y + +# +# Protocols +# +CONFIG_PNPACPI=y +CONFIG_BLK_DEV=y +# CONFIG_BLK_DEV_FD is not set +# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +# CONFIG_BLK_CPQ_DA is not set +# CONFIG_BLK_CPQ_CISS_DA is not set +# CONFIG_BLK_DEV_DAC960 is not set +# CONFIG_BLK_DEV_UMEM is not set +# CONFIG_BLK_DEV_COW_COMMON is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +# CONFIG_BLK_DEV_CRYPTOLOOP is not set + +# +# DRBD disabled because PROC_FS, INET or CONNECTOR not selected +# +CONFIG_BLK_DEV_NBD=y +# CONFIG_BLK_DEV_NVME is not set +# CONFIG_BLK_DEV_SX8 is not set +# CONFIG_BLK_DEV_RAM is not set +# CONFIG_CDROM_PKTCDVD is not set +# CONFIG_ATA_OVER_ETH is not set +CONFIG_VIRTIO_BLK=y +# CONFIG_BLK_DEV_HD is not set +# CONFIG_BLK_DEV_RBD is not set + +# +# Misc devices +# +# CONFIG_SENSORS_LIS3LV02D is not set +# CONFIG_IBM_ASM is not set +# CONFIG_PHANTOM is not set +# CONFIG_INTEL_MID_PTI is not set +# CONFIG_SGI_IOC4 is not set +# CONFIG_TIFM_CORE is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_HP_ILO is not set +# CONFIG_VMWARE_BALLOON is not set +# CONFIG_PCH_PHUB is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_93CX6 is not set +# CONFIG_CB710_CORE is not set + +# +# Texas Instruments shared transport line discipline +# + +# +# Altera FPGA firmware download module +# +CONFIG_HAVE_IDE=y +# CONFIG_IDE is not set + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +# CONFIG_SCSI is not set +# CONFIG_SCSI_DMA is not set +# CONFIG_SCSI_NETLINK is not set +# CONFIG_ATA is not set +# CONFIG_MD is not set +# CONFIG_FUSION is not set + +# +# IEEE 1394 (FireWire) support +# +# CONFIG_FIREWIRE is not set +# CONFIG_FIREWIRE_NOSY is not set +# CONFIG_I2O is not set +# CONFIG_MACINTOSH_DRIVERS is not set +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +CONFIG_DUMMY=y +# CONFIG_EQUALIZER is not set +# CONFIG_MII is not set +# CONFIG_NET_TEAM is not set +# CONFIG_MACVLAN is not set +# CONFIG_NETCONSOLE is not set +# CONFIG_NETPOLL is not set +# CONFIG_NET_POLL_CONTROLLER is not set +CONFIG_TUN=y +# CONFIG_VETH is not set +CONFIG_VIRTIO_NET=y +# CONFIG_ARCNET is not set + +# +# CAIF transport drivers +# +CONFIG_ETHERNET=y +CONFIG_NET_VENDOR_3COM=y +# CONFIG_VORTEX is not set +# CONFIG_TYPHOON is not set +CONFIG_NET_VENDOR_ADAPTEC=y +# CONFIG_ADAPTEC_STARFIRE is not set +CONFIG_NET_VENDOR_ALTEON=y +# CONFIG_ACENIC is not set +CONFIG_NET_VENDOR_AMD=y +# CONFIG_AMD8111_ETH is not set +# CONFIG_PCNET32 is not set +CONFIG_NET_VENDOR_ATHEROS=y +# CONFIG_ATL2 is not set +# CONFIG_ATL1 is not set +# CONFIG_ATL1E is not set +# CONFIG_ATL1C is not set +CONFIG_NET_VENDOR_BROADCOM=y +# CONFIG_B44 is not set +# CONFIG_BNX2 is not set +# CONFIG_CNIC is not set +# CONFIG_TIGON3 is not set +# CONFIG_BNX2X is not set +CONFIG_NET_VENDOR_BROCADE=y +# CONFIG_BNA is not set +# CONFIG_NET_CALXEDA_XGMAC is not set +CONFIG_NET_VENDOR_CHELSIO=y +# CONFIG_CHELSIO_T1 is not set +# CONFIG_CHELSIO_T3 is not set +# CONFIG_CHELSIO_T4 is not set +# CONFIG_CHELSIO_T4VF is not set +CONFIG_NET_VENDOR_CISCO=y +# CONFIG_ENIC is not set +# CONFIG_DNET is not set +CONFIG_NET_VENDOR_DEC=y +# CONFIG_NET_TULIP is not set +CONFIG_NET_VENDOR_DLINK=y +# CONFIG_DL2K is not set +# CONFIG_SUNDANCE is not set +CONFIG_NET_VENDOR_EMULEX=y +# CONFIG_BE2NET is not set +CONFIG_NET_VENDOR_EXAR=y +# CONFIG_S2IO is not set +# CONFIG_VXGE is not set +CONFIG_NET_VENDOR_HP=y +# CONFIG_HP100 is not set +CONFIG_NET_VENDOR_INTEL=y +# CONFIG_E100 is not set +# CONFIG_E1000 is not set +# CONFIG_E1000E is not set +# CONFIG_IGB is not set +# CONFIG_IGBVF is not set +# CONFIG_IXGB is not set +# CONFIG_IXGBE is not set +# CONFIG_IXGBEVF is not set +CONFIG_NET_VENDOR_I825XX=y +# CONFIG_ZNET is not set +# CONFIG_IP1000 is not set +# CONFIG_JME is not set +CONFIG_NET_VENDOR_MARVELL=y +# CONFIG_SKGE is not set +# CONFIG_SKY2 is not set +CONFIG_NET_VENDOR_MELLANOX=y +# CONFIG_MLX4_EN is not set +# CONFIG_MLX4_CORE is not set +CONFIG_NET_VENDOR_MICREL=y +# CONFIG_KS8851_MLL is not set +# CONFIG_KSZ884X_PCI is not set +CONFIG_NET_VENDOR_MYRI=y +# CONFIG_MYRI10GE is not set +# CONFIG_FEALNX is not set +CONFIG_NET_VENDOR_NATSEMI=y +# CONFIG_NATSEMI is not set +# CONFIG_NS83820 is not set +CONFIG_NET_VENDOR_8390=y +# CONFIG_NE2K_PCI is not set +CONFIG_NET_VENDOR_NVIDIA=y +# CONFIG_FORCEDETH is not set +CONFIG_NET_VENDOR_OKI=y +# CONFIG_PCH_GBE is not set +# CONFIG_ETHOC is not set +CONFIG_NET_PACKET_ENGINE=y +# CONFIG_HAMACHI is not set +# CONFIG_YELLOWFIN is not set +CONFIG_NET_VENDOR_QLOGIC=y +# CONFIG_QLA3XXX is not set +# CONFIG_QLCNIC is not set +# CONFIG_QLGE is not set +# CONFIG_NETXEN_NIC is not set +CONFIG_NET_VENDOR_REALTEK=y +# CONFIG_8139CP is not set +# CONFIG_8139TOO is not set +# CONFIG_R8169 is not set +CONFIG_NET_VENDOR_RDC=y +# CONFIG_R6040 is not set +CONFIG_NET_VENDOR_SEEQ=y +# CONFIG_SEEQ8005 is not set +CONFIG_NET_VENDOR_SILAN=y +# CONFIG_SC92031 is not set +CONFIG_NET_VENDOR_SIS=y +# CONFIG_SIS900 is not set +# CONFIG_SIS190 is not set +# CONFIG_SFC is not set +CONFIG_NET_VENDOR_SMSC=y +# CONFIG_EPIC100 is not set +# CONFIG_SMSC9420 is not set +CONFIG_NET_VENDOR_STMICRO=y +# CONFIG_STMMAC_ETH is not set +CONFIG_NET_VENDOR_SUN=y +# CONFIG_HAPPYMEAL is not set +# CONFIG_SUNGEM is not set +# CONFIG_CASSINI is not set +# CONFIG_NIU is not set +CONFIG_NET_VENDOR_TEHUTI=y +# CONFIG_TEHUTI is not set +CONFIG_NET_VENDOR_TI=y +# CONFIG_TLAN is not set +CONFIG_NET_VENDOR_VIA=y +# CONFIG_VIA_RHINE is not set +# CONFIG_VIA_VELOCITY is not set +CONFIG_NET_VENDOR_WIZNET=y +# CONFIG_WIZNET_W5100 is not set +# CONFIG_WIZNET_W5300 is not set +# CONFIG_FDDI is not set +# CONFIG_HIPPI is not set +# CONFIG_NET_SB1000 is not set +# CONFIG_PHYLIB is not set +# CONFIG_PPP is not set +# CONFIG_SLIP is not set +CONFIG_WLAN=y +# CONFIG_AIRO is not set +# CONFIG_ATMEL is not set +# CONFIG_PRISM54 is not set +# CONFIG_HOSTAP is not set +# CONFIG_WL_TI is not set + +# +# Enable WiMAX (Networking options) to see the WiMAX drivers +# +# CONFIG_WAN is not set +# CONFIG_VMXNET3 is not set +# CONFIG_ISDN is not set + +# +# Input device support +# +CONFIG_INPUT=y +# CONFIG_INPUT_FF_MEMLESS is not set +# CONFIG_INPUT_POLLDEV is not set +# CONFIG_INPUT_SPARSEKMAP is not set +# CONFIG_INPUT_MATRIXKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_MOUSEDEV_PSAUX=y +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +# CONFIG_INPUT_JOYDEV is not set +# CONFIG_INPUT_EVDEV is not set +# CONFIG_INPUT_EVBUG is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +CONFIG_KEYBOARD_ATKBD=y +# CONFIG_KEYBOARD_LKKBD is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_OMAP4 is not set +# CONFIG_KEYBOARD_XTKBD is not set +CONFIG_INPUT_MOUSE=y +CONFIG_MOUSE_PS2=y +CONFIG_MOUSE_PS2_ALPS=y +CONFIG_MOUSE_PS2_LOGIPS2PP=y +CONFIG_MOUSE_PS2_SYNAPTICS=y +CONFIG_MOUSE_PS2_LIFEBOOK=y +CONFIG_MOUSE_PS2_TRACKPOINT=y +# CONFIG_MOUSE_PS2_ELANTECH is not set +# CONFIG_MOUSE_PS2_SENTELIC is not set +# CONFIG_MOUSE_PS2_TOUCHKIT is not set +# CONFIG_MOUSE_SERIAL is not set +# CONFIG_MOUSE_APPLETOUCH is not set +# CONFIG_MOUSE_BCM5974 is not set +# CONFIG_MOUSE_VSXXXAA is not set +# CONFIG_MOUSE_SYNAPTICS_USB is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +# CONFIG_INPUT_TOUCHSCREEN is not set +# CONFIG_INPUT_MISC is not set + +# +# Hardware I/O ports +# +CONFIG_SERIO=y +CONFIG_SERIO_I8042=y +CONFIG_SERIO_SERPORT=y +# CONFIG_SERIO_CT82C710 is not set +# CONFIG_SERIO_PCIPS2 is not set +CONFIG_SERIO_LIBPS2=y +# CONFIG_SERIO_RAW is not set +# CONFIG_SERIO_ALTERA_PS2 is not set +# CONFIG_SERIO_PS2MULT is not set +# CONFIG_GAMEPORT is not set + +# +# Character devices +# +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_VT_CONSOLE_SLEEP=y +CONFIG_HW_CONSOLE=y +# CONFIG_VT_HW_CONSOLE_BINDING is not set +CONFIG_UNIX98_PTYS=y +# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set +CONFIG_LEGACY_PTYS=y +CONFIG_LEGACY_PTY_COUNT=256 +# CONFIG_SERIAL_NONSTANDARD is not set +# CONFIG_NOZOMI is not set +# CONFIG_N_GSM is not set +# CONFIG_TRACE_SINK is not set +CONFIG_DEVKMEM=y + +# +# Serial drivers +# +# CONFIG_SERIAL_8250 is not set +CONFIG_FIX_EARLYCON_MEM=y + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_MFD_HSU is not set +# CONFIG_SERIAL_JSM is not set +# CONFIG_SERIAL_TIMBERDALE is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +# CONFIG_SERIAL_PCH_UART is not set +# CONFIG_SERIAL_XILINX_PS_UART is not set +CONFIG_HVC_DRIVER=y +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_IPMI_HANDLER is not set +# CONFIG_HW_RANDOM is not set +# CONFIG_NVRAM is not set +# CONFIG_RTC is not set +# CONFIG_GEN_RTC is not set +# CONFIG_R3964 is not set +# CONFIG_APPLICOM is not set +# CONFIG_MWAVE is not set +# CONFIG_RAW_DRIVER is not set +# CONFIG_HPET is not set +# CONFIG_HANGCHECK_TIMER is not set +# CONFIG_TCG_TPM is not set +# CONFIG_TELCLOCK is not set +CONFIG_DEVPORT=y +# CONFIG_I2C is not set +# CONFIG_SPI is not set +# CONFIG_HSI is not set + +# +# PPS support +# +# CONFIG_PPS is not set + +# +# PPS generators support +# + +# +# PTP clock support +# + +# +# Enable Device Drivers -> PPS to see the PTP clock options. +# +CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y +# CONFIG_GPIOLIB is not set +# CONFIG_W1 is not set +CONFIG_POWER_SUPPLY=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_PDA_POWER is not set +# CONFIG_TEST_POWER is not set +# CONFIG_BATTERY_DS2780 is not set +# CONFIG_BATTERY_DS2781 is not set +# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_CHARGER_MAX8903 is not set +CONFIG_HWMON=y +# CONFIG_HWMON_VID is not set +# CONFIG_HWMON_DEBUG_CHIP is not set + +# +# Native drivers +# +# CONFIG_SENSORS_ABITUGURU is not set +# CONFIG_SENSORS_ABITUGURU3 is not set +# CONFIG_SENSORS_K8TEMP is not set +# CONFIG_SENSORS_K10TEMP is not set +# CONFIG_SENSORS_FAM15H_POWER is not set +# CONFIG_SENSORS_I5K_AMB is not set +# CONFIG_SENSORS_F71805F is not set +# CONFIG_SENSORS_F71882FG is not set +# CONFIG_SENSORS_CORETEMP is not set +# CONFIG_SENSORS_IT87 is not set +# CONFIG_SENSORS_NTC_THERMISTOR is not set +# CONFIG_SENSORS_PC87360 is not set +# CONFIG_SENSORS_PC87427 is not set +# CONFIG_SENSORS_SIS5595 is not set +# CONFIG_SENSORS_SMSC47M1 is not set +# CONFIG_SENSORS_SMSC47B397 is not set +# CONFIG_SENSORS_SCH56XX_COMMON is not set +# CONFIG_SENSORS_VIA_CPUTEMP is not set +# CONFIG_SENSORS_VIA686A is not set +# CONFIG_SENSORS_VT1211 is not set +# CONFIG_SENSORS_VT8231 is not set +# CONFIG_SENSORS_W83627HF is not set +# CONFIG_SENSORS_W83627EHF is not set +# CONFIG_SENSORS_APPLESMC is not set + +# +# ACPI drivers +# +# CONFIG_SENSORS_ACPI_POWER is not set +# CONFIG_SENSORS_ATK0110 is not set +CONFIG_THERMAL=y +CONFIG_THERMAL_HWMON=y +# CONFIG_WATCHDOG is not set +CONFIG_SSB_POSSIBLE=y + +# +# Sonics Silicon Backplane +# +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y + +# +# Broadcom specific AMBA +# +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_CORE is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_MFD_TMIO is not set +# CONFIG_ABX500_CORE is not set +# CONFIG_MFD_CS5535 is not set +# CONFIG_LPC_SCH is not set +# CONFIG_LPC_ICH is not set +# CONFIG_MFD_RDC321X is not set +# CONFIG_MFD_JANZ_CMODIO is not set +# CONFIG_MFD_VX855 is not set +# CONFIG_REGULATOR is not set +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +# CONFIG_AGP is not set +CONFIG_VGA_ARB=y +CONFIG_VGA_ARB_MAX_GPUS=16 +# CONFIG_VGA_SWITCHEROO is not set +# CONFIG_DRM is not set +# CONFIG_STUB_POULSBO is not set +# CONFIG_VGASTATE is not set +# CONFIG_VIDEO_OUTPUT_CONTROL is not set +# CONFIG_FB is not set +# CONFIG_EXYNOS_VIDEO is not set +# CONFIG_BACKLIGHT_LCD_SUPPORT is not set + +# +# Console display driver support +# +CONFIG_VGA_CONSOLE=y +# CONFIG_VGACON_SOFT_SCROLLBACK is not set +CONFIG_DUMMY_CONSOLE=y +CONFIG_SOUND=y +# CONFIG_SOUND_OSS_CORE is not set +# CONFIG_SND is not set +# CONFIG_SOUND_PRIME is not set + +# +# HID support +# +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +# CONFIG_HIDRAW is not set +CONFIG_HID_GENERIC=y + +# +# Special HID drivers +# +CONFIG_USB_ARCH_HAS_OHCI=y +CONFIG_USB_ARCH_HAS_EHCI=y +CONFIG_USB_ARCH_HAS_XHCI=y +CONFIG_USB_SUPPORT=y +CONFIG_USB_ARCH_HAS_HCD=y +# CONFIG_USB is not set + +# +# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may +# +# CONFIG_USB_GADGET is not set + +# +# OTG and related infrastructure +# +# CONFIG_UWB is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_INFINIBAND is not set +# CONFIG_EDAC is not set +# CONFIG_RTC_CLASS is not set +# CONFIG_DMADEVICES is not set +# CONFIG_AUXDISPLAY is not set +# CONFIG_UIO is not set +CONFIG_VIRTIO=y +CONFIG_VIRTIO_RING=y + +# +# Virtio drivers +# +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_BALLOON=y +CONFIG_VIRTIO_MMIO=y +# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set + +# +# Microsoft Hyper-V guest support +# +# CONFIG_HYPERV is not set +# CONFIG_STAGING is not set +CONFIG_X86_PLATFORM_DEVICES=y +# CONFIG_ACERHDF is not set +# CONFIG_ASUS_LAPTOP is not set +# CONFIG_FUJITSU_TABLET is not set +# CONFIG_HP_ACCEL is not set +# CONFIG_THINKPAD_ACPI is not set +# CONFIG_SENSORS_HDAPS is not set +# CONFIG_INTEL_MENLOW is not set +# CONFIG_ACPI_WMI is not set +# CONFIG_TOPSTAR_LAPTOP is not set +# CONFIG_TOSHIBA_BT_RFKILL is not set +# CONFIG_ACPI_CMPC is not set +# CONFIG_INTEL_IPS is not set +# CONFIG_IBM_RTL is not set +# CONFIG_XO15_EBOOK is not set +# CONFIG_SAMSUNG_Q10 is not set +# CONFIG_APPLE_GMUX is not set + +# +# Hardware Spinlock drivers +# +CONFIG_CLKEVT_I8253=y +CONFIG_I8253_LOCK=y +CONFIG_CLKBLD_I8253=y +CONFIG_IOMMU_SUPPORT=y +# CONFIG_AMD_IOMMU is not set +# CONFIG_INTEL_IOMMU is not set +# CONFIG_IRQ_REMAP is not set + +# +# Remoteproc drivers (EXPERIMENTAL) +# + +# +# Rpmsg drivers (EXPERIMENTAL) +# +# CONFIG_VIRT_DRIVERS is not set +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_VME_BUS is not set + +# +# Firmware Drivers +# +# CONFIG_EDD is not set +CONFIG_FIRMWARE_MEMMAP=y +# CONFIG_DELL_RBU is not set +# CONFIG_DCDBAS is not set +CONFIG_DMIID=y +# CONFIG_DMI_SYSFS is not set +# CONFIG_ISCSI_IBFT_FIND is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +CONFIG_EXT2_FS=y +# CONFIG_EXT2_FS_XATTR is not set +# CONFIG_EXT2_FS_XIP is not set +CONFIG_EXT3_FS=y +# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set +# CONFIG_EXT3_FS_XATTR is not set +# CONFIG_EXT4_FS is not set +CONFIG_JBD=y +CONFIG_REISERFS_FS=y +# CONFIG_REISERFS_CHECK is not set +# CONFIG_REISERFS_PROC_INFO is not set +# CONFIG_REISERFS_FS_XATTR is not set +# CONFIG_JFS_FS is not set +# CONFIG_XFS_FS is not set +# CONFIG_GFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +CONFIG_FS_POSIX_ACL=y +CONFIG_FILE_LOCKING=y +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +# CONFIG_FANOTIFY is not set +CONFIG_QUOTA=y +# CONFIG_QUOTA_NETLINK_INTERFACE is not set +CONFIG_PRINT_QUOTA_WARNING=y +# CONFIG_QUOTA_DEBUG is not set +# CONFIG_QFMT_V1 is not set +# CONFIG_QFMT_V2 is not set +CONFIG_QUOTACTL=y +CONFIG_AUTOFS4_FS=y +# CONFIG_FUSE_FS is not set + +# +# Caches +# +# CONFIG_FSCACHE is not set + +# +# CD-ROM/DVD Filesystems +# +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +# CONFIG_ZISOFS is not set +# CONFIG_UDF_FS is not set + +# +# DOS/FAT/NT Filesystems +# +# CONFIG_MSDOS_FS is not set +# CONFIG_VFAT_FS is not set +# CONFIG_NTFS_FS is not set + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +# CONFIG_TMPFS_POSIX_ACL is not set +# CONFIG_TMPFS_XATTR is not set +# CONFIG_HUGETLBFS is not set +# CONFIG_HUGETLB_PAGE is not set +# CONFIG_CONFIGFS_FS is not set +CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ADFS_FS is not set +# CONFIG_AFFS_FS is not set +# CONFIG_HFS_FS is not set +# CONFIG_HFSPLUS_FS is not set +# CONFIG_BEFS_FS is not set +# CONFIG_BFS_FS is not set +# CONFIG_EFS_FS is not set +# CONFIG_LOGFS is not set +# CONFIG_CRAMFS is not set +# CONFIG_SQUASHFS is not set +# CONFIG_VXFS_FS is not set +# CONFIG_MINIX_FS is not set +# CONFIG_OMFS_FS is not set +# CONFIG_HPFS_FS is not set +# CONFIG_QNX4FS_FS is not set +# CONFIG_QNX6FS_FS is not set +# CONFIG_ROMFS_FS is not set +# CONFIG_PSTORE is not set +# CONFIG_SYSV_FS is not set +# CONFIG_UFS_FS is not set +CONFIG_NETWORK_FILESYSTEMS=y +# CONFIG_NFS_FS is not set +# CONFIG_NFSD is not set +# CONFIG_CEPH_FS is not set +# CONFIG_CIFS is not set +# CONFIG_NCP_FS is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_9P_FS=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="iso8859-1" +# CONFIG_NLS_CODEPAGE_437 is not set +# CONFIG_NLS_CODEPAGE_737 is not set +# CONFIG_NLS_CODEPAGE_775 is not set +# CONFIG_NLS_CODEPAGE_850 is not set +# CONFIG_NLS_CODEPAGE_852 is not set +# CONFIG_NLS_CODEPAGE_855 is not set +# CONFIG_NLS_CODEPAGE_857 is not set +# CONFIG_NLS_CODEPAGE_860 is not set +# CONFIG_NLS_CODEPAGE_861 is not set +# CONFIG_NLS_CODEPAGE_862 is not set +# CONFIG_NLS_CODEPAGE_863 is not set +# CONFIG_NLS_CODEPAGE_864 is not set +# CONFIG_NLS_CODEPAGE_865 is not set +# CONFIG_NLS_CODEPAGE_866 is not set +# CONFIG_NLS_CODEPAGE_869 is not set +# CONFIG_NLS_CODEPAGE_936 is not set +# CONFIG_NLS_CODEPAGE_950 is not set +# CONFIG_NLS_CODEPAGE_932 is not set +# CONFIG_NLS_CODEPAGE_949 is not set +# CONFIG_NLS_CODEPAGE_874 is not set +# CONFIG_NLS_ISO8859_8 is not set +# CONFIG_NLS_CODEPAGE_1250 is not set +# CONFIG_NLS_CODEPAGE_1251 is not set +# CONFIG_NLS_ASCII is not set +# CONFIG_NLS_ISO8859_1 is not set +# CONFIG_NLS_ISO8859_2 is not set +# CONFIG_NLS_ISO8859_3 is not set +# CONFIG_NLS_ISO8859_4 is not set +# CONFIG_NLS_ISO8859_5 is not set +# CONFIG_NLS_ISO8859_6 is not set +# CONFIG_NLS_ISO8859_7 is not set +# CONFIG_NLS_ISO8859_9 is not set +# CONFIG_NLS_ISO8859_13 is not set +# CONFIG_NLS_ISO8859_14 is not set +# CONFIG_NLS_ISO8859_15 is not set +# CONFIG_NLS_KOI8_R is not set +# CONFIG_NLS_KOI8_U is not set +# CONFIG_NLS_MAC_ROMAN is not set +# CONFIG_NLS_MAC_CELTIC is not set +# CONFIG_NLS_MAC_CENTEURO is not set +# CONFIG_NLS_MAC_CROATIAN is not set +# CONFIG_NLS_MAC_CYRILLIC is not set +# CONFIG_NLS_MAC_GAELIC is not set +# CONFIG_NLS_MAC_GREEK is not set +# CONFIG_NLS_MAC_ICELAND is not set +# CONFIG_NLS_MAC_INUIT is not set +# CONFIG_NLS_MAC_ROMANIAN is not set +# CONFIG_NLS_MAC_TURKISH is not set +# CONFIG_NLS_UTF8 is not set + +# +# Kernel hacking +# +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +# CONFIG_PRINTK_TIME is not set +CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4 +CONFIG_ENABLE_WARN_DEPRECATED=y +CONFIG_ENABLE_MUST_CHECK=y +CONFIG_FRAME_WARN=1024 +# CONFIG_MAGIC_SYSRQ is not set +# CONFIG_STRIP_ASM_SYMS is not set +# CONFIG_READABLE_ASM is not set +# CONFIG_UNUSED_SYMBOLS is not set +# CONFIG_DEBUG_FS is not set +# CONFIG_HEADERS_CHECK is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_DEBUG_KERNEL=y +# CONFIG_DEBUG_SHIRQ is not set +# CONFIG_LOCKUP_DETECTOR is not set +# CONFIG_HARDLOCKUP_DETECTOR is not set +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 +# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set +CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 +# CONFIG_SCHED_DEBUG is not set +# CONFIG_SCHEDSTATS is not set +# CONFIG_TIMER_STATS is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_DEBUG_SLAB is not set +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_RT_MUTEX_TESTER is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_PROVE_LOCKING is not set +# CONFIG_SPARSE_RCU_POINTER is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_DEBUG_KOBJECT is not set +CONFIG_DEBUG_BUGVERBOSE=y +CONFIG_DEBUG_INFO=y +# CONFIG_DEBUG_INFO_REDUCED is not set +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_VIRTUAL is not set +# CONFIG_DEBUG_WRITECOUNT is not set +CONFIG_DEBUG_MEMORY_INIT=y +# CONFIG_DEBUG_LIST is not set +# CONFIG_TEST_LIST_SORT is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +# CONFIG_DEBUG_CREDENTIALS is not set +CONFIG_ARCH_WANT_FRAME_POINTERS=y +CONFIG_FRAME_POINTER=y +# CONFIG_BOOT_PRINTK_DELAY is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_TRACE is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# CONFIG_FAULT_INJECTION is not set +# CONFIG_LATENCYTOP is not set +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_USER_STACKTRACE_SUPPORT=y +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y +CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACING_SUPPORT=y +CONFIG_FTRACE=y +# CONFIG_FUNCTION_TRACER is not set +# CONFIG_IRQSOFF_TRACER is not set +# CONFIG_SCHED_TRACER is not set +# CONFIG_ENABLE_DEFAULT_TRACERS is not set +# CONFIG_FTRACE_SYSCALLS is not set +CONFIG_BRANCH_PROFILE_NONE=y +# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set +# CONFIG_PROFILE_ALL_BRANCHES is not set +# CONFIG_STACK_TRACER is not set +# CONFIG_BLK_DEV_IO_TRACE is not set +# CONFIG_UPROBE_EVENT is not set +# CONFIG_PROBE_EVENTS is not set +# CONFIG_MMIOTRACE is not set +# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_SAMPLES is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_HAVE_ARCH_KMEMCHECK=y +# CONFIG_TEST_KSTRTOX is not set +# CONFIG_STRICT_DEVMEM is not set +CONFIG_X86_VERBOSE_BOOTUP=y +CONFIG_EARLY_PRINTK=y +# CONFIG_EARLY_PRINTK_DBGP is not set +# CONFIG_DEBUG_STACKOVERFLOW is not set +# CONFIG_X86_PTDUMP is not set +CONFIG_DEBUG_RODATA=y +CONFIG_DEBUG_RODATA_TEST=y +# CONFIG_IOMMU_DEBUG is not set +# CONFIG_IOMMU_STRESS is not set +CONFIG_HAVE_MMIOTRACE_SUPPORT=y +CONFIG_IO_DELAY_TYPE_0X80=0 +CONFIG_IO_DELAY_TYPE_0XED=1 +CONFIG_IO_DELAY_TYPE_UDELAY=2 +CONFIG_IO_DELAY_TYPE_NONE=3 +CONFIG_IO_DELAY_0X80=y +# CONFIG_IO_DELAY_0XED is not set +# CONFIG_IO_DELAY_UDELAY is not set +# CONFIG_IO_DELAY_NONE is not set +CONFIG_DEFAULT_IO_DELAY_TYPE=0 +# CONFIG_CPA_DEBUG is not set +# CONFIG_OPTIMIZE_INLINING is not set +# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set +# CONFIG_DEBUG_NMI_SELFTEST is not set + +# +# Security options +# +# CONFIG_KEYS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +# CONFIG_SECURITYFS is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_DEFAULT_SECURITY="" +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_BLKCIPHER=y +CONFIG_CRYPTO_BLKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_PCOMP=y +CONFIG_CRYPTO_PCOMP2=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +CONFIG_CRYPTO_USER=y +CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +CONFIG_CRYPTO_GF128MUL=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_WORKQUEUE=y +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_AUTHENC=y + +# +# Authenticated Encryption with Associated Data +# +CONFIG_CRYPTO_CCM=y +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_SEQIV=y + +# +# Block modes +# +CONFIG_CRYPTO_CBC=y +CONFIG_CRYPTO_CTR=y +# CONFIG_CRYPTO_CTS is not set +CONFIG_CRYPTO_ECB=y +CONFIG_CRYPTO_LRW=y +CONFIG_CRYPTO_PCBC=y +CONFIG_CRYPTO_XTS=y + +# +# Hash modes +# +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_XCBC=y +# CONFIG_CRYPTO_VMAC is not set + +# +# Digest +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_CRC32C_INTEL is not set +CONFIG_CRYPTO_GHASH=y +CONFIG_CRYPTO_MD4=y +CONFIG_CRYPTO_MD5=y +CONFIG_CRYPTO_MICHAEL_MIC=y +CONFIG_CRYPTO_RMD128=y +CONFIG_CRYPTO_RMD160=y +CONFIG_CRYPTO_RMD256=y +CONFIG_CRYPTO_RMD320=y +CONFIG_CRYPTO_SHA1=y +# CONFIG_CRYPTO_SHA1_SSSE3 is not set +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y +CONFIG_CRYPTO_TGR192=y +CONFIG_CRYPTO_WP512=y +# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set + +# +# Ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_X86_64 is not set +# CONFIG_CRYPTO_AES_NI_INTEL is not set +CONFIG_CRYPTO_ANUBIS=y +CONFIG_CRYPTO_ARC4=y +CONFIG_CRYPTO_BLOWFISH=y +CONFIG_CRYPTO_BLOWFISH_COMMON=y +# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set +CONFIG_CRYPTO_CAMELLIA=y +# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set +CONFIG_CRYPTO_CAST5=y +CONFIG_CRYPTO_CAST6=y +CONFIG_CRYPTO_DES=y +CONFIG_CRYPTO_FCRYPT=y +CONFIG_CRYPTO_KHAZAD=y +CONFIG_CRYPTO_SALSA20=y +# CONFIG_CRYPTO_SALSA20_X86_64 is not set +CONFIG_CRYPTO_SEED=y +CONFIG_CRYPTO_SERPENT=y +# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set +CONFIG_CRYPTO_TEA=y +CONFIG_CRYPTO_TWOFISH=y +CONFIG_CRYPTO_TWOFISH_COMMON=y +# CONFIG_CRYPTO_TWOFISH_X86_64 is not set +# CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_ZLIB=y +# CONFIG_CRYPTO_LZO is not set + +# +# Random Number Generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y +# CONFIG_CRYPTO_HW is not set +CONFIG_HAVE_KVM=y +CONFIG_VIRTUALIZATION=y +# CONFIG_KVM is not set +# CONFIG_VHOST_NET is not set +# CONFIG_BINARY_PRINTF is not set + +# +# Library routines +# +CONFIG_BITREVERSE=y +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +CONFIG_GENERIC_FIND_FIRST_BIT=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IOMAP=y +CONFIG_GENERIC_IO=y +CONFIG_CRC_CCITT=y +CONFIG_CRC16=y +# CONFIG_CRC_T10DIF is not set +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +CONFIG_CRC7=y +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +# CONFIG_XZ_DEC is not set +# CONFIG_XZ_DEC_BCJ is not set +CONFIG_TEXTSEARCH=y +CONFIG_TEXTSEARCH_KMP=y +CONFIG_TEXTSEARCH_BM=y +CONFIG_TEXTSEARCH_FSM=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT=y +CONFIG_HAS_DMA=y +CONFIG_DQL=y +CONFIG_NLATTR=y +# CONFIG_AVERAGE is not set +# CONFIG_CORDIC is not set +# CONFIG_DDR is not set diff --git a/testing/config/kernel/config-3.6 b/testing/config/kernel/config-3.6 new file mode 100644 index 000000000..8755bf772 --- /dev/null +++ b/testing/config/kernel/config-3.6 @@ -0,0 +1,1830 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/x86_64 3.6.11 Kernel Configuration +# +CONFIG_64BIT=y +# CONFIG_X86_32 is not set +CONFIG_X86_64=y +CONFIG_X86=y +CONFIG_INSTRUCTION_DECODER=y +CONFIG_OUTPUT_FORMAT="elf64-x86-64" +CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig" +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_HAVE_LATENCYTOP_SUPPORT=y +CONFIG_MMU=y +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_NEED_SG_DMA_LENGTH=y +CONFIG_GENERIC_ISA_DMA=y +CONFIG_GENERIC_BUG=y +CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_ARCH_MAY_HAVE_PC_FDC=y +# CONFIG_RWSEM_GENERIC_SPINLOCK is not set +CONFIG_RWSEM_XCHGADD_ALGORITHM=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HAS_DEFAULT_IDLE=y +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_ARCH_HAS_CPU_AUTOPROBE=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_ZONE_DMA32=y +CONFIG_AUDIT_ARCH=y +CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11" +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" +CONFIG_HAVE_IRQ_WORK=y +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_EXTABLE_SORT=y + +# +# General setup +# +CONFIG_EXPERIMENTAL=y +CONFIG_BROKEN_ON_SMP=y +CONFIG_INIT_ENV_ARG_LIMIT=32 +CONFIG_CROSS_COMPILE="" +CONFIG_LOCALVERSION="" +CONFIG_LOCALVERSION_AUTO=y +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_BZIP2=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_BZIP2 is not set +# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_XZ is not set +# CONFIG_KERNEL_LZO is not set +CONFIG_DEFAULT_HOSTNAME="(none)" +CONFIG_SWAP=y +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y +CONFIG_BSD_PROCESS_ACCT=y +# CONFIG_BSD_PROCESS_ACCT_V3 is not set +# CONFIG_FHANDLE is not set +# CONFIG_TASKSTATS is not set +# CONFIG_AUDIT is not set +CONFIG_HAVE_GENERIC_HARDIRQS=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_HARDIRQS=y +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +CONFIG_CLOCKSOURCE_WATCHDOG=y +CONFIG_ARCH_CLOCKSOURCE_DATA=y +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_GENERIC_CLOCKEVENTS_BUILD=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CMOS_UPDATE=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y + +# +# RCU Subsystem +# +CONFIG_TINY_RCU=y +# CONFIG_PREEMPT_RCU is not set +# CONFIG_TREE_RCU_TRACE is not set +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_LOG_BUF_SHIFT=14 +CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y +# CONFIG_CGROUPS is not set +# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_NAMESPACES=y +# CONFIG_UTS_NS is not set +# CONFIG_IPC_NS is not set +# CONFIG_PID_NS is not set +# CONFIG_NET_NS is not set +# CONFIG_SCHED_AUTOGROUP is not set +# CONFIG_SYSFS_DEPRECATED is not set +# CONFIG_RELAY is not set +# CONFIG_BLK_DEV_INITRD is not set +CONFIG_CC_OPTIMIZE_FOR_SIZE=y +CONFIG_SYSCTL=y +CONFIG_ANON_INODES=y +# CONFIG_EXPERT is not set +# CONFIG_SYSCTL_SYSCALL is not set +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_ALL is not set +CONFIG_HOTPLUG=y +CONFIG_PRINTK=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_PCSPKR_PLATFORM=y +CONFIG_HAVE_PCSPKR_PLATFORM=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +CONFIG_VM_EVENT_COUNTERS=y +CONFIG_PCI_QUIRKS=y +CONFIG_COMPAT_BRK=y +CONFIG_SLAB=y +# CONFIG_SLUB is not set +# CONFIG_PROFILING is not set +CONFIG_HAVE_OPROFILE=y +CONFIG_OPROFILE_NMI_TIMER=y +# CONFIG_JUMP_LABEL is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_OPTPROBES=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_ATTRS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_DMA_API_DEBUG=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y +CONFIG_HAVE_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_PERF_EVENTS_NMI=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y + +# +# GCOV-based kernel profiling +# +# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set +CONFIG_SLABINFO=y +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +# CONFIG_MODULES is not set +CONFIG_BLOCK=y +# CONFIG_BLK_DEV_BSG is not set +# CONFIG_BLK_DEV_BSGLIB is not set +# CONFIG_BLK_DEV_INTEGRITY is not set + +# +# Partition Types +# +# CONFIG_PARTITION_ADVANCED is not set +CONFIG_MSDOS_PARTITION=y + +# +# IO Schedulers +# +CONFIG_IOSCHED_NOOP=y +CONFIG_IOSCHED_DEADLINE=y +CONFIG_IOSCHED_CFQ=y +# CONFIG_DEFAULT_DEADLINE is not set +CONFIG_DEFAULT_CFQ=y +# CONFIG_DEFAULT_NOOP is not set +CONFIG_DEFAULT_IOSCHED="cfq" +# CONFIG_INLINE_SPIN_TRYLOCK is not set +# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK is not set +# CONFIG_INLINE_SPIN_LOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK_IRQ is not set +# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set +# CONFIG_INLINE_SPIN_UNLOCK_BH is not set +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_READ_TRYLOCK is not set +# CONFIG_INLINE_READ_LOCK is not set +# CONFIG_INLINE_READ_LOCK_BH is not set +# CONFIG_INLINE_READ_LOCK_IRQ is not set +# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set +CONFIG_INLINE_READ_UNLOCK=y +# CONFIG_INLINE_READ_UNLOCK_BH is not set +CONFIG_INLINE_READ_UNLOCK_IRQ=y +# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_WRITE_TRYLOCK is not set +# CONFIG_INLINE_WRITE_LOCK is not set +# CONFIG_INLINE_WRITE_LOCK_BH is not set +# CONFIG_INLINE_WRITE_LOCK_IRQ is not set +# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set +CONFIG_INLINE_WRITE_UNLOCK=y +# CONFIG_INLINE_WRITE_UNLOCK_BH is not set +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set +# CONFIG_MUTEX_SPIN_ON_OWNER is not set +CONFIG_FREEZER=y + +# +# Processor type and features +# +CONFIG_ZONE_DMA=y +# CONFIG_SMP is not set +CONFIG_X86_MPPARSE=y +CONFIG_X86_EXTENDED_PLATFORM=y +CONFIG_SCHED_OMIT_FRAME_POINTER=y +CONFIG_PARAVIRT_GUEST=y +# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set +# CONFIG_XEN is not set +# CONFIG_XEN_PRIVILEGED_GUEST is not set +CONFIG_KVM_CLOCK=y +CONFIG_KVM_GUEST=y +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_CLOCK=y +# CONFIG_PARAVIRT_DEBUG is not set +CONFIG_NO_BOOTMEM=y +# CONFIG_MEMTEST is not set +# CONFIG_MK8 is not set +# CONFIG_MPSC is not set +CONFIG_MCORE2=y +# CONFIG_MATOM is not set +# CONFIG_GENERIC_CPU is not set +CONFIG_X86_INTERNODE_CACHE_SHIFT=6 +CONFIG_X86_CMPXCHG=y +CONFIG_X86_L1_CACHE_SHIFT=6 +CONFIG_X86_XADD=y +CONFIG_X86_WP_WORKS_OK=y +CONFIG_X86_INTEL_USERCOPY=y +CONFIG_X86_USE_PPRO_CHECKSUM=y +CONFIG_X86_P6_NOP=y +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=64 +CONFIG_X86_DEBUGCTLMSR=y +CONFIG_CPU_SUP_INTEL=y +CONFIG_CPU_SUP_AMD=y +CONFIG_CPU_SUP_CENTAUR=y +CONFIG_HPET_TIMER=y +CONFIG_DMI=y +CONFIG_GART_IOMMU=y +# CONFIG_CALGARY_IOMMU is not set +CONFIG_SWIOTLB=y +CONFIG_IOMMU_HELPER=y +CONFIG_NR_CPUS=1 +# CONFIG_IRQ_TIME_ACCOUNTING is not set +CONFIG_PREEMPT_NONE=y +# CONFIG_PREEMPT_VOLUNTARY is not set +# CONFIG_PREEMPT is not set +CONFIG_X86_LOCAL_APIC=y +CONFIG_X86_IO_APIC=y +# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set +# CONFIG_X86_MCE is not set +# CONFIG_I8K is not set +# CONFIG_MICROCODE is not set +# CONFIG_X86_MSR is not set +# CONFIG_X86_CPUID is not set +CONFIG_ARCH_PHYS_ADDR_T_64BIT=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +CONFIG_DIRECT_GBPAGES=y +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_DEFAULT=y +CONFIG_ARCH_SELECT_MEMORY_MODEL=y +CONFIG_ARCH_MEMORY_PROBE=y +CONFIG_ARCH_PROC_KCORE_TEXT=y +CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_SPARSEMEM_MANUAL=y +CONFIG_SPARSEMEM=y +CONFIG_HAVE_MEMORY_PRESENT=y +CONFIG_SPARSEMEM_EXTREME=y +CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y +CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y +CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_HAVE_MEMBLOCK=y +CONFIG_HAVE_MEMBLOCK_NODE_MAP=y +CONFIG_ARCH_DISCARD_MEMBLOCK=y +CONFIG_MEMORY_ISOLATION=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTPLUG_SPARSE=y +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_PAGEFLAGS_EXTENDED=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +# CONFIG_COMPACTION is not set +CONFIG_MIGRATION=y +CONFIG_PHYS_ADDR_T_64BIT=y +CONFIG_ZONE_DMA_FLAG=1 +CONFIG_BOUNCE=y +CONFIG_VIRT_TO_BUS=y +# CONFIG_KSM is not set +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +# CONFIG_TRANSPARENT_HUGEPAGE is not set +CONFIG_CROSS_MEMORY_ATTACH=y +CONFIG_NEED_PER_CPU_KM=y +# CONFIG_CLEANCACHE is not set +# CONFIG_FRONTSWAP is not set +# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set +CONFIG_X86_RESERVE_LOW=64 +CONFIG_MTRR=y +CONFIG_MTRR_SANITIZER=y +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 +CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 +CONFIG_X86_PAT=y +CONFIG_ARCH_USES_PG_UNCACHED=y +CONFIG_ARCH_RANDOM=y +# CONFIG_EFI is not set +CONFIG_SECCOMP=y +# CONFIG_CC_STACKPROTECTOR is not set +# CONFIG_HZ_100 is not set +CONFIG_HZ_250=y +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 +CONFIG_SCHED_HRTICK=y +# CONFIG_KEXEC is not set +# CONFIG_CRASH_DUMP is not set +CONFIG_PHYSICAL_START=0x1000000 +CONFIG_RELOCATABLE=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +# CONFIG_CMDLINE_BOOL is not set +CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y +CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y + +# +# Power management and ACPI options +# +CONFIG_SUSPEND=y +CONFIG_SUSPEND_FREEZER=y +# CONFIG_HIBERNATION is not set +CONFIG_PM_SLEEP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +# CONFIG_PM_RUNTIME is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_ACPI=y +CONFIG_ACPI_SLEEP=y +# CONFIG_ACPI_PROCFS is not set +# CONFIG_ACPI_PROCFS_POWER is not set +# CONFIG_ACPI_EC_DEBUGFS is not set +CONFIG_ACPI_PROC_EVENT=y +CONFIG_ACPI_AC=y +CONFIG_ACPI_BATTERY=y +CONFIG_ACPI_BUTTON=y +CONFIG_ACPI_FAN=y +# CONFIG_ACPI_DOCK is not set +CONFIG_ACPI_PROCESSOR=y +# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set +CONFIG_ACPI_THERMAL=y +# CONFIG_ACPI_CUSTOM_DSDT is not set +CONFIG_ACPI_BLACKLIST_YEAR=0 +# CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_PCI_SLOT is not set +CONFIG_X86_PM_TIMER=y +# CONFIG_ACPI_CONTAINER is not set +# CONFIG_ACPI_HOTPLUG_MEMORY is not set +# CONFIG_ACPI_SBS is not set +# CONFIG_ACPI_HED is not set +# CONFIG_ACPI_BGRT is not set +# CONFIG_ACPI_APEI is not set +# CONFIG_SFI is not set + +# +# CPU Frequency scaling +# +# CONFIG_CPU_FREQ is not set +CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_GOV_LADDER=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set +# CONFIG_INTEL_IDLE is not set + +# +# Memory power savings +# +# CONFIG_I7300_IDLE is not set + +# +# Bus options (PCI etc.) +# +CONFIG_PCI=y +CONFIG_PCI_DIRECT=y +# CONFIG_PCI_MMCONFIG is not set +CONFIG_PCI_DOMAINS=y +# CONFIG_PCI_CNB20LE_QUIRK is not set +# CONFIG_PCIEPORTBUS is not set +CONFIG_ARCH_SUPPORTS_MSI=y +CONFIG_PCI_MSI=y +# CONFIG_PCI_DEBUG is not set +# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set +# CONFIG_PCI_STUB is not set +CONFIG_HT_IRQ=y +# CONFIG_PCI_IOV is not set +# CONFIG_PCI_PRI is not set +# CONFIG_PCI_PASID is not set +# CONFIG_PCI_IOAPIC is not set +CONFIG_PCI_LABEL=y +CONFIG_ISA_DMA_API=y +CONFIG_AMD_NB=y +# CONFIG_PCCARD is not set +# CONFIG_HOTPLUG_PCI is not set +# CONFIG_RAPIDIO is not set + +# +# Executable file formats / Emulations +# +CONFIG_BINFMT_ELF=y +CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +# CONFIG_HAVE_AOUT is not set +# CONFIG_BINFMT_MISC is not set +# CONFIG_IA32_EMULATION is not set +# CONFIG_COMPAT_FOR_U64_ALIGNMENT is not set +CONFIG_HAVE_TEXT_POKE_SMP=y +CONFIG_X86_DEV_DMA_OPS=y +CONFIG_NET=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_UNIX=y +# CONFIG_UNIX_DIAG is not set +CONFIG_XFRM=y +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_USER=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_IPCOMP=y +CONFIG_NET_KEY=y +CONFIG_NET_KEY_MIGRATE=y +CONFIG_INET=y +# CONFIG_IP_MULTICAST is not set +CONFIG_IP_ADVANCED_ROUTER=y +# CONFIG_IP_FIB_TRIE_STATS is not set +CONFIG_IP_MULTIPLE_TABLES=y +# CONFIG_IP_ROUTE_MULTIPATH is not set +# CONFIG_IP_ROUTE_VERBOSE is not set +CONFIG_IP_ROUTE_CLASSID=y +# CONFIG_IP_PNP is not set +# CONFIG_NET_IPIP is not set +# CONFIG_NET_IPGRE_DEMUX is not set +# CONFIG_ARPD is not set +# CONFIG_SYN_COOKIES is not set +# CONFIG_NET_IPVTI is not set +CONFIG_INET_AH=y +CONFIG_INET_ESP=y +CONFIG_INET_IPCOMP=y +CONFIG_INET_XFRM_TUNNEL=y +CONFIG_INET_TUNNEL=y +CONFIG_INET_XFRM_MODE_TRANSPORT=y +CONFIG_INET_XFRM_MODE_TUNNEL=y +CONFIG_INET_XFRM_MODE_BEET=y +# CONFIG_INET_LRO is not set +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +# CONFIG_INET_UDP_DIAG is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +CONFIG_IPV6=y +# CONFIG_IPV6_PRIVACY is not set +# CONFIG_IPV6_ROUTER_PREF is not set +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_INET6_AH=y +CONFIG_INET6_ESP=y +CONFIG_INET6_IPCOMP=y +CONFIG_IPV6_MIP6=y +CONFIG_INET6_XFRM_TUNNEL=y +CONFIG_INET6_TUNNEL=y +CONFIG_INET6_XFRM_MODE_TRANSPORT=y +CONFIG_INET6_XFRM_MODE_TUNNEL=y +CONFIG_INET6_XFRM_MODE_BEET=y +# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set +# CONFIG_IPV6_SIT is not set +# CONFIG_IPV6_TUNNEL is not set +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_SUBTREES=y +# CONFIG_IPV6_MROUTE is not set +# CONFIG_NETWORK_SECMARK is not set +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +CONFIG_NETFILTER=y +# CONFIG_NETFILTER_DEBUG is not set +CONFIG_NETFILTER_ADVANCED=y + +# +# Core Netfilter Configuration +# +CONFIG_NETFILTER_NETLINK=y +# CONFIG_NETFILTER_NETLINK_ACCT is not set +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_CONNTRACK_MARK=y +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_EVENTS=y +# CONFIG_NF_CONNTRACK_TIMEOUT is not set +# CONFIG_NF_CONNTRACK_TIMESTAMP is not set +# CONFIG_NF_CT_PROTO_DCCP is not set +# CONFIG_NF_CT_PROTO_SCTP is not set +CONFIG_NF_CT_PROTO_UDPLITE=y +# CONFIG_NF_CONNTRACK_AMANDA is not set +# CONFIG_NF_CONNTRACK_FTP is not set +# CONFIG_NF_CONNTRACK_H323 is not set +# CONFIG_NF_CONNTRACK_IRC is not set +# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set +# CONFIG_NF_CONNTRACK_SNMP is not set +# CONFIG_NF_CONNTRACK_PPTP is not set +CONFIG_NF_CONNTRACK_SANE=y +# CONFIG_NF_CONNTRACK_SIP is not set +# CONFIG_NF_CONNTRACK_TFTP is not set +CONFIG_NF_CT_NETLINK=y +# CONFIG_NF_CT_NETLINK_TIMEOUT is not set +# CONFIG_NETFILTER_NETLINK_QUEUE_CT is not set +# CONFIG_NETFILTER_TPROXY is not set +CONFIG_NETFILTER_XTABLES=y + +# +# Xtables combined modules +# +CONFIG_NETFILTER_XT_MARK=y +CONFIG_NETFILTER_XT_CONNMARK=y +CONFIG_NETFILTER_XT_SET=y + +# +# Xtables targets +# +# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +# CONFIG_NETFILTER_XT_TARGET_CT is not set +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_HL=y +# CONFIG_NETFILTER_XT_TARGET_HMARK is not set +# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_NOTRACK=y +# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set +# CONFIG_NETFILTER_XT_TARGET_TEE is not set +CONFIG_NETFILTER_XT_TARGET_TRACE=y +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set + +# +# Xtables matches +# +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +# CONFIG_NETFILTER_XT_MATCH_CPU is not set +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ECN=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_HL=y +# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set +# CONFIG_NETFILTER_XT_MATCH_OSF is not set +# CONFIG_NETFILTER_XT_MATCH_OWNER is not set +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set +CONFIG_NETFILTER_XT_MATCH_REALM=y +# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +# CONFIG_NETFILTER_XT_MATCH_TIME is not set +CONFIG_NETFILTER_XT_MATCH_U32=y +CONFIG_IP_SET=y +CONFIG_IP_SET_MAX=256 +CONFIG_IP_SET_BITMAP_IP=y +CONFIG_IP_SET_BITMAP_IPMAC=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETPORT=y +# CONFIG_IP_SET_HASH_NETIFACE is not set +CONFIG_IP_SET_LIST_SET=y +# CONFIG_IP_VS is not set + +# +# IP: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_CONNTRACK_IPV4=y +CONFIG_NF_CONNTRACK_PROC_COMPAT=y +CONFIG_IP_NF_QUEUE=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +# CONFIG_IP_NF_MATCH_RPFILTER is not set +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_TARGET_REJECT=y +CONFIG_IP_NF_TARGET_ULOG=y +CONFIG_NF_NAT=y +CONFIG_NF_NAT_NEEDED=y +CONFIG_IP_NF_TARGET_MASQUERADE=y +CONFIG_IP_NF_TARGET_NETMAP=y +CONFIG_IP_NF_TARGET_REDIRECT=y +CONFIG_NF_NAT_PROTO_UDPLITE=y +# CONFIG_NF_NAT_FTP is not set +# CONFIG_NF_NAT_IRC is not set +# CONFIG_NF_NAT_TFTP is not set +# CONFIG_NF_NAT_AMANDA is not set +# CONFIG_NF_NAT_PPTP is not set +# CONFIG_NF_NAT_H323 is not set +# CONFIG_NF_NAT_SIP is not set +CONFIG_IP_NF_MANGLE=y +CONFIG_IP_NF_TARGET_CLUSTERIP=y +CONFIG_IP_NF_TARGET_ECN=y +CONFIG_IP_NF_TARGET_TTL=y +CONFIG_IP_NF_RAW=y +CONFIG_IP_NF_ARPTABLES=y +CONFIG_IP_NF_ARPFILTER=y +CONFIG_IP_NF_ARP_MANGLE=y + +# +# IPv6: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV6=y +CONFIG_NF_CONNTRACK_IPV6=y +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +# CONFIG_IP6_NF_MATCH_RPFILTER is not set +CONFIG_IP6_NF_MATCH_RT=y +CONFIG_IP6_NF_TARGET_HL=y +CONFIG_IP6_NF_FILTER=y +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_RAW=y +# CONFIG_IP_DCCP is not set +# CONFIG_IP_SCTP is not set +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +CONFIG_L2TP=y +# CONFIG_L2TP_V3 is not set +# CONFIG_BRIDGE is not set +# CONFIG_NET_DSA is not set +# CONFIG_VLAN_8021Q is not set +# CONFIG_DECNET is not set +# CONFIG_LLC2 is not set +# CONFIG_IPX is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_WAN_ROUTER is not set +# CONFIG_PHONET is not set +# CONFIG_IEEE802154 is not set +# CONFIG_NET_SCHED is not set +# CONFIG_DCB is not set +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +CONFIG_BQL=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_IRDA is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +CONFIG_FIB_RULES=y +CONFIG_WIRELESS=y +# CONFIG_CFG80211 is not set +# CONFIG_LIB80211 is not set + +# +# CFG80211 needs to be enabled for MAC80211 +# +# CONFIG_WIMAX is not set +# CONFIG_RFKILL is not set +CONFIG_NET_9P=y +CONFIG_NET_9P_VIRTIO=y +# CONFIG_NET_9P_DEBUG is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +CONFIG_HAVE_BPF_JIT=y + +# +# Device Drivers +# + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +# CONFIG_DEVTMPFS is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y +CONFIG_FW_LOADER=y +CONFIG_FIRMWARE_IN_KERNEL=y +CONFIG_EXTRA_FIRMWARE="" +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_SYS_HYPERVISOR is not set +# CONFIG_GENERIC_CPU_DEVICES is not set +# CONFIG_DMA_SHARED_BUFFER is not set +# CONFIG_CONNECTOR is not set +# CONFIG_MTD is not set +# CONFIG_PARPORT is not set +CONFIG_PNP=y +CONFIG_PNP_DEBUG_MESSAGES=y + +# +# Protocols +# +CONFIG_PNPACPI=y +CONFIG_BLK_DEV=y +# CONFIG_BLK_DEV_FD is not set +# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +# CONFIG_BLK_CPQ_DA is not set +# CONFIG_BLK_CPQ_CISS_DA is not set +# CONFIG_BLK_DEV_DAC960 is not set +# CONFIG_BLK_DEV_UMEM is not set +# CONFIG_BLK_DEV_COW_COMMON is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +# CONFIG_BLK_DEV_CRYPTOLOOP is not set + +# +# DRBD disabled because PROC_FS, INET or CONNECTOR not selected +# +CONFIG_BLK_DEV_NBD=y +# CONFIG_BLK_DEV_NVME is not set +# CONFIG_BLK_DEV_SX8 is not set +# CONFIG_BLK_DEV_RAM is not set +# CONFIG_CDROM_PKTCDVD is not set +# CONFIG_ATA_OVER_ETH is not set +CONFIG_VIRTIO_BLK=y +# CONFIG_BLK_DEV_HD is not set +# CONFIG_BLK_DEV_RBD is not set + +# +# Misc devices +# +# CONFIG_SENSORS_LIS3LV02D is not set +# CONFIG_IBM_ASM is not set +# CONFIG_PHANTOM is not set +# CONFIG_INTEL_MID_PTI is not set +# CONFIG_SGI_IOC4 is not set +# CONFIG_TIFM_CORE is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_HP_ILO is not set +# CONFIG_VMWARE_BALLOON is not set +# CONFIG_PCH_PHUB is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_93CX6 is not set +# CONFIG_CB710_CORE is not set + +# +# Texas Instruments shared transport line discipline +# + +# +# Altera FPGA firmware download module +# +CONFIG_HAVE_IDE=y +# CONFIG_IDE is not set + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +# CONFIG_SCSI is not set +# CONFIG_SCSI_DMA is not set +# CONFIG_SCSI_NETLINK is not set +# CONFIG_ATA is not set +# CONFIG_MD is not set +# CONFIG_FUSION is not set + +# +# IEEE 1394 (FireWire) support +# +# CONFIG_FIREWIRE is not set +# CONFIG_FIREWIRE_NOSY is not set +# CONFIG_I2O is not set +# CONFIG_MACINTOSH_DRIVERS is not set +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +CONFIG_DUMMY=y +# CONFIG_EQUALIZER is not set +# CONFIG_MII is not set +# CONFIG_NET_TEAM is not set +# CONFIG_MACVLAN is not set +# CONFIG_NETCONSOLE is not set +# CONFIG_NETPOLL is not set +# CONFIG_NET_POLL_CONTROLLER is not set +CONFIG_TUN=y +# CONFIG_VETH is not set +CONFIG_VIRTIO_NET=y +# CONFIG_ARCNET is not set + +# +# CAIF transport drivers +# +CONFIG_ETHERNET=y +CONFIG_NET_VENDOR_3COM=y +# CONFIG_VORTEX is not set +# CONFIG_TYPHOON is not set +CONFIG_NET_VENDOR_ADAPTEC=y +# CONFIG_ADAPTEC_STARFIRE is not set +CONFIG_NET_VENDOR_ALTEON=y +# CONFIG_ACENIC is not set +CONFIG_NET_VENDOR_AMD=y +# CONFIG_AMD8111_ETH is not set +# CONFIG_PCNET32 is not set +CONFIG_NET_VENDOR_ATHEROS=y +# CONFIG_ATL2 is not set +# CONFIG_ATL1 is not set +# CONFIG_ATL1E is not set +# CONFIG_ATL1C is not set +CONFIG_NET_VENDOR_BROADCOM=y +# CONFIG_B44 is not set +# CONFIG_BNX2 is not set +# CONFIG_CNIC is not set +# CONFIG_TIGON3 is not set +# CONFIG_BNX2X is not set +CONFIG_NET_VENDOR_BROCADE=y +# CONFIG_BNA is not set +# CONFIG_NET_CALXEDA_XGMAC is not set +CONFIG_NET_VENDOR_CHELSIO=y +# CONFIG_CHELSIO_T1 is not set +# CONFIG_CHELSIO_T3 is not set +# CONFIG_CHELSIO_T4 is not set +# CONFIG_CHELSIO_T4VF is not set +CONFIG_NET_VENDOR_CISCO=y +# CONFIG_ENIC is not set +# CONFIG_DNET is not set +CONFIG_NET_VENDOR_DEC=y +# CONFIG_NET_TULIP is not set +CONFIG_NET_VENDOR_DLINK=y +# CONFIG_DL2K is not set +# CONFIG_SUNDANCE is not set +CONFIG_NET_VENDOR_EMULEX=y +# CONFIG_BE2NET is not set +CONFIG_NET_VENDOR_EXAR=y +# CONFIG_S2IO is not set +# CONFIG_VXGE is not set +CONFIG_NET_VENDOR_HP=y +# CONFIG_HP100 is not set +CONFIG_NET_VENDOR_INTEL=y +# CONFIG_E100 is not set +# CONFIG_E1000 is not set +# CONFIG_E1000E is not set +# CONFIG_IGB is not set +# CONFIG_IGBVF is not set +# CONFIG_IXGB is not set +# CONFIG_IXGBE is not set +# CONFIG_IXGBEVF is not set +CONFIG_NET_VENDOR_I825XX=y +# CONFIG_ZNET is not set +# CONFIG_IP1000 is not set +# CONFIG_JME is not set +CONFIG_NET_VENDOR_MARVELL=y +# CONFIG_SKGE is not set +# CONFIG_SKY2 is not set +CONFIG_NET_VENDOR_MELLANOX=y +# CONFIG_MLX4_EN is not set +# CONFIG_MLX4_CORE is not set +CONFIG_NET_VENDOR_MICREL=y +# CONFIG_KS8851_MLL is not set +# CONFIG_KSZ884X_PCI is not set +CONFIG_NET_VENDOR_MYRI=y +# CONFIG_MYRI10GE is not set +# CONFIG_FEALNX is not set +CONFIG_NET_VENDOR_NATSEMI=y +# CONFIG_NATSEMI is not set +# CONFIG_NS83820 is not set +CONFIG_NET_VENDOR_8390=y +# CONFIG_NE2K_PCI is not set +CONFIG_NET_VENDOR_NVIDIA=y +# CONFIG_FORCEDETH is not set +CONFIG_NET_VENDOR_OKI=y +# CONFIG_PCH_GBE is not set +# CONFIG_ETHOC is not set +CONFIG_NET_PACKET_ENGINE=y +# CONFIG_HAMACHI is not set +# CONFIG_YELLOWFIN is not set +CONFIG_NET_VENDOR_QLOGIC=y +# CONFIG_QLA3XXX is not set +# CONFIG_QLCNIC is not set +# CONFIG_QLGE is not set +# CONFIG_NETXEN_NIC is not set +CONFIG_NET_VENDOR_REALTEK=y +# CONFIG_8139CP is not set +# CONFIG_8139TOO is not set +# CONFIG_R8169 is not set +CONFIG_NET_VENDOR_RDC=y +# CONFIG_R6040 is not set +CONFIG_NET_VENDOR_SEEQ=y +# CONFIG_SEEQ8005 is not set +CONFIG_NET_VENDOR_SILAN=y +# CONFIG_SC92031 is not set +CONFIG_NET_VENDOR_SIS=y +# CONFIG_SIS900 is not set +# CONFIG_SIS190 is not set +# CONFIG_SFC is not set +CONFIG_NET_VENDOR_SMSC=y +# CONFIG_EPIC100 is not set +# CONFIG_SMSC9420 is not set +CONFIG_NET_VENDOR_STMICRO=y +# CONFIG_STMMAC_ETH is not set +CONFIG_NET_VENDOR_SUN=y +# CONFIG_HAPPYMEAL is not set +# CONFIG_SUNGEM is not set +# CONFIG_CASSINI is not set +# CONFIG_NIU is not set +CONFIG_NET_VENDOR_TEHUTI=y +# CONFIG_TEHUTI is not set +CONFIG_NET_VENDOR_TI=y +# CONFIG_TLAN is not set +CONFIG_NET_VENDOR_VIA=y +# CONFIG_VIA_RHINE is not set +# CONFIG_VIA_VELOCITY is not set +CONFIG_NET_VENDOR_WIZNET=y +# CONFIG_WIZNET_W5100 is not set +# CONFIG_WIZNET_W5300 is not set +# CONFIG_FDDI is not set +# CONFIG_HIPPI is not set +# CONFIG_NET_SB1000 is not set +# CONFIG_PHYLIB is not set +# CONFIG_PPP is not set +# CONFIG_SLIP is not set +CONFIG_WLAN=y +# CONFIG_AIRO is not set +# CONFIG_ATMEL is not set +# CONFIG_PRISM54 is not set +# CONFIG_HOSTAP is not set +# CONFIG_WL_TI is not set + +# +# Enable WiMAX (Networking options) to see the WiMAX drivers +# +# CONFIG_WAN is not set +# CONFIG_VMXNET3 is not set +# CONFIG_ISDN is not set + +# +# Input device support +# +CONFIG_INPUT=y +# CONFIG_INPUT_FF_MEMLESS is not set +# CONFIG_INPUT_POLLDEV is not set +# CONFIG_INPUT_SPARSEKMAP is not set +# CONFIG_INPUT_MATRIXKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_MOUSEDEV_PSAUX=y +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +# CONFIG_INPUT_JOYDEV is not set +# CONFIG_INPUT_EVDEV is not set +# CONFIG_INPUT_EVBUG is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +CONFIG_KEYBOARD_ATKBD=y +# CONFIG_KEYBOARD_LKKBD is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_OMAP4 is not set +# CONFIG_KEYBOARD_XTKBD is not set +CONFIG_INPUT_MOUSE=y +CONFIG_MOUSE_PS2=y +CONFIG_MOUSE_PS2_ALPS=y +CONFIG_MOUSE_PS2_LOGIPS2PP=y +CONFIG_MOUSE_PS2_SYNAPTICS=y +CONFIG_MOUSE_PS2_LIFEBOOK=y +CONFIG_MOUSE_PS2_TRACKPOINT=y +# CONFIG_MOUSE_PS2_ELANTECH is not set +# CONFIG_MOUSE_PS2_SENTELIC is not set +# CONFIG_MOUSE_PS2_TOUCHKIT is not set +# CONFIG_MOUSE_SERIAL is not set +# CONFIG_MOUSE_APPLETOUCH is not set +# CONFIG_MOUSE_BCM5974 is not set +# CONFIG_MOUSE_VSXXXAA is not set +# CONFIG_MOUSE_SYNAPTICS_USB is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +# CONFIG_INPUT_TOUCHSCREEN is not set +# CONFIG_INPUT_MISC is not set + +# +# Hardware I/O ports +# +CONFIG_SERIO=y +CONFIG_SERIO_I8042=y +CONFIG_SERIO_SERPORT=y +# CONFIG_SERIO_CT82C710 is not set +# CONFIG_SERIO_PCIPS2 is not set +CONFIG_SERIO_LIBPS2=y +# CONFIG_SERIO_RAW is not set +# CONFIG_SERIO_ALTERA_PS2 is not set +# CONFIG_SERIO_PS2MULT is not set +# CONFIG_GAMEPORT is not set + +# +# Character devices +# +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_VT_CONSOLE_SLEEP=y +CONFIG_HW_CONSOLE=y +# CONFIG_VT_HW_CONSOLE_BINDING is not set +CONFIG_UNIX98_PTYS=y +# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set +CONFIG_LEGACY_PTYS=y +CONFIG_LEGACY_PTY_COUNT=256 +# CONFIG_SERIAL_NONSTANDARD is not set +# CONFIG_NOZOMI is not set +# CONFIG_N_GSM is not set +# CONFIG_TRACE_SINK is not set +CONFIG_DEVKMEM=y + +# +# Serial drivers +# +# CONFIG_SERIAL_8250 is not set +CONFIG_FIX_EARLYCON_MEM=y + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_MFD_HSU is not set +# CONFIG_SERIAL_JSM is not set +# CONFIG_SERIAL_TIMBERDALE is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +# CONFIG_SERIAL_PCH_UART is not set +# CONFIG_SERIAL_XILINX_PS_UART is not set +CONFIG_HVC_DRIVER=y +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_IPMI_HANDLER is not set +# CONFIG_HW_RANDOM is not set +# CONFIG_NVRAM is not set +# CONFIG_RTC is not set +# CONFIG_GEN_RTC is not set +# CONFIG_R3964 is not set +# CONFIG_APPLICOM is not set +# CONFIG_MWAVE is not set +# CONFIG_RAW_DRIVER is not set +# CONFIG_HPET is not set +# CONFIG_HANGCHECK_TIMER is not set +# CONFIG_TCG_TPM is not set +# CONFIG_TELCLOCK is not set +CONFIG_DEVPORT=y +# CONFIG_I2C is not set +# CONFIG_SPI is not set +# CONFIG_HSI is not set + +# +# PPS support +# +# CONFIG_PPS is not set + +# +# PPS generators support +# + +# +# PTP clock support +# + +# +# Enable Device Drivers -> PPS to see the PTP clock options. +# +CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y +# CONFIG_GPIOLIB is not set +# CONFIG_W1 is not set +CONFIG_POWER_SUPPLY=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_PDA_POWER is not set +# CONFIG_TEST_POWER is not set +# CONFIG_BATTERY_DS2780 is not set +# CONFIG_BATTERY_DS2781 is not set +# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_CHARGER_MAX8903 is not set +# CONFIG_POWER_AVS is not set +CONFIG_HWMON=y +# CONFIG_HWMON_VID is not set +# CONFIG_HWMON_DEBUG_CHIP is not set + +# +# Native drivers +# +# CONFIG_SENSORS_ABITUGURU is not set +# CONFIG_SENSORS_ABITUGURU3 is not set +# CONFIG_SENSORS_K8TEMP is not set +# CONFIG_SENSORS_K10TEMP is not set +# CONFIG_SENSORS_FAM15H_POWER is not set +# CONFIG_SENSORS_I5K_AMB is not set +# CONFIG_SENSORS_F71805F is not set +# CONFIG_SENSORS_F71882FG is not set +# CONFIG_SENSORS_CORETEMP is not set +# CONFIG_SENSORS_IT87 is not set +# CONFIG_SENSORS_NTC_THERMISTOR is not set +# CONFIG_SENSORS_PC87360 is not set +# CONFIG_SENSORS_PC87427 is not set +# CONFIG_SENSORS_SIS5595 is not set +# CONFIG_SENSORS_SMSC47M1 is not set +# CONFIG_SENSORS_SMSC47B397 is not set +# CONFIG_SENSORS_SCH56XX_COMMON is not set +# CONFIG_SENSORS_VIA_CPUTEMP is not set +# CONFIG_SENSORS_VIA686A is not set +# CONFIG_SENSORS_VT1211 is not set +# CONFIG_SENSORS_VT8231 is not set +# CONFIG_SENSORS_W83627HF is not set +# CONFIG_SENSORS_W83627EHF is not set +# CONFIG_SENSORS_APPLESMC is not set + +# +# ACPI drivers +# +# CONFIG_SENSORS_ACPI_POWER is not set +# CONFIG_SENSORS_ATK0110 is not set +CONFIG_THERMAL=y +CONFIG_THERMAL_HWMON=y +# CONFIG_WATCHDOG is not set +CONFIG_SSB_POSSIBLE=y + +# +# Sonics Silicon Backplane +# +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y + +# +# Broadcom specific AMBA +# +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_CORE is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_MFD_TMIO is not set +# CONFIG_ABX500_CORE is not set +# CONFIG_MFD_CS5535 is not set +# CONFIG_LPC_SCH is not set +# CONFIG_LPC_ICH is not set +# CONFIG_MFD_RDC321X is not set +# CONFIG_MFD_JANZ_CMODIO is not set +# CONFIG_MFD_VX855 is not set +# CONFIG_REGULATOR is not set +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +# CONFIG_AGP is not set +CONFIG_VGA_ARB=y +CONFIG_VGA_ARB_MAX_GPUS=16 +# CONFIG_VGA_SWITCHEROO is not set +# CONFIG_DRM is not set +# CONFIG_STUB_POULSBO is not set +# CONFIG_VGASTATE is not set +# CONFIG_VIDEO_OUTPUT_CONTROL is not set +# CONFIG_FB is not set +# CONFIG_EXYNOS_VIDEO is not set +# CONFIG_BACKLIGHT_LCD_SUPPORT is not set + +# +# Console display driver support +# +CONFIG_VGA_CONSOLE=y +# CONFIG_VGACON_SOFT_SCROLLBACK is not set +CONFIG_DUMMY_CONSOLE=y +CONFIG_SOUND=y +# CONFIG_SOUND_OSS_CORE is not set +# CONFIG_SND is not set +# CONFIG_SOUND_PRIME is not set + +# +# HID support +# +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +# CONFIG_HIDRAW is not set +# CONFIG_UHID is not set +CONFIG_HID_GENERIC=y + +# +# Special HID drivers +# +CONFIG_USB_ARCH_HAS_OHCI=y +CONFIG_USB_ARCH_HAS_EHCI=y +CONFIG_USB_ARCH_HAS_XHCI=y +CONFIG_USB_SUPPORT=y +CONFIG_USB_ARCH_HAS_HCD=y +# CONFIG_USB is not set + +# +# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may +# +# CONFIG_USB_GADGET is not set + +# +# OTG and related infrastructure +# +# CONFIG_UWB is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_INFINIBAND is not set +# CONFIG_EDAC is not set +# CONFIG_RTC_CLASS is not set +# CONFIG_DMADEVICES is not set +# CONFIG_AUXDISPLAY is not set +# CONFIG_UIO is not set +CONFIG_VIRTIO=y +CONFIG_VIRTIO_RING=y + +# +# Virtio drivers +# +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_BALLOON=y +CONFIG_VIRTIO_MMIO=y +# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set + +# +# Microsoft Hyper-V guest support +# +# CONFIG_HYPERV is not set +# CONFIG_STAGING is not set +CONFIG_X86_PLATFORM_DEVICES=y +# CONFIG_ACERHDF is not set +# CONFIG_ASUS_LAPTOP is not set +# CONFIG_FUJITSU_TABLET is not set +# CONFIG_HP_ACCEL is not set +# CONFIG_THINKPAD_ACPI is not set +# CONFIG_SENSORS_HDAPS is not set +# CONFIG_INTEL_MENLOW is not set +# CONFIG_ACPI_WMI is not set +# CONFIG_TOPSTAR_LAPTOP is not set +# CONFIG_TOSHIBA_BT_RFKILL is not set +# CONFIG_ACPI_CMPC is not set +# CONFIG_INTEL_IPS is not set +# CONFIG_IBM_RTL is not set +# CONFIG_XO15_EBOOK is not set +# CONFIG_SAMSUNG_Q10 is not set + +# +# Hardware Spinlock drivers +# +CONFIG_CLKEVT_I8253=y +CONFIG_I8253_LOCK=y +CONFIG_CLKBLD_I8253=y +CONFIG_IOMMU_SUPPORT=y +# CONFIG_AMD_IOMMU is not set +# CONFIG_INTEL_IOMMU is not set +# CONFIG_IRQ_REMAP is not set + +# +# Remoteproc drivers (EXPERIMENTAL) +# + +# +# Rpmsg drivers (EXPERIMENTAL) +# +# CONFIG_VIRT_DRIVERS is not set +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_VME_BUS is not set +# CONFIG_PWM is not set + +# +# Firmware Drivers +# +# CONFIG_EDD is not set +CONFIG_FIRMWARE_MEMMAP=y +# CONFIG_DELL_RBU is not set +# CONFIG_DCDBAS is not set +CONFIG_DMIID=y +# CONFIG_DMI_SYSFS is not set +# CONFIG_ISCSI_IBFT_FIND is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +CONFIG_EXT2_FS=y +# CONFIG_EXT2_FS_XATTR is not set +# CONFIG_EXT2_FS_XIP is not set +CONFIG_EXT3_FS=y +# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set +# CONFIG_EXT3_FS_XATTR is not set +# CONFIG_EXT4_FS is not set +CONFIG_JBD=y +CONFIG_REISERFS_FS=y +# CONFIG_REISERFS_CHECK is not set +# CONFIG_REISERFS_PROC_INFO is not set +# CONFIG_REISERFS_FS_XATTR is not set +# CONFIG_JFS_FS is not set +# CONFIG_XFS_FS is not set +# CONFIG_GFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +CONFIG_FS_POSIX_ACL=y +CONFIG_FILE_LOCKING=y +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +# CONFIG_FANOTIFY is not set +CONFIG_QUOTA=y +# CONFIG_QUOTA_NETLINK_INTERFACE is not set +CONFIG_PRINT_QUOTA_WARNING=y +# CONFIG_QUOTA_DEBUG is not set +# CONFIG_QFMT_V1 is not set +# CONFIG_QFMT_V2 is not set +CONFIG_QUOTACTL=y +CONFIG_AUTOFS4_FS=y +# CONFIG_FUSE_FS is not set + +# +# Caches +# +# CONFIG_FSCACHE is not set + +# +# CD-ROM/DVD Filesystems +# +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +# CONFIG_ZISOFS is not set +# CONFIG_UDF_FS is not set + +# +# DOS/FAT/NT Filesystems +# +# CONFIG_MSDOS_FS is not set +# CONFIG_VFAT_FS is not set +# CONFIG_NTFS_FS is not set + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +# CONFIG_TMPFS_POSIX_ACL is not set +# CONFIG_TMPFS_XATTR is not set +# CONFIG_HUGETLBFS is not set +# CONFIG_HUGETLB_PAGE is not set +# CONFIG_CONFIGFS_FS is not set +CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ADFS_FS is not set +# CONFIG_AFFS_FS is not set +# CONFIG_HFS_FS is not set +# CONFIG_HFSPLUS_FS is not set +# CONFIG_BEFS_FS is not set +# CONFIG_BFS_FS is not set +# CONFIG_EFS_FS is not set +# CONFIG_LOGFS is not set +# CONFIG_CRAMFS is not set +# CONFIG_SQUASHFS is not set +# CONFIG_VXFS_FS is not set +# CONFIG_MINIX_FS is not set +# CONFIG_OMFS_FS is not set +# CONFIG_HPFS_FS is not set +# CONFIG_QNX4FS_FS is not set +# CONFIG_QNX6FS_FS is not set +# CONFIG_ROMFS_FS is not set +# CONFIG_PSTORE is not set +# CONFIG_SYSV_FS is not set +# CONFIG_UFS_FS is not set +CONFIG_NETWORK_FILESYSTEMS=y +# CONFIG_NFS_FS is not set +# CONFIG_NFSD is not set +# CONFIG_CEPH_FS is not set +# CONFIG_CIFS is not set +# CONFIG_NCP_FS is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_9P_FS=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="iso8859-1" +# CONFIG_NLS_CODEPAGE_437 is not set +# CONFIG_NLS_CODEPAGE_737 is not set +# CONFIG_NLS_CODEPAGE_775 is not set +# CONFIG_NLS_CODEPAGE_850 is not set +# CONFIG_NLS_CODEPAGE_852 is not set +# CONFIG_NLS_CODEPAGE_855 is not set +# CONFIG_NLS_CODEPAGE_857 is not set +# CONFIG_NLS_CODEPAGE_860 is not set +# CONFIG_NLS_CODEPAGE_861 is not set +# CONFIG_NLS_CODEPAGE_862 is not set +# CONFIG_NLS_CODEPAGE_863 is not set +# CONFIG_NLS_CODEPAGE_864 is not set +# CONFIG_NLS_CODEPAGE_865 is not set +# CONFIG_NLS_CODEPAGE_866 is not set +# CONFIG_NLS_CODEPAGE_869 is not set +# CONFIG_NLS_CODEPAGE_936 is not set +# CONFIG_NLS_CODEPAGE_950 is not set +# CONFIG_NLS_CODEPAGE_932 is not set +# CONFIG_NLS_CODEPAGE_949 is not set +# CONFIG_NLS_CODEPAGE_874 is not set +# CONFIG_NLS_ISO8859_8 is not set +# CONFIG_NLS_CODEPAGE_1250 is not set +# CONFIG_NLS_CODEPAGE_1251 is not set +# CONFIG_NLS_ASCII is not set +# CONFIG_NLS_ISO8859_1 is not set +# CONFIG_NLS_ISO8859_2 is not set +# CONFIG_NLS_ISO8859_3 is not set +# CONFIG_NLS_ISO8859_4 is not set +# CONFIG_NLS_ISO8859_5 is not set +# CONFIG_NLS_ISO8859_6 is not set +# CONFIG_NLS_ISO8859_7 is not set +# CONFIG_NLS_ISO8859_9 is not set +# CONFIG_NLS_ISO8859_13 is not set +# CONFIG_NLS_ISO8859_14 is not set +# CONFIG_NLS_ISO8859_15 is not set +# CONFIG_NLS_KOI8_R is not set +# CONFIG_NLS_KOI8_U is not set +# CONFIG_NLS_MAC_ROMAN is not set +# CONFIG_NLS_MAC_CELTIC is not set +# CONFIG_NLS_MAC_CENTEURO is not set +# CONFIG_NLS_MAC_CROATIAN is not set +# CONFIG_NLS_MAC_CYRILLIC is not set +# CONFIG_NLS_MAC_GAELIC is not set +# CONFIG_NLS_MAC_GREEK is not set +# CONFIG_NLS_MAC_ICELAND is not set +# CONFIG_NLS_MAC_INUIT is not set +# CONFIG_NLS_MAC_ROMANIAN is not set +# CONFIG_NLS_MAC_TURKISH is not set +# CONFIG_NLS_UTF8 is not set + +# +# Kernel hacking +# +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +# CONFIG_PRINTK_TIME is not set +CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4 +CONFIG_ENABLE_WARN_DEPRECATED=y +CONFIG_ENABLE_MUST_CHECK=y +CONFIG_FRAME_WARN=1024 +# CONFIG_MAGIC_SYSRQ is not set +# CONFIG_STRIP_ASM_SYMS is not set +# CONFIG_READABLE_ASM is not set +# CONFIG_UNUSED_SYMBOLS is not set +# CONFIG_DEBUG_FS is not set +# CONFIG_HEADERS_CHECK is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_DEBUG_KERNEL=y +# CONFIG_DEBUG_SHIRQ is not set +# CONFIG_LOCKUP_DETECTOR is not set +# CONFIG_HARDLOCKUP_DETECTOR is not set +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 +# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set +CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 +# CONFIG_SCHED_DEBUG is not set +# CONFIG_SCHEDSTATS is not set +# CONFIG_TIMER_STATS is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_DEBUG_SLAB is not set +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_RT_MUTEX_TESTER is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_PROVE_LOCKING is not set +# CONFIG_SPARSE_RCU_POINTER is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_DEBUG_KOBJECT is not set +CONFIG_DEBUG_BUGVERBOSE=y +CONFIG_DEBUG_INFO=y +# CONFIG_DEBUG_INFO_REDUCED is not set +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_VIRTUAL is not set +# CONFIG_DEBUG_WRITECOUNT is not set +CONFIG_DEBUG_MEMORY_INIT=y +# CONFIG_DEBUG_LIST is not set +# CONFIG_TEST_LIST_SORT is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +# CONFIG_DEBUG_CREDENTIALS is not set +CONFIG_ARCH_WANT_FRAME_POINTERS=y +CONFIG_FRAME_POINTER=y +# CONFIG_BOOT_PRINTK_DELAY is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_TRACE is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# CONFIG_NOTIFIER_ERROR_INJECTION is not set +# CONFIG_FAULT_INJECTION is not set +# CONFIG_LATENCYTOP is not set +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_USER_STACKTRACE_SUPPORT=y +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y +CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACING_SUPPORT=y +CONFIG_FTRACE=y +# CONFIG_FUNCTION_TRACER is not set +# CONFIG_IRQSOFF_TRACER is not set +# CONFIG_SCHED_TRACER is not set +# CONFIG_ENABLE_DEFAULT_TRACERS is not set +# CONFIG_FTRACE_SYSCALLS is not set +CONFIG_BRANCH_PROFILE_NONE=y +# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set +# CONFIG_PROFILE_ALL_BRANCHES is not set +# CONFIG_STACK_TRACER is not set +# CONFIG_BLK_DEV_IO_TRACE is not set +# CONFIG_UPROBE_EVENT is not set +# CONFIG_PROBE_EVENTS is not set +# CONFIG_MMIOTRACE is not set +# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_SAMPLES is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_HAVE_ARCH_KMEMCHECK=y +# CONFIG_TEST_KSTRTOX is not set +# CONFIG_STRICT_DEVMEM is not set +CONFIG_X86_VERBOSE_BOOTUP=y +CONFIG_EARLY_PRINTK=y +# CONFIG_EARLY_PRINTK_DBGP is not set +# CONFIG_DEBUG_STACKOVERFLOW is not set +# CONFIG_X86_PTDUMP is not set +CONFIG_DEBUG_RODATA=y +CONFIG_DEBUG_RODATA_TEST=y +# CONFIG_DEBUG_TLBFLUSH is not set +# CONFIG_IOMMU_DEBUG is not set +# CONFIG_IOMMU_STRESS is not set +CONFIG_HAVE_MMIOTRACE_SUPPORT=y +CONFIG_IO_DELAY_TYPE_0X80=0 +CONFIG_IO_DELAY_TYPE_0XED=1 +CONFIG_IO_DELAY_TYPE_UDELAY=2 +CONFIG_IO_DELAY_TYPE_NONE=3 +CONFIG_IO_DELAY_0X80=y +# CONFIG_IO_DELAY_0XED is not set +# CONFIG_IO_DELAY_UDELAY is not set +# CONFIG_IO_DELAY_NONE is not set +CONFIG_DEFAULT_IO_DELAY_TYPE=0 +# CONFIG_CPA_DEBUG is not set +# CONFIG_OPTIMIZE_INLINING is not set +# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set +# CONFIG_DEBUG_NMI_SELFTEST is not set + +# +# Security options +# +# CONFIG_KEYS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +# CONFIG_SECURITYFS is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_DEFAULT_SECURITY="" +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_BLKCIPHER=y +CONFIG_CRYPTO_BLKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_PCOMP=y +CONFIG_CRYPTO_PCOMP2=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +CONFIG_CRYPTO_USER=y +CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +CONFIG_CRYPTO_GF128MUL=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_WORKQUEUE=y +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_AUTHENC=y +CONFIG_CRYPTO_ABLK_HELPER_X86=y +CONFIG_CRYPTO_GLUE_HELPER_X86=y + +# +# Authenticated Encryption with Associated Data +# +CONFIG_CRYPTO_CCM=y +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_SEQIV=y + +# +# Block modes +# +CONFIG_CRYPTO_CBC=y +CONFIG_CRYPTO_CTR=y +# CONFIG_CRYPTO_CTS is not set +CONFIG_CRYPTO_ECB=y +CONFIG_CRYPTO_LRW=y +CONFIG_CRYPTO_PCBC=y +CONFIG_CRYPTO_XTS=y + +# +# Hash modes +# +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_XCBC=y +# CONFIG_CRYPTO_VMAC is not set + +# +# Digest +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_CRC32C_INTEL is not set +CONFIG_CRYPTO_GHASH=y +CONFIG_CRYPTO_MD4=y +CONFIG_CRYPTO_MD5=y +CONFIG_CRYPTO_MICHAEL_MIC=y +CONFIG_CRYPTO_RMD128=y +CONFIG_CRYPTO_RMD160=y +CONFIG_CRYPTO_RMD256=y +CONFIG_CRYPTO_RMD320=y +CONFIG_CRYPTO_SHA1=y +# CONFIG_CRYPTO_SHA1_SSSE3 is not set +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y +CONFIG_CRYPTO_TGR192=y +CONFIG_CRYPTO_WP512=y +# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set + +# +# Ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_X86_64 is not set +# CONFIG_CRYPTO_AES_NI_INTEL is not set +CONFIG_CRYPTO_ANUBIS=y +CONFIG_CRYPTO_ARC4=y +CONFIG_CRYPTO_BLOWFISH=y +CONFIG_CRYPTO_BLOWFISH_COMMON=y +# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set +CONFIG_CRYPTO_CAMELLIA=y +# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set +CONFIG_CRYPTO_CAST5=y +CONFIG_CRYPTO_CAST6=y +CONFIG_CRYPTO_DES=y +CONFIG_CRYPTO_FCRYPT=y +CONFIG_CRYPTO_KHAZAD=y +CONFIG_CRYPTO_SALSA20=y +# CONFIG_CRYPTO_SALSA20_X86_64 is not set +CONFIG_CRYPTO_SEED=y +CONFIG_CRYPTO_SERPENT=y +# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set +CONFIG_CRYPTO_SERPENT_AVX_X86_64=y +CONFIG_CRYPTO_TEA=y +CONFIG_CRYPTO_TWOFISH=y +CONFIG_CRYPTO_TWOFISH_COMMON=y +CONFIG_CRYPTO_TWOFISH_X86_64=y +CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y +CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_ZLIB=y +# CONFIG_CRYPTO_LZO is not set + +# +# Random Number Generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y +# CONFIG_CRYPTO_HW is not set +CONFIG_HAVE_KVM=y +CONFIG_VIRTUALIZATION=y +# CONFIG_KVM is not set +# CONFIG_VHOST_NET is not set +# CONFIG_BINARY_PRINTF is not set + +# +# Library routines +# +CONFIG_BITREVERSE=y +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +CONFIG_GENERIC_FIND_FIRST_BIT=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IOMAP=y +CONFIG_GENERIC_IO=y +CONFIG_CRC_CCITT=y +CONFIG_CRC16=y +# CONFIG_CRC_T10DIF is not set +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +CONFIG_CRC7=y +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +# CONFIG_XZ_DEC is not set +# CONFIG_XZ_DEC_BCJ is not set +CONFIG_TEXTSEARCH=y +CONFIG_TEXTSEARCH_KMP=y +CONFIG_TEXTSEARCH_BM=y +CONFIG_TEXTSEARCH_FSM=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT=y +CONFIG_HAS_DMA=y +CONFIG_DQL=y +CONFIG_NLATTR=y +CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y +# CONFIG_AVERAGE is not set +# CONFIG_CORDIC is not set +# CONFIG_DDR is not set diff --git a/testing/config/kvm/alice.xml b/testing/config/kvm/alice.xml new file mode 100644 index 000000000..6ca78f861 --- /dev/null +++ b/testing/config/kvm/alice.xml @@ -0,0 +1,70 @@ +<domain type='kvm'> + <name>alice</name> + <uuid>1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/alice.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:9a:e2:de'/> + <source network='vnet2'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <interface type='network'> + <mac address='52:54:00:3b:0c:d7'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/bob.xml b/testing/config/kvm/bob.xml new file mode 100644 index 000000000..d9a9b4c05 --- /dev/null +++ b/testing/config/kvm/bob.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>bob</name> + <uuid>72728516-377f-f5be-ea1d-b1f1e851538f</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/bob.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:40:85:6b'/> + <source network='vnet3'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/carol.xml b/testing/config/kvm/carol.xml new file mode 100644 index 000000000..fbdabe2e4 --- /dev/null +++ b/testing/config/kvm/carol.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>carol</name> + <uuid>6bc2eef5-7faf-cde0-5f27-6fc29f93bc3d</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/carol.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:ae:f1:f8'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/dave.xml b/testing/config/kvm/dave.xml new file mode 100644 index 000000000..bfebe9b60 --- /dev/null +++ b/testing/config/kvm/dave.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>dave</name> + <uuid>05f1debe-4e38-4f3d-10a0-c07fbb70d816</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/dave.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:b9:15:a9'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/moon.xml b/testing/config/kvm/moon.xml new file mode 100644 index 000000000..e019fcea5 --- /dev/null +++ b/testing/config/kvm/moon.xml @@ -0,0 +1,70 @@ +<domain type='kvm'> + <name>moon</name> + <uuid>b5e00ad3-1c81-3b2a-7f66-cdf8727b3c65</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/moon.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:43:e3:35'/> + <source network='vnet2'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </interface> + <interface type='network'> + <mac address='52:54:00:c7:b8:b0'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/sun.xml b/testing/config/kvm/sun.xml new file mode 100644 index 000000000..5ed1a47ea --- /dev/null +++ b/testing/config/kvm/sun.xml @@ -0,0 +1,70 @@ +<domain type='kvm'> + <name>sun</name> + <uuid>35341843-346c-a63a-786b-9df0fd5e6264</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/sun.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:77:43:ea'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <interface type='network'> + <mac address='52:54:00:0f:97:db'/> + <source network='vnet3'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/venus.xml b/testing/config/kvm/venus.xml new file mode 100644 index 000000000..77a333655 --- /dev/null +++ b/testing/config/kvm/venus.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>venus</name> + <uuid>f0838df9-7cc0-84f5-6c14-2d16ab002e8d</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/venus.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:69:d3:80'/> + <source network='vnet2'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/config/kvm/vnet1.xml b/testing/config/kvm/vnet1.xml new file mode 100644 index 000000000..f9d979be1 --- /dev/null +++ b/testing/config/kvm/vnet1.xml @@ -0,0 +1,11 @@ +<network> + <name>vnet1</name> + <uuid>1d6ac7c7-60d9-56c1-a7df-210d3d0cc6d1</uuid> + <forward dev='lo' mode='route'> + <interface dev='lo'/> + </forward> + <bridge name='virbr1' stp='on' delay='0' /> + <mac address='52:54:00:97:F9:FD'/> + <ip address='192.168.0.254' netmask='255.255.255.0'> + </ip> +</network> diff --git a/testing/config/kvm/vnet2.xml b/testing/config/kvm/vnet2.xml new file mode 100644 index 000000000..7d125bfc6 --- /dev/null +++ b/testing/config/kvm/vnet2.xml @@ -0,0 +1,11 @@ +<network> + <name>vnet2</name> + <uuid>b5147a7d-e184-5c9e-3838-4621796ba95c</uuid> + <forward dev='lo' mode='route'> + <interface dev='lo'/> + </forward> + <bridge name='virbr2' stp='on' delay='0' /> + <mac address='52:54:00:05:F3:34'/> + <ip address='10.1.0.254' netmask='255.255.0.0'> + </ip> +</network> diff --git a/testing/config/kvm/vnet3.xml b/testing/config/kvm/vnet3.xml new file mode 100644 index 000000000..1da06c448 --- /dev/null +++ b/testing/config/kvm/vnet3.xml @@ -0,0 +1,11 @@ +<network> + <name>vnet3</name> + <uuid>5c537abc-c116-90e9-a0ef-886340d4c356</uuid> + <forward dev='lo' mode='route'> + <interface dev='lo'/> + </forward> + <bridge name='virbr3' stp='on' delay='0' /> + <mac address='52:54:00:62:4C:69'/> + <ip address='10.2.0.254' netmask='255.255.0.0'> + </ip> +</network> diff --git a/testing/config/kvm/winnetou.xml b/testing/config/kvm/winnetou.xml new file mode 100644 index 000000000..99d5deb99 --- /dev/null +++ b/testing/config/kvm/winnetou.xml @@ -0,0 +1,64 @@ +<domain type='kvm'> + <name>winnetou</name> + <uuid>b1d3d2f7-e20b-ab95-277e-66d4cac33cc3</uuid> + <memory unit='KiB'>131072</memory> + <currentMemory unit='KiB'>131072</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-1.1'>hvm</type> + <kernel>/var/run/kvm-swan-kernel</kernel> + <cmdline>root=/dev/vda1 loglevel=1</cmdline> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <emulator>/usr/bin/kvm</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' cache='writethrough'/> + <source file='/var/lib/libvirt/images/winnetou.qcow2'/> + <target dev='vda' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <filesystem type='mount' accessmode='mapped'> + <source dir='/var/run/kvm-swan-hostfs'/> + <target dir='/hostshare'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:4b:23:fa'/> + <source network='vnet1'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <target port='0'/> + </serial> + <console type='pty'> + <target type='serial' port='0'/> + </console> + <input type='tablet' bus='usb'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <sound model='ich6'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/testing/do-tests.in b/testing/do-tests index 82e027078..fafbe6e89 100755 --- a/testing/do-tests.in +++ b/testing/do-tests @@ -14,23 +14,16 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. -DIR=`dirname $0` +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf +. $DIR/scripts/function.sh -source $DIR/scripts/function.sh - -[ -f $DIR/testing.conf ] || die "Configuration file 'testing.conf' not found" [ -d $DIR/hosts ] || die "Directory 'hosts' not found" [ -d $DIR/tests ] || die "Directory 'tests' not found" +[ -d $BUILDDIR ] || + die "Directory '$BUILDDIR' does not exist, please run make-testing first" -source $DIR/testing.conf - - -############################################################################## -# test if UMLs have been built at all -# - -[ -d $BUILDDIR ] || die "Directory '$BUILDDIR' does not exist. Please run 'make-testing'first." - +ln -sfT $DIR $TESTDIR/testing ############################################################################## # take care of new path and file variables @@ -38,15 +31,15 @@ source $DIR/testing.conf [ -d $TESTRESULTSDIR ] || mkdir $TESTRESULTSDIR -TESTDATE=`date +%Y%m%d-%H%M` +TESTDATE=`date +%Y%m%d-%H%M-%S` TODAYDIR=$TESTRESULTSDIR/$TESTDATE mkdir $TODAYDIR TESTRESULTSHTML=$TODAYDIR/all.html INDEX=$TODAYDIR/index.html -DEFAULTTESTSDIR=$UMLTESTDIR/testing/tests +DEFAULTTESTSDIR=$TESTDIR/testing/tests -SOURCEIP_ROUTING_TABLE=@routing_table@ +SOURCEIP_ROUTING_TABLE=220 testnumber="0" failed_cnt="0" @@ -105,8 +98,9 @@ done # for host in $STRONGSWANHOSTS do - ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` & + ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` >/dev/null 2>&1 & eval ssh_pid_$host="`echo $!`" + do_on_exit kill `eval echo \\\$ssh_pid_$host` done @@ -114,30 +108,27 @@ done # create header for the results html file # -KERNEL_VERSION=`basename $KERNEL .tar.bz2` -IPSEC_VERSION=`basename $STRONGSWAN .tar.bz2` - ENVIRONMENT_HEADER=$(cat <<@EOF - <table border="0" cellspacing="2"> + <table border="0" cellspacing="2" cellpadding="2"> <tr valign="top"> - <td><b>Host:</b></td> + <td><b>Host</b></td> <td colspan="3">`uname -a`</td> </tr> <tr valign="top"> - <td><b>UML kernel: </b></td> - <td colspan="3">$KERNEL_VERSION</td> + <td><b>Guest kernel</b></td> + <td colspan="3">$KERNELVERSION</td> </tr> <tr valign="top"> - <td><b>IPsec:</b></td> - <td colspan="3">$IPSEC_VERSION</td> + <td><b>strongSwan</b></td> + <td colspan="3">$SWANVERSION</td> </tr> <tr valign="top"> - <td><b>Date:</b></td> + <td><b>Date</b></td> <td colspan="3">$TESTDATE</td> </tr> <tr> <td width="100"> </td> - <td width="200"> </td> + <td width="300"> </td> <td width=" 50"> </td> <td > </td> </tr> @@ -147,20 +138,20 @@ ENVIRONMENT_HEADER=$(cat <<@EOF cat > $INDEX <<@EOF <html> <head> - <title>strongSwan UML Tests</title> + <title>strongSwan KVM Tests</title> </head> <body> - <h2>strongSwan UML Tests</h2> + <h2>strongSwan KVM Tests</h2> $ENVIRONMENT_HEADER @EOF cat > $TESTRESULTSHTML <<@EOF <html> <head> - <title>strongSwan UML Tests - All Tests</title> + <title>strongSwan KVM Tests - All Tests</title> </head> <body> - <div><a href="index.html">strongSwan UML Tests</a> / All Tests</div> + <div><a href="index.html">strongSwan KVM Tests</a> / All Tests</div> <h2>All Tests</h2> $ENVIRONMENT_HEADER <tr align="left"> @@ -170,10 +161,10 @@ cat > $TESTRESULTSHTML <<@EOF </tr> @EOF -cecho "UML kernel: $KERNEL_VERSION" -cecho "IPsec: $IPSEC_VERSION" -cecho "Date: $TESTDATE" -cecho "" +echo "Guest kernel : $KERNELVERSION" +echo "strongSwan : $SWANVERSION" +echo "Date : $TESTDATE" +echo ############################################################################## @@ -183,10 +174,6 @@ cecho "" if [ $# -gt 0 ] then TESTS=$* -elif [ $SELECTEDTESTSONLY = "yes" ] -then - # set internal field seperator - TESTS=$SELECTEDTESTS else # set internal field seperator TESTS="`ls $DEFAULTTESTSDIR`" @@ -208,7 +195,7 @@ do mkdir $TODAYDIR/$SUBDIR if [ $testnumber == 0 ] then - FIRST="<b>Category:</b" + FIRST="<b>Category</b>" else FIRST=" " fi @@ -225,24 +212,24 @@ do <title>strongSwan $SUBDIR Tests</title> </head> <body> - <div><a href="../index.html">strongSwan UML Tests</a> / $SUBDIR</div> + <div><a href="../index.html">strongSwan KVM Tests</a> / $SUBDIR</div> <h2>strongSwan $SUBDIR Tests</h2> - <table border="0" cellspacing="2"> + <table border="0" cellspacing="2" cellpadding="2"> <tr valign="top"> - <td><b>UML kernel: </b></td> - <td colspan="3">$KERNEL_VERSION</td> + <td><b>Guest kernel</b></td> + <td colspan="3">$KERNELVERSION</td> </tr> <tr valign="top"> - <td><b>IPsec:</b></td> - <td colspan="3">$IPSEC_VERSION</td> + <td><b>strongSwan</b></td> + <td colspan="3">$SWANVERSION</td> </tr> <tr valign="top"> - <td><b>Date:</b></td> + <td><b>Date</b></td> <td colspan="3">$TESTDATE</td> </tr> <tr> <td width="100"> </td> - <td width="200"> </td> + <td width="300"> </td> <td width=" 50"> </td> <td > </td> </tr> @@ -258,11 +245,11 @@ do do let "testnumber += 1" testname=$SUBDIR/$name - cecho-n " $testnumber $testname.." + log_action " $testnumber $testname:" if [ ! -d $DEFAULTTESTSDIR/${testname} ] then - cecho "is missing..skipped" + echo "is missing..skipped" continue fi @@ -390,7 +377,7 @@ do # execute pre-test commands # - cecho-n "pre.." + echo -n "pre.." echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1 eval `awk -F "::" '{ @@ -419,7 +406,7 @@ do # get and evaluate test results # - cecho-n "test.." + echo -n "test.." echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1 STATUS="passed" @@ -476,7 +463,7 @@ do <body> <table border="0" cellpadding="0" cellspacing="0" width="600"> <tr><td> - <div><a href="../../index.html">strongSwan UML Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div> + <div><a href="../../index.html">strongSwan KVM Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div> <h2>Test $testname</h2> <h3>Description</h3> @EOF @@ -487,7 +474,7 @@ do <ul> <li><a href="console.log">console.log</a></li> </ul> - <img src="../../images/$DIAGRAM" alt="$UMLHOSTS"> + <img src="../../images/$DIAGRAM" alt="$VIRTHOSTS"> @EOF for host in $IPSECHOSTS @@ -507,7 +494,7 @@ do done scp $SSHCONF $HOSTLOGIN:/etc/ipsec.d/ipsec.sql \ - $TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1 + $TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1 ssh $SSHCONF $HOSTLOGIN ip -s xfrm policy \ > $TESTRESULTDIR/${host}.ip.policy 2>/dev/null @@ -558,15 +545,18 @@ do for file in clients.conf eap.conf radiusd.conf proxy.conf users do - scp $SSHCONF $HOSTLOGIN:/etc/raddb/$file \ + scp $SSHCONF $HOSTLOGIN:/etc/freeradius/$file \ $TESTRESULTDIR/${host}.$file > /dev/null 2>&1 done scp $SSHCONF $HOSTLOGIN:/etc/strongswan.conf \ $TESTRESULTDIR/${host}.strongswan.conf > /dev/null 2>&1 - scp $SSHCONF $HOSTLOGIN:/var/log/radius/radius.log \ - $TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1 + scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \ + $TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1 + + ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \ + >> $TESTRESULTDIR/${host}.daemon.log chmod a+r $TESTRESULTDIR/* cat >> $TESTRESULTDIR/index.html <<@EOF @@ -600,6 +590,28 @@ do done cat >> $TESTRESULTDIR/index.html <<@EOF + <h3>tcpdump</h3> + <ul> +@EOF + + for host in $TCPDUMPHOSTS + do + eval HOSTLOGIN=root@\$ipv4_${host} + + scp $SSHCONF $HOSTLOGIN:/tmp/tcpdump.log \ + $TESTRESULTDIR/${host}.tcpdump.log > /dev/null 2>&1 + + cat >> $TESTRESULTDIR/index.html <<@EOF + <li><a href="$host.tcpdump.log">$host tcpdump.log</a></li> +@EOF + + done + + cat >> $TESTRESULTDIR/index.html <<@EOF + </ul> +@EOF + + cat >> $TESTRESULTDIR/index.html <<@EOF </td></tr> </table> </body> @@ -611,7 +623,7 @@ do # execute post-test commands # - cecho-n "post.." + echo -n "post" echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1 eval `awk -F "::" '{ @@ -649,18 +661,6 @@ do ########################################################################## - # get a copy of /var/log/daemon.log - # - - for host in $RADIUSHOSTS - do - eval HOSTLOGIN=root@\$ipv4_${host} - ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \ - >> $TESTRESULTDIR/${host}.daemon.log - done - - - ########################################################################## # stop tcpdump if necessary # @@ -688,11 +688,11 @@ do if [ $STATUS = "passed" ] then - COLOR="green" - cecho "\033[1;32m$STATUS" + COLOR="green" + log_status 0 else - COLOR="red" - cecho "$STATUS" + COLOR="red" + log_status 1 fi cat >> $TESTRESULTSHTML << @EOF @@ -737,10 +737,10 @@ cat >> $TESTRESULTSHTML << @EOF <td> </td><td> </td><td> </td><td> </td> </tr> <tr> - <td><b>Passed:</b></td><td><b><font color="green">$passed_cnt</font></b></td><td> </td><td> </td> + <td><b>Passed</b></td><td><b><font color="green">$passed_cnt</font></b></td><td> </td><td> </td> </tr> <tr> - <td><b>Failed:</b></td><td><b><font color="red">$failed_cnt</font></b></td><td> </td><td> </td> + <td><b>Failed</b></td><td><b><font color="red">$failed_cnt</font></b></td><td> </td><td> </td> </tr> </table> </body> @@ -757,7 +757,7 @@ cat >> $INDEX << @EOF <td> </td> </tr> <tr> - <td><b>Failed:</b></td> + <td><b>Failed</b></td> <td> </td> <td align="right"><b><font color="red">$failed_cnt</font></b></td> <td> </td> @@ -767,33 +767,25 @@ cat >> $INDEX << @EOF </html> @EOF -cecho "" -cecho "\033[1;32mPassed: $passed_cnt" -cecho "Failed: $failed_cnt" -cecho "" +echo +echo_ok "Passed : $passed_cnt" +echo_failed "Failed : $failed_cnt" +echo ############################################################################## # copy the test results to the apache server # -HTDOCS="/var/www/localhost/htdocs" +HTDOCS="/var/www" -cecho-n "Copying test results to winnetou.." ssh $SSHCONF root@${ipv4_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1 scp $SSHCONF -r $TODAYDIR root@${ipv4_winnetou}:$HTDOCS/testresults > /dev/null 2>&1 ssh $SSHCONF root@${ipv4_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1 -cgecho "done" -cecho "" -cecho "The results are available in $TODAYDIR" -cecho "or via the link http://$ipv4_winnetou/testresults/$TESTDATE" - - -########################################################################## -# close ssh sessions -# -for host in $STRONGSWANHOSTS -do - kill `eval echo \\\$ssh_pid_$host` -done +echo +echo "The results are available in $TODAYDIR" +echo "or via the link http://$ipv4_winnetou/testresults/$TESTDATE" +ENDDATE=`date +%Y%m%d-%H%M` +echo +echo "Finished : $ENDDATE" diff --git a/testing/hosts/alice/etc/conf.d/hostname b/testing/hosts/alice/etc/conf.d/hostname deleted file mode 100644 index 2012e0451..000000000 --- a/testing/hosts/alice/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=alice diff --git a/testing/hosts/alice/etc/conf.d/net b/testing/hosts/alice/etc/conf.d/net deleted file mode 100644 index 41e8887c4..000000000 --- a/testing/hosts/alice/etc/conf.d/net +++ /dev/null @@ -1,12 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0" - "PH_IP6_ALICE/16" ) -config_eth1=( "PH_IP_ALICE1 broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_ALICE1/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via PH_IP_MOON1" ) diff --git a/testing/hosts/alice/etc/freeradius/clients.conf b/testing/hosts/alice/etc/freeradius/clients.conf new file mode 100644 index 000000000..5fb47a2ad --- /dev/null +++ b/testing/hosts/alice/etc/freeradius/clients.conf @@ -0,0 +1,4 @@ +client 10.1.0.1 { + secret = gv6URkSs + shortname = moon +} diff --git a/testing/hosts/alice/etc/freeradius/dictionary b/testing/hosts/alice/etc/freeradius/dictionary new file mode 100644 index 000000000..59a874b3e --- /dev/null +++ b/testing/hosts/alice/etc/freeradius/dictionary @@ -0,0 +1,32 @@ +# +# This is the master dictionary file, which references the +# pre-defined dictionary files included with the server. +# +# Any new/changed attributes MUST be placed in this file, as +# the pre-defined dictionaries SHOULD NOT be edited. +# +# $Id$ +# + +# +# The filename given here should be an absolute path. +# +$INCLUDE /usr/local/share/freeradius/dictionary + +# +# Place additional attributes or $INCLUDEs here. They will +# over-ride the definitions in the pre-defined dictionaries. +# +# See the 'man' page for 'dictionary' for information on +# the format of the dictionary files. + +# +# If you want to add entries to the dictionary file, +# which are NOT going to be placed in a RADIUS packet, +# add them here. The numbers you pick should be between +# 3000 and 4000. +# + +#ATTRIBUTE My-Local-String 3000 string +#ATTRIBUTE My-Local-IPAddr 3001 ipaddr +#ATTRIBUTE My-Local-Integer 3002 integer diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/hosts/alice/etc/freeradius/radiusd.conf index 1143a0473..e4f721738 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf +++ b/testing/hosts/alice/etc/freeradius/radiusd.conf @@ -5,16 +5,16 @@ exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb +logdir = ${localstatedir}/log/freeradius +raddbdir = ${sysconfdir}/freeradius radacctdir = ${logdir}/radacct # name of the running server. See also the "-n" command-line option. -name = radiusd +name = freeradius # Location of config and logfiles. confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd +run_dir = ${localstatedir}/run # Should likely be ${localstatedir}/lib/radiusd db_dir = ${raddbdir} @@ -37,7 +37,7 @@ max_requests = 1024 # listen: Make the server listen on a particular IP address, and send listen { type = auth - ipaddr = PH_IP_ALICE + ipaddr = 10.1.0.10 port = 0 } @@ -46,7 +46,7 @@ listen { # listen { type = acct - ipaddr = PH_IP_ALICE + ipaddr = 10.1.0.10 port = 0 } @@ -66,9 +66,9 @@ log { file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes + auth = yes + auth_badpass = yes + auth_goodpass = yes } # The program to execute to do concurrency checks. diff --git a/testing/hosts/alice/etc/hostname b/testing/hosts/alice/etc/hostname new file mode 100644 index 000000000..c9fc40bfb --- /dev/null +++ b/testing/hosts/alice/etc/hostname @@ -0,0 +1 @@ +alice diff --git a/testing/hosts/alice/etc/init.d/iptables b/testing/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 1097ac5a4..000000000 --- a/testing/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/alice/etc/init.d/net.eth0 b/testing/hosts/alice/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/alice/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/alice/etc/init.d/net.eth1 b/testing/hosts/alice/etc/init.d/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/alice/etc/init.d/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/alice/etc/init.d/radiusd b/testing/hosts/alice/etc/init.d/radiusd deleted file mode 100755 index 8334385f9..000000000 --- a/testing/hosts/alice/etc/init.d/radiusd +++ /dev/null @@ -1,64 +0,0 @@ -#!/sbin/runscript - -opts="${opts} reload" - -depend() { - need net - use dns -} - -checkconfig() { - # set the location of log files - if ! cd /var/log/radius ; then - eerror "Failed to change current directory to /var/log/radius" - return 1 - fi - - if [ ! -d /var/run/radiusd ] && ! mkdir /var/run/radiusd ; then - eerror "Failed to create /var/run/radiusd" - return 1 - fi - - if [ ! -f /etc/raddb/radiusd.conf ] ; then - eerror "No /etc/raddb/radiusd.conf file exists!" - return 1 - fi - - RADIUSD_OPTS="-xx" - RADIUSD_USER=`grep '^ *user *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3` - RADIUSD_GROUP=`grep '^ *group *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3` - if [ -n "${RADIUSD_USER}" ] && ! getent passwd ${RADIUSD_USER} > /dev/null ; then - eerror "${RADIUSD_USER} user missing!" - return 1 - fi - if [ -n "${RADIUSD_GROUP}" ] && ! getent group ${RADIUSD_GROUP} > /dev/null ; then - eerror "${RADIUSD_GROUP} group missing!" - return 1 - fi - - # radius.log is created before privileges are dropped - need to set proper permissions on it - [ -f radius.log ] || touch radius.log || return 1 - - chown -R "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" . /var/run/radiusd && \ - chmod -R u+rwX,g+rX . /var/run/radiusd || return 1 -} - -start() { - checkconfig || return 1 - - ebegin "Starting radiusd" - start-stop-daemon --start --quiet --exec /usr/sbin/radiusd -- ${RADIUSD_OPTS} >/dev/null - eend $? -} - -stop () { - ebegin "Stopping radiusd" - start-stop-daemon --stop --quiet --pidfile=/var/run/radiusd/radiusd.pid - eend $? -} - -reload () { - ebegin "Reloading radiusd" - kill -HUP `</var/run/radiusd/radiusd.pid` - eend $? -} diff --git a/testing/hosts/alice/etc/ipsec.conf b/testing/hosts/alice/etc/ipsec.conf index 0671537e9..6d8aa629d 100755..100644 --- a/testing/hosts/alice/etc/ipsec.conf +++ b/testing/hosts/alice/etc/ipsec.conf @@ -13,7 +13,7 @@ conn nat-t leftcert=aliceCert.pem leftid=alice@strongswan.org leftfirewall=yes - right=PH_IP_SUN + right=192.168.0.2 rightid=@sun.strongswan.org rightsubnet=10.2.0.0/16 auto=add diff --git a/testing/hosts/alice/etc/network/interfaces b/testing/hosts/alice/etc/network/interfaces new file mode 100644 index 000000000..6fcbaa597 --- /dev/null +++ b/testing/hosts/alice/etc/network/interfaces @@ -0,0 +1,20 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 10.1.0.10 + netmask 255.255.0.0 + broadcast 10.1.255.255 + gateway 10.1.0.1 +iface eth0 inet6 static + address fec1::10 + netmask 16 + +iface eth1 inet static + address 192.168.0.50 + netmask 255.255.255.0 + broadcast 192.168.0.255 +iface eth1 inet6 static + address fec0::5 + netmask 16 diff --git a/testing/hosts/alice/etc/runlevels/default/net.eth0 b/testing/hosts/alice/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/alice/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/bob/etc/conf.d/hostname b/testing/hosts/bob/etc/conf.d/hostname deleted file mode 100644 index bbf5a2ea6..000000000 --- a/testing/hosts/bob/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=bob diff --git a/testing/hosts/bob/etc/conf.d/net b/testing/hosts/bob/etc/conf.d/net deleted file mode 100644 index bd0b3a5ce..000000000 --- a/testing/hosts/bob/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_BOB broadcast 10.2.255.255 netmask 255.255.0.0" - "PH_IP6_BOB/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via PH_IP_SUN1" ) diff --git a/testing/hosts/bob/etc/hostname b/testing/hosts/bob/etc/hostname new file mode 100644 index 000000000..696fb6baa --- /dev/null +++ b/testing/hosts/bob/etc/hostname @@ -0,0 +1 @@ +bob diff --git a/testing/hosts/bob/etc/init.d/iptables b/testing/hosts/bob/etc/init.d/iptables deleted file mode 100755 index 7b8756b81..000000000 --- a/testing/hosts/bob/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/bob/etc/init.d/net.eth0 b/testing/hosts/bob/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/bob/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/bob/etc/ipsec.conf b/testing/hosts/bob/etc/ipsec.conf index 5896c3436..5896c3436 100755..100644 --- a/testing/hosts/bob/etc/ipsec.conf +++ b/testing/hosts/bob/etc/ipsec.conf diff --git a/testing/hosts/bob/etc/network/interfaces b/testing/hosts/bob/etc/network/interfaces new file mode 100644 index 000000000..eca4f8fe7 --- /dev/null +++ b/testing/hosts/bob/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 10.2.0.10 + netmask 255.255.0.0 + broadcast 10.2.255.255 + gateway 10.2.0.1 +iface eth0 inet6 static + address fec2::10 + netmask 16 diff --git a/testing/hosts/bob/etc/runlevels/default/net.eth0 b/testing/hosts/bob/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/bob/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/carol/etc/conf.d/hostname b/testing/hosts/carol/etc/conf.d/hostname deleted file mode 100644 index d5101b924..000000000 --- a/testing/hosts/carol/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=carol diff --git a/testing/hosts/carol/etc/conf.d/net b/testing/hosts/carol/etc/conf.d/net deleted file mode 100644 index f7f685942..000000000 --- a/testing/hosts/carol/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_CAROL broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_CAROL/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/carol/etc/hostname b/testing/hosts/carol/etc/hostname new file mode 100644 index 000000000..da4b06358 --- /dev/null +++ b/testing/hosts/carol/etc/hostname @@ -0,0 +1 @@ +carol diff --git a/testing/hosts/carol/etc/init.d/iptables b/testing/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 6ff11a424..000000000 --- a/testing/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/carol/etc/init.d/net.eth0 b/testing/hosts/carol/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/carol/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/carol/etc/ipsec.conf b/testing/hosts/carol/etc/ipsec.conf index 0848ee716..d2d481b68 100755..100644 --- a/testing/hosts/carol/etc/ipsec.conf +++ b/testing/hosts/carol/etc/ipsec.conf @@ -9,11 +9,11 @@ conn %default keyingtries=1 conn home - left=PH_IP_CAROL + left=192.168.0.100 leftcert=carolCert.pem leftid=carol@strongswan.org leftfirewall=yes - right=PH_IP_MOON + right=192.168.0.1 rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add diff --git a/testing/hosts/carol/etc/network/interfaces b/testing/hosts/carol/etc/network/interfaces new file mode 100644 index 000000000..67bc73359 --- /dev/null +++ b/testing/hosts/carol/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.100 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::10 + netmask 16 diff --git a/testing/hosts/carol/etc/runlevels/default/net.eth0 b/testing/hosts/carol/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/carol/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/dave/etc/conf.d/hostname b/testing/hosts/dave/etc/conf.d/hostname deleted file mode 100644 index c3fabf331..000000000 --- a/testing/hosts/dave/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=dave diff --git a/testing/hosts/dave/etc/conf.d/net b/testing/hosts/dave/etc/conf.d/net deleted file mode 100644 index 2b902525a..000000000 --- a/testing/hosts/dave/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_DAVE broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_DAVE/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/dave/etc/hostname b/testing/hosts/dave/etc/hostname new file mode 100644 index 000000000..9fcf7b10e --- /dev/null +++ b/testing/hosts/dave/etc/hostname @@ -0,0 +1 @@ +dave diff --git a/testing/hosts/dave/etc/init.d/iptables b/testing/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 6ff11a424..000000000 --- a/testing/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/dave/etc/init.d/net.eth0 b/testing/hosts/dave/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/dave/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/dave/etc/ipsec.conf b/testing/hosts/dave/etc/ipsec.conf index 96502581e..5c546e260 100755..100644 --- a/testing/hosts/dave/etc/ipsec.conf +++ b/testing/hosts/dave/etc/ipsec.conf @@ -9,11 +9,11 @@ conn %default keyingtries=1 conn home - left=PH_IP_DAVE + left=192.168.0.200 leftcert=daveCert.pem leftid=dave@strongswan.org leftfirewall=yes - right=PH_IP_MOON + right=192.168.0.1 rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add diff --git a/testing/hosts/dave/etc/network/interfaces b/testing/hosts/dave/etc/network/interfaces new file mode 100644 index 000000000..59e526751 --- /dev/null +++ b/testing/hosts/dave/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.200 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::20 + netmask 16 diff --git a/testing/hosts/dave/etc/runlevels/default/net.eth0 b/testing/hosts/dave/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/dave/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/default/etc/default/slapd b/testing/hosts/default/etc/default/slapd new file mode 100644 index 000000000..a4a0a6e2a --- /dev/null +++ b/testing/hosts/default/etc/default/slapd @@ -0,0 +1,45 @@ +# Default location of the slapd.conf file or slapd.d cn=config directory. If +# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to +# /etc/ldap/slapd.conf). +SLAPD_CONF=/etc/ldap/slapd.conf + +# System account to run the slapd server under. If empty the server +# will run as root. +SLAPD_USER="openldap" + +# System group to run the slapd server under. If empty the server will +# run in the primary group of its user. +SLAPD_GROUP="openldap" + +# Path to the pid file of the slapd server. If not set the init.d script +# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by +# default) +SLAPD_PIDFILE= + +# slapd normally serves ldap only on all TCP-ports 389. slapd can also +# service requests on TCP-port 636 (ldaps) and requests via unix +# sockets. +# Example usage: +# SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///" +SLAPD_SERVICES="ldap:///" + +# If SLAPD_NO_START is set, the init script will not start or restart +# slapd (but stop will still work). Uncomment this if you are +# starting slapd via some other means or if you don't want slapd normally +# started at boot. +#SLAPD_NO_START=1 + +# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists, +# the init script will not start or restart slapd (but stop will still +# work). Use this for temporarily disabling startup of slapd (when doing +# maintenance, for example, or through a configuration management system) +# when you don't want to edit a configuration file. +SLAPD_SENTINEL_FILE=/etc/ldap/noslapd + +# For Kerberos authentication (via SASL), slapd by default uses the system +# keytab file (/etc/krb5.keytab). To use a different keytab file, +# uncomment this line and change the path. +#export KRB5_KTNAME=/etc/krb5.keytab + +# Additional options to pass to slapd +SLAPD_OPTIONS="" diff --git a/testing/hosts/default/etc/fstab b/testing/hosts/default/etc/fstab new file mode 100644 index 000000000..12747232e --- /dev/null +++ b/testing/hosts/default/etc/fstab @@ -0,0 +1 @@ +/hostshare /root/shared 9p trans=virtio,version=9p2000.L 0 0 diff --git a/testing/hosts/default/etc/ip6tables.flush b/testing/hosts/default/etc/ip6tables.flush new file mode 100644 index 000000000..c3f5a9254 --- /dev/null +++ b/testing/hosts/default/etc/ip6tables.flush @@ -0,0 +1,15 @@ +*filter + +-F + +-P INPUT ACCEPT +-P OUTPUT ACCEPT +-P FORWARD ACCEPT + +COMMIT + +*mangle + +-F + +COMMIT diff --git a/testing/hosts/default/etc/ip6tables.rules b/testing/hosts/default/etc/ip6tables.rules new file mode 100644 index 000000000..6a2c6af8e --- /dev/null +++ b/testing/hosts/default/etc/ip6tables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow last UDP fragment +-A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# allow crl and certficate fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/hosts/default/etc/iptables.drop b/testing/hosts/default/etc/iptables.drop new file mode 100644 index 000000000..445c45669 --- /dev/null +++ b/testing/hosts/default/etc/iptables.drop @@ -0,0 +1,12 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT diff --git a/testing/hosts/default/etc/iptables.flush b/testing/hosts/default/etc/iptables.flush new file mode 100644 index 000000000..b3ab63c51 --- /dev/null +++ b/testing/hosts/default/etc/iptables.flush @@ -0,0 +1,21 @@ +*filter + +-F + +-P INPUT ACCEPT +-P OUTPUT ACCEPT +-P FORWARD ACCEPT + +COMMIT + +*nat + +-F + +COMMIT + +*mangle + +-F + +COMMIT diff --git a/testing/hosts/default/etc/iptables.rules b/testing/hosts/default/etc/iptables.rules new file mode 100644 index 000000000..c3f036cf9 --- /dev/null +++ b/testing/hosts/default/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT + +COMMIT diff --git a/testing/hosts/default/etc/profile.d/coredumps.sh b/testing/hosts/default/etc/profile.d/coredumps.sh new file mode 100644 index 000000000..ea44c0ef6 --- /dev/null +++ b/testing/hosts/default/etc/profile.d/coredumps.sh @@ -0,0 +1,5 @@ +#!/bin/sh -e + +ulimit -c unlimited >/dev/null 2>&1 +install -m 1777 -d /var/local/dumps >/dev/null 2>&1 +echo "/var/local/dumps/core.%e.%p" > /proc/sys/kernel/core_pattern diff --git a/testing/hosts/default/etc/rsyslog.conf b/testing/hosts/default/etc/rsyslog.conf new file mode 100644 index 000000000..9f76da36e --- /dev/null +++ b/testing/hosts/default/etc/rsyslog.conf @@ -0,0 +1,125 @@ +# /etc/rsyslog.conf Configuration file for rsyslog. +# +# For more information see +# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html + + +################# +#### MODULES #### +################# + +$ModLoad imuxsock # provides support for local system logging +$ModLoad imklog # provides kernel logging support +#$ModLoad immark # provides --MARK-- message capability + +# Don't drop messages +$SystemLogRateLimitInterval 0 +$RepeatedMsgReduction off + +# provides UDP syslog reception +#$ModLoad imudp +#$UDPServerRun 514 + +# provides TCP syslog reception +#$ModLoad imtcp +#$InputTCPServerRun 514 + + +########################### +#### GLOBAL DIRECTIVES #### +########################### + +# +# Use traditional timestamp format. +# To enable high precision timestamps, comment out the following line. +# +$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat + +# +# Set the default permissions for all log files. +# +$FileOwner root +$FileGroup adm +$FileCreateMode 0640 +$DirCreateMode 0755 +$Umask 0022 + +# +# Where to place spool and state files +# +$WorkDirectory /var/spool/rsyslog + +# +# Include all config files in /etc/rsyslog.d/ +# +$IncludeConfig /etc/rsyslog.d/*.conf + + +############### +#### RULES #### +############### + +# +# First some standard log files. Log by facility. +# +auth,authpriv.* /var/log/auth.log +*.*;auth,authpriv.none -/var/log/syslog +#cron.* /var/log/cron.log +daemon.* /var/log/daemon.log +kern.* -/var/log/kern.log +lpr.* -/var/log/lpr.log +mail.* -/var/log/mail.log +user.* -/var/log/user.log + +# +# Logging for the mail system. Split it up so that +# it is easy to write scripts to parse these files. +# +mail.info -/var/log/mail.info +mail.warn -/var/log/mail.warn +mail.err /var/log/mail.err + +# +# Logging for INN news system. +# +news.crit /var/log/news/news.crit +news.err /var/log/news/news.err +news.notice -/var/log/news/news.notice + +# +# Some "catch-all" log files. +# +*.=debug;\ + auth,authpriv.none;\ + news.none;mail.none -/var/log/debug +*.=info;*.=notice;*.=warn;\ + auth,authpriv.none;\ + cron,daemon.none;\ + mail,news.none -/var/log/messages + +# +# Emergencies are sent to everybody logged in. +# +*.emerg :omusrmsg:* + +# +# I like to have messages displayed on the console, but only on a virtual +# console I usually leave idle. +# +#daemon,mail.*;\ +# news.=crit;news.=err;news.=notice;\ +# *.=debug;*.=info;\ +# *.=notice;*.=warn /dev/tty8 + +# The named pipe /dev/xconsole is for the `xconsole' utility. To use it, +# you must invoke `xconsole' with the `-file' option: +# +# $ xconsole -file /dev/xconsole [...] +# +# NOTE: adjust the list below, or you'll go crazy if you have a reasonably +# busy site.. +# +daemon.*;mail.*;\ + news.err;\ + *.=debug;*.=info;\ + *.=notice;*.=warn |/dev/xconsole diff --git a/testing/hosts/default/etc/security/limits.conf b/testing/hosts/default/etc/security/limits.conf new file mode 100644 index 000000000..2658b3236 --- /dev/null +++ b/testing/hosts/default/etc/security/limits.conf @@ -0,0 +1,58 @@ +# /etc/security/limits.conf +# +#Each line describes a limit for a user in the form: +# +#<domain> <type> <item> <value> +# +#Where: +#<domain> can be: +# - an user name +# - a group name, with @group syntax +# - the wildcard *, for default entry +# - the wildcard %, can be also used with %group syntax, +# for maxlogin limit +# - NOTE: group and wildcard limits are not applied to root. +# To apply a limit to the root user, <domain> must be +# the literal username root. +# +#<type> can have the two values: +# - "soft" for enforcing the soft limits +# - "hard" for enforcing hard limits +# +#<item> can be one of the following: +# - core - limits the core file size (KB) +# - data - max data size (KB) +# - fsize - maximum filesize (KB) +# - memlock - max locked-in-memory address space (KB) +# - nofile - max number of open files +# - rss - max resident set size (KB) +# - stack - max stack size (KB) +# - cpu - max CPU time (MIN) +# - nproc - max number of processes +# - as - address space limit (KB) +# - maxlogins - max number of logins for this user +# - maxsyslogins - max number of logins on the system +# - priority - the priority to run user process with +# - locks - max number of file locks the user can hold +# - sigpending - max number of pending signals +# - msgqueue - max memory used by POSIX message queues (bytes) +# - nice - max nice priority allowed to raise to values: [-20, 19] +# - rtprio - max realtime priority +# - chroot - change root to directory (Debian-specific) +# +#<domain> <type> <item> <value> +# + +#* soft core 0 +#root hard core 100000 +#* hard rss 10000 +#@student hard nproc 20 +#@faculty soft nproc 20 +#@faculty hard nproc 50 +#ftp hard nproc 0 +#ftp - chroot /ftp +#@student - maxlogins 4 + +* soft core unlimited + +# End of file diff --git a/testing/hosts/default/etc/ssh/sshd_config b/testing/hosts/default/etc/ssh/sshd_config new file mode 100644 index 000000000..07b7e78e5 --- /dev/null +++ b/testing/hosts/default/etc/ssh/sshd_config @@ -0,0 +1,13 @@ +Port 22 +Protocol 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +UsePrivilegeSeparation no +PermitRootLogin yes +StrictModes no +PubkeyAuthentication no +PermitEmptyPasswords yes +PrintMotd no +PrintLastLog no +UsePAM no diff --git a/testing/hosts/default/etc/sysctl.conf b/testing/hosts/default/etc/sysctl.conf new file mode 100644 index 000000000..43010d52e --- /dev/null +++ b/testing/hosts/default/etc/sysctl.conf @@ -0,0 +1,62 @@ +# +# /etc/sysctl.conf - Configuration file for setting system variables +# See /etc/sysctl.d/ for additonal system variables +# See sysctl.conf (5) for information. +# + +#kernel.domainname = example.com + +# Uncomment the following to stop low-level messages on console +#kernel.printk = 3 4 1 3 + +##############################################################3 +# Functions previously found in netbase +# + +# Uncomment the next two lines to enable Spoof protection (reverse-path filter) +# Turn on Source Address Verification in all interfaces to +# prevent some spoofing attacks +#net.ipv4.conf.default.rp_filter=1 +#net.ipv4.conf.all.rp_filter=1 + +# Uncomment the next line to enable TCP/IP SYN cookies +# See http://lwn.net/Articles/277146/ +# Note: This may impact IPv6 TCP sessions too +#net.ipv4.tcp_syncookies=1 + +# Uncomment the next line to enable packet forwarding for IPv4 +net.ipv4.ip_forward=1 + +# Uncomment the next line to enable packet forwarding for IPv6 +# Enabling this option disables Stateless Address Autoconfiguration +# based on Router Advertisements for this host +net.ipv6.conf.all.forwarding=1 + + +################################################################### +# Additional settings - these settings can improve the network +# security of the host and prevent against some network attacks +# including spoofing attacks and man in the middle attacks through +# redirection. Some network environments, however, require that these +# settings are disabled so review and enable them as needed. +# +# Do not accept ICMP redirects (prevent MITM attacks) +#net.ipv4.conf.all.accept_redirects = 0 +#net.ipv6.conf.all.accept_redirects = 0 +# _or_ +# Accept ICMP redirects only for gateways listed in our default +# gateway list (enabled by default) +# net.ipv4.conf.all.secure_redirects = 1 +# +# Do not send ICMP redirects (we are not a router) +#net.ipv4.conf.all.send_redirects = 0 +# +# Do not accept IP source route packets (we are not a router) +#net.ipv4.conf.all.accept_source_route = 0 +#net.ipv6.conf.all.accept_source_route = 0 +# +# Log Martian Packets +#net.ipv4.conf.all.log_martians = 1 + +# Enable coredump for suid binaries +fs.suid_dumpable = 1 diff --git a/testing/hosts/default/root/.ssh/config b/testing/hosts/default/root/.ssh/config new file mode 100644 index 000000000..aa102a144 --- /dev/null +++ b/testing/hosts/default/root/.ssh/config @@ -0,0 +1,3 @@ +Host * + StrictHostKeyChecking no + UserKnownHostsFile /dev/null diff --git a/testing/hosts/default/usr/local/bin/expect-connection b/testing/hosts/default/usr/local/bin/expect-connection new file mode 100755 index 000000000..10a709255 --- /dev/null +++ b/testing/hosts/default/usr/local/bin/expect-connection @@ -0,0 +1,27 @@ +#!/bin/bash +# +# Wait until a given IPsec connection becomes available +# +# Params: +# $1 - connection name +# $2 - maximum time to wait in seconds, default is 5 seconds + +if [[ $# -lt 1 || $# -gt 2 ]] +then + echo "invalid arguments" + exit 1 +fi + +secs=$2 +[ ! $secs ] && secs=5 + +let steps=$secs*10 +for i in `seq 1 $steps` +do + ipsec statusall 2>&1 | grep ^[[:space:]]*$1: >/dev/null + [ $? -eq 0 ] && exit 0 + sleep 0.1 +done + +echo "Connection '$1' not available after $secs second(s)" +exit 1 diff --git a/testing/hosts/moon/etc/conf.d/hostname b/testing/hosts/moon/etc/conf.d/hostname deleted file mode 100644 index 78e695337..000000000 --- a/testing/hosts/moon/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=moon diff --git a/testing/hosts/moon/etc/conf.d/net b/testing/hosts/moon/etc/conf.d/net deleted file mode 100644 index 7f09fd8a5..000000000 --- a/testing/hosts/moon/etc/conf.d/net +++ /dev/null @@ -1,12 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_MOON broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_MOON/16" ) -config_eth1=( "PH_IP_MOON1 broadcast 10.1.255.255 netmask 255.255.0.0" - "PH_IP6_MOON1/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/moon/etc/hostname b/testing/hosts/moon/etc/hostname new file mode 100644 index 000000000..605185ef1 --- /dev/null +++ b/testing/hosts/moon/etc/hostname @@ -0,0 +1 @@ +moon diff --git a/testing/hosts/moon/etc/init.d/iptables b/testing/hosts/moon/etc/init.d/iptables deleted file mode 100755 index f5fa80b26..000000000 --- a/testing/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/moon/etc/init.d/net.eth0 b/testing/hosts/moon/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/moon/etc/init.d/net.eth1 b/testing/hosts/moon/etc/init.d/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/init.d/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/moon/etc/ipsec.conf b/testing/hosts/moon/etc/ipsec.conf index 6ee481e49..623e75d0a 100755..100644 --- a/testing/hosts/moon/etc/ipsec.conf +++ b/testing/hosts/moon/etc/ipsec.conf @@ -7,20 +7,20 @@ conn %default keylife=20m rekeymargin=3m keyingtries=1 - left=PH_IP_MOON + left=192.168.0.1 leftcert=moonCert.pem leftid=@moon.strongswan.org leftfirewall=yes conn net-net leftsubnet=10.1.0.0/16 - right=PH_IP_SUN + right=192.168.0.2 rightsubnet=10.2.0.0/16 rightid=@sun.strongswan.org auto=add - + conn host-host - right=PH_IP_SUN + right=192.168.0.2 rightid=@sun.strongswan.org auto=add diff --git a/testing/hosts/moon/etc/network/interfaces b/testing/hosts/moon/etc/network/interfaces new file mode 100644 index 000000000..fde2f102f --- /dev/null +++ b/testing/hosts/moon/etc/network/interfaces @@ -0,0 +1,21 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.1 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::1 + netmask 16 + +auto eth1 +iface eth1 inet static + address 10.1.0.1 + netmask 255.255.0.0 + broadcast 10.1.255.255 +iface eth1 inet6 static + address fec1::1 + netmask 16 diff --git a/testing/hosts/moon/etc/rc.local b/testing/hosts/moon/etc/rc.local new file mode 100755 index 000000000..8649a2bcb --- /dev/null +++ b/testing/hosts/moon/etc/rc.local @@ -0,0 +1,20 @@ +#!/bin/sh -e +# +# rc.local +# +# This script is executed at the end of each multiuser runlevel. +# Make sure that the script will "exit 0" on success or any other +# value on error. +# +# In order to enable or disable this script just change the execution +# bits. +# + +# Disable checksum offloading on eth1 because it does not currently work with +# libvirt and isc-dhcp-server running on venus, see [1] +# [1] - https://bugs.mageia.org/show_bug.cgi?id=1243 + +ethtool --offload eth1 tx off >/dev/null 2>&1 +ethtool --offload eth1 rx off >/dev/null 2>&1 + +exit 0 diff --git a/testing/hosts/moon/etc/runlevels/default/net.eth0 b/testing/hosts/moon/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/moon/etc/runlevels/default/net.eth1 b/testing/hosts/moon/etc/runlevels/default/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/moon/etc/runlevels/default/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/ssh_host_rsa_key.pub b/testing/hosts/ssh_host_rsa_key.pub deleted file mode 100644 index a5f71de4e..000000000 --- a/testing/hosts/ssh_host_rsa_key.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsxKfTm05po6leGD8C+M0eAR5EE4s1pQXc0D/dVlqrmfZ65h5BFQY9lnwpCvapV6OVqKWx8ICmeIH3OhaPxPPNKlU81f3d0xgh8BRJpWh459DYkRVa5f7ax5eeFE1lelj9s1d0seUl/IZolpJ8Wmt9TN1hwJ0mrkwN4670rb3urc= diff --git a/testing/hosts/sun/etc/conf.d/hostname b/testing/hosts/sun/etc/conf.d/hostname deleted file mode 100644 index bc042b68b..000000000 --- a/testing/hosts/sun/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=sun diff --git a/testing/hosts/sun/etc/conf.d/net b/testing/hosts/sun/etc/conf.d/net deleted file mode 100644 index 4a6370ab7..000000000 --- a/testing/hosts/sun/etc/conf.d/net +++ /dev/null @@ -1,14 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_SUN broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_SUN/16" ) -config_eth1=( "PH_IP_SUN1 broadcast 10.2.255.255 netmask 255.255.0.0" - "PH_IP6_SUN1/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) - - diff --git a/testing/hosts/sun/etc/hostname b/testing/hosts/sun/etc/hostname new file mode 100644 index 000000000..692699759 --- /dev/null +++ b/testing/hosts/sun/etc/hostname @@ -0,0 +1 @@ +sun diff --git a/testing/hosts/sun/etc/init.d/iptables b/testing/hosts/sun/etc/init.d/iptables deleted file mode 100755 index aeaf472fb..000000000 --- a/testing/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/sun/etc/init.d/net.eth0 b/testing/hosts/sun/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/sun/etc/init.d/net.eth1 b/testing/hosts/sun/etc/init.d/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/init.d/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/sun/etc/ipsec.conf b/testing/hosts/sun/etc/ipsec.conf index 277928ec1..2f979f122 100755..100644 --- a/testing/hosts/sun/etc/ipsec.conf +++ b/testing/hosts/sun/etc/ipsec.conf @@ -7,20 +7,20 @@ conn %default keylife=20m rekeymargin=3m keyingtries=1 - left=PH_IP_SUN + left=192.168.0.2 leftcert=sunCert.pem leftid=@sun.strongswan.org leftfirewall=yes conn net-net leftsubnet=10.2.0.0/16 - right=PH_IP_MOON + right=192.168.0.1 rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add conn host-host - right=PH_IP_MOON + right=192.168.0.1 rightid=@moon.strongswan.org auto=add diff --git a/testing/hosts/sun/etc/network/interfaces b/testing/hosts/sun/etc/network/interfaces new file mode 100644 index 000000000..841735af1 --- /dev/null +++ b/testing/hosts/sun/etc/network/interfaces @@ -0,0 +1,21 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.2 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::2 + netmask 16 + +auto eth1 +iface eth1 inet static + address 10.2.0.1 + netmask 255.255.0.0 + broadcast 10.2.255.255 +iface eth1 inet6 static + address fec2::1 + netmask 16 diff --git a/testing/hosts/sun/etc/runlevels/default/net.eth0 b/testing/hosts/sun/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/sun/etc/runlevels/default/net.eth1 b/testing/hosts/sun/etc/runlevels/default/net.eth1 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/sun/etc/runlevels/default/net.eth1 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/venus/etc/conf.d/hostname b/testing/hosts/venus/etc/conf.d/hostname deleted file mode 100644 index c9e3dd1d4..000000000 --- a/testing/hosts/venus/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=venus diff --git a/testing/hosts/venus/etc/conf.d/net b/testing/hosts/venus/etc/conf.d/net deleted file mode 100644 index 43ec97807..000000000 --- a/testing/hosts/venus/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_VENUS broadcast 10.1.255.255 netmask 255.255.0.0" - "PH_IP6_VENUS/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via PH_IP_MOON1" ) diff --git a/testing/hosts/venus/etc/hostname b/testing/hosts/venus/etc/hostname new file mode 100644 index 000000000..acf16d8be --- /dev/null +++ b/testing/hosts/venus/etc/hostname @@ -0,0 +1 @@ +venus diff --git a/testing/hosts/venus/etc/init.d/iptables b/testing/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 1097ac5a4..000000000 --- a/testing/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/venus/etc/init.d/net.eth0 b/testing/hosts/venus/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/venus/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/venus/etc/ipsec.conf b/testing/hosts/venus/etc/ipsec.conf index dd6a82f89..e4604cb44 100755..100644 --- a/testing/hosts/venus/etc/ipsec.conf +++ b/testing/hosts/venus/etc/ipsec.conf @@ -13,7 +13,7 @@ conn nat-t leftcert=venusCert.pem leftid=@venus.strongswan.org leftfirewall=yes - right=PH_IP_SUN + right=192.168.0.2 rightid=@sun.strongswan.org rightsubnet=10.2.0.0/16 auto=add diff --git a/testing/hosts/venus/etc/network/interfaces b/testing/hosts/venus/etc/network/interfaces new file mode 100644 index 000000000..9cbae6041 --- /dev/null +++ b/testing/hosts/venus/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 10.1.0.20 + netmask 255.255.0.0 + broadcast 10.1.255.255 + gateway 10.1.0.1 +iface eth0 inet6 static + address fec1::20 + netmask 16 diff --git a/testing/hosts/venus/etc/runlevels/default/net.eth0 b/testing/hosts/venus/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/venus/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text b/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text new file mode 100644 index 000000000..6f5f3011c --- /dev/null +++ b/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text @@ -0,0 +1 @@ +AddType text/plain .iptables .log .sql diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt b/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt deleted file mode 100644 index 0de3b268d..000000000 --- a/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt +++ /dev/null @@ -1,22 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ -MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS -b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE -BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u -Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y -X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f -FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc -4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/ -7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5 -gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr -K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud -DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw -ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD -VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg -Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/ -lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n -+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE -UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy -0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy -gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8= ------END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt b/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt deleted file mode 100644 index 956c217d9..000000000 --- a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt +++ /dev/null @@ -1,24 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEFTCCAv2gAwIBAgIBDjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ -MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS -b290IENBMB4XDTA1MDYwODE5MTcxNFoXDTEwMDYwNzE5MTcxNFowSjELMAkGA1UE -BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xIDAeBgNVBAMTF3dpbm5l -dG91LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC -AQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqXuh16Ahe3S5vZ -F56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/u7BlyqpBUtLa -r14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRBK2gQGBUULo26 -sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqVjlKyqG7vdggk -wW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3MuOP3FNHIRMd2H -AcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABo4IBCTCCAQUwCQYDVR0TBAIwADALBgNV -HQ8EBAMCA6gwHQYDVR0OBBYEFEMS0mbhrA4zDvmfKf4MntUNxkH4MG0GA1UdIwRm -MGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcG -A1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290 -IENBggEAMCIGA1UdEQQbMBmCF3dpbm5ldG91LnN0cm9uZ3N3YW4ub3JnMDkGA1Ud -HwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dh -bi5jcmwwDQYJKoZIhvcNAQEEBQADggEBACO4+j1Mwt/lbkopeSJst46uFh7OtegG -6IWNE30i3l3FIn9slSwAOMtmZR0hAF8sExvk61EPlzCR/d9trSJ5+gyjPkeF/enw -p61rxPMT13Grzomi9gYlk6Q/0zLmE9uYWEY69Q0bEIUcfdZfwB+F7kesa946JNMc -yHfVEhKtvzmns9ueG0S/8E+6MPDeJv+JHQ++SdWSvOVg6JNxXDGusnim2fjM2Aln -JmqA6iU4IaPl9DUCuXlLOVv/YhwhviNEbF94upyHq8xjOZdzPbKroHXg/2yvalAw -4aXc/ZsnFxqsq3i6a2Fj1Y4J7gYsNO/HwA0xvKz3loOTqHaJqO/qeow= ------END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key b/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key deleted file mode 100644 index 727027188..000000000 --- a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqX -uh16Ahe3S5vZF56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/ -u7BlyqpBUtLar14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRB -K2gQGBUULo26sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqV -jlKyqG7vdggkwW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3Mu -OP3FNHIRMd2HAcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABAoIBACYiWrCgl8B/c4Lz -Uay4Tlm8hvQ/zQJjY3v93EXwbB21hBV8qrYlt9zGfHqj+5q2vsbB9c0pzdO2VDba -EWueS2fUIWhglEG5VCebrztNCldx2O7jo9bMk8iBt+oLNaJunSK7ACeYHHGcE7dF -KZh1eyd7z4+SMBWZqmhO5ZisasQoHCusVGepcyyMGQNkc3XKJ6resGAsOqrOoq7Q -C4vO5Kkbnk8nnEGmQ/ldD8LwIyq1hzVLDiiqWXZgh6S5l4BEo7Dy3KYrZoZfVcZK -GMVhAI2+uA1ZqY9twpwryT6VZ3eK4DXF/COQntiBW5pLOpaqTOnKqiVmZFwfbo3u -cq8n5jkCgYEA5zgzRLifbM0q34c2HX8pTegh+BH7MGCxtcoU2uRPaXiGkqQObHI9 -aItrgUQp+pAmKSBnEWJKgKsOh2Uf5ogjIeNuruGG/AXw/Pw2ORHNueenhDuhu69T -E2I4yxT3PPYbdzJ4ylBElfgm9WTrv7Wi7wSSfgQ6rEFdWukXa5vvsqMCgYEA1K+q -m1Jv9MGVIVc6MxhuOOj2Ym+qcWt/Pjvg78rR8SRsKwHlGTuv1rdWUSXYDr3f2Nf7 -6DdbJtaSx5f8gY/UG34yGZx5FFbYV03vcCYBaLXsi/b6H7vb/VW74Y5g6bXqnprv -4mcdVU7xfyNFgdbLPAP9sYVLijPYDwm0Qq3cz/8CgYBKSJz4BBR8AQI4JBl3qoXb -mKtpJmW76iTN0amXlWgJ64XYkMptftpJvxj/w6V08WDBL77NL/XdlpcpWozAJJac -6ZOCrcQPLd15eZH2Dck5Y7pG2l2gjbgz7wdt/0NbG3pBdj6mSNlwEPR7PDwdMD6z -aZWi1LsA4lMaxO4YTVXZ3wKBgQCoFhTNH/+e/YawjNFQJFSn4WUnMn0Pmhc7xfLl -T/NPkqtx6dN3d7ZmCQrMow33yJOqOje5tFXzgc0KtNE4S8Uj3T4XA5SlQGVFyjAa -/85JRM2naA8RGVSpCCKuBeoNilnb8zL2SOvjyboN8oAyNuDzk2vh6ihjFsoASHkP -4XwLXQKBgQC0k6rzt/plIwEiP56XXOqwOxJj6kuE/hx1zGIiGT6lWiOsih20Ym2T -kYegVFvuDIWmSIAxGONWyee1lfnJbEuaHRixWQTnHUpqrU0FSnZTubnR3q/faZat -hrvLDdpa0ydAKoMEn3qUPSrh3CdBfi3KTQAQn2Mlk7bGHh9ICWi3vA== ------END RSA PRIVATE KEY----- diff --git a/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf b/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf deleted file mode 100644 index 72b7e0ea4..000000000 --- a/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf +++ /dev/null @@ -1,61 +0,0 @@ -# DefaultType: the default MIME type the server will use for a document -# if it cannot otherwise determine one, such as from filename extensions. -# If your server contains mostly text or HTML documents, "text/plain" is -# a good value. If most of your content is binary, such as applications -# or images, you may want to use "application/octet-stream" instead to -# keep browsers from trying to display binary files as though they are -# text. -DefaultType text/plain - -<IfModule mime_module> -# TypesConfig points to the file containing the list of mappings from -# filename extension to MIME-type. -TypesConfig /etc/mime.types - -# AddType allows you to add to or override the MIME configuration -# file specified in TypesConfig for specific file types. -#AddType application/x-gzip .tgz - -# AddEncoding allows you to have certain browsers uncompress -# information on the fly. Note: Not all browsers support this. -#AddEncoding x-compress .Z -#AddEncoding x-gzip .gz .tgz - -# If the AddEncoding directives above are commented-out, then you -# probably should define those extensions to indicate media types: -AddType application/x-compress .Z -AddType application/x-gzip .gz .tgz - -# AddHandler allows you to map certain file extensions to "handlers": -# actions unrelated to filetype. These can be either built into the server -# or added with the Action directive (see below) - -# To use CGI scripts outside of ScriptAliased directories: -# (You will also need to add "ExecCGI" to the "Options" directive.) -AddHandler cgi-script .cgi - -# For files that include their own HTTP headers: -#AddHandler send-as-is asis - -# For server-parsed imagemap files: -#AddHandler imap-file map - -# For type maps (negotiated resources): -AddHandler type-map var - -# Filters allow you to process content before it is sent to the client. -# -# To parse .shtml files for server-side includes (SSI): -# (You will also need to add "Includes" to the "Options" directive.) -#AddType text/html .shtml -#AddOutputFilter INCLUDES .shtml -</IfModule> - -<IfModule mime_magic_module> -# The mod_mime_magic module allows the server to use various hints from the -# contents of the file itself to determine its type. The MIMEMagicFile -# directive tells the module where the hint definitions are located. -MIMEMagicFile /etc/apache2/magic -</IfModule> - -# vim: ts=4 filetype=apache diff --git a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf b/testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost index 9a32412db..b76080e37 100644 --- a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf +++ b/testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost @@ -2,6 +2,8 @@ Listen 8880 +AddHandler cgi-script .cgi + <VirtualHost *:8880> ServerAdmin root@strongswan.org DocumentRoot /etc/openssl/ocsp diff --git a/testing/hosts/winnetou/etc/conf.d/hostname b/testing/hosts/winnetou/etc/conf.d/hostname deleted file mode 100644 index 1bfa5acbd..000000000 --- a/testing/hosts/winnetou/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=winnetou diff --git a/testing/hosts/winnetou/etc/conf.d/net b/testing/hosts/winnetou/etc/conf.d/net deleted file mode 100644 index 7fbc37014..000000000 --- a/testing/hosts/winnetou/etc/conf.d/net +++ /dev/null @@ -1,10 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_WINNETOU broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_WINNETOU/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via 192.168.0.254" ) diff --git a/testing/hosts/winnetou/etc/conf.d/slapd b/testing/hosts/winnetou/etc/conf.d/slapd deleted file mode 100644 index 8d9ac4787..000000000 --- a/testing/hosts/winnetou/etc/conf.d/slapd +++ /dev/null @@ -1,8 +0,0 @@ -# conf.d file for the openldap-2.1 series -# -# To enable both the standard unciphered server and the ssl encrypted -# one uncomment this line or set any other server starting options -# you may desire. -# -# OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'" -OPTS="-4" diff --git a/testing/hosts/winnetou/etc/init.d/apache2 b/testing/hosts/winnetou/etc/init.d/apache2 deleted file mode 100755 index 5f72d3090..000000000 --- a/testing/hosts/winnetou/etc/init.d/apache2 +++ /dev/null @@ -1,121 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2007 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="configtest fullstatus graceful gracefulstop modules reload" - -depend() { - need net - use mysql dns logger netmount postgresql - after sshd -} - -configtest() { - ebegin "Checking Apache Configuration" - checkconfig - eend $? -} - -checkconfig() { - SERVERROOT="${SERVERROOT:-/usr/lib/apache2}" - if [ ! -d ${SERVERROOT} ]; then - eerror "SERVERROOT does not exist: ${SERVERROOT}" - return 1 - fi - - CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}" - [ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}" - if [ ! -r "${CONFIGFILE}" ]; then - eerror "Unable to read configuration file: ${CONFIGFILE}" - return 1 - fi - - APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}" - APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}" - [ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}" - - APACHE2="/usr/sbin/apache2" - - ${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1 - ret=$? - if [ $ret -ne 0 ]; then - eerror "Apache2 has detected a syntax error in your configuration files:" - ${APACHE2} ${APACHE2_OPTS} -t - fi - - return $ret -} - -start() { - checkconfig || return 1 - ebegin "Starting apache2" - [ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache - - start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start - eend $? -} - -stop() { - checkconfig || return 1 - ebegin "Stopping apache2" - start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -reload() { - RELOAD_TYPE="${RELOAD_TYPE:-graceful}" - - checkconfig || return 1 - if [ "${RELOAD_TYPE}" = "restart" ]; then - ebegin "Restarting apache2" - start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - elif [ "${RELOAD_TYPE}" = "graceful" ]; then - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - else - eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2" - fi -} - -graceful() { - checkconfig || return 1 - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -gracefulstop() { - checkconfig || return 1 - - # zap! - if service_started "${myservice}"; then - mark_service_stopped "${myservice}" - fi - - ebegin "Gracefully stopping apache2" - # 28 is SIGWINCH - start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -modules() { - checkconfig || return 1 - - ${APACHE2} ${APACHE2_OPTS} -M 2>&1 -} - -status() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } ' -} - -fullstatus() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} -} diff --git a/testing/hosts/winnetou/etc/init.d/net.eth0 b/testing/hosts/winnetou/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/winnetou/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/hosts/winnetou/etc/init.d/slapd b/testing/hosts/winnetou/etc/init.d/slapd deleted file mode 100755 index d4c070b33..000000000 --- a/testing/hosts/winnetou/etc/init.d/slapd +++ /dev/null @@ -1,25 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/strongswan/testing/hosts/winnetou/etc/init.d/slapd,v 1.2 2005/05/31 14:04:43 as Exp $ - -depend() { - need net -} - -start() { - ebegin "Starting ldap-server" - eval start-stop-daemon --start --quiet --pidfile /var/run/openldap/slapd.pid --exec /usr/lib/openldap/slapd -- -u ldap -g ldap "${OPTS}" - eend $? - if [ ! -e /var/lib/openldap-data/objectClass.bdb ] - then - sleep 5 - ldapadd -x -D "cn=Manager, o=Linux strongSwan, c=CH" -w tuxmux -f /etc/openldap/ldif.txt - fi -} - -stop() { - ebegin "Stopping ldap-server" - start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/slapd.pid - eend $? -} diff --git a/testing/hosts/winnetou/etc/openldap/ldif.txt b/testing/hosts/winnetou/etc/ldap/ldif.txt index 3eca4d6c6..d06621adb 100644 --- a/testing/hosts/winnetou/etc/openldap/ldif.txt +++ b/testing/hosts/winnetou/etc/ldap/ldif.txt @@ -28,7 +28,7 @@ cACertificate;binary:< file:///etc/openssl/research/researchCert.der dn: ou=Sales, o=Linux strongSwan, c=CH objectclass: organizationalUnit -ou: Sales +ou: Sales dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH objectClass: organizationalRole @@ -37,4 +37,3 @@ objectClass: certificationAuthority authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl cACertificate;binary:< file:///etc/openssl/sales/salesCert.der - diff --git a/testing/hosts/winnetou/etc/ldap/slapd.conf b/testing/hosts/winnetou/etc/ldap/slapd.conf new file mode 100644 index 000000000..103d4573f --- /dev/null +++ b/testing/hosts/winnetou/etc/ldap/slapd.conf @@ -0,0 +1,23 @@ +# +# See slapd.conf(5) for details on configuration options. +# This file should NOT be world readable. +# + +moduleload back_bdb.la + +include /etc/ldap/schema/core.schema + +pidfile /var/run/openldap/slapd.pid +argsfile /var/run/openldap/slapd.args + +####################################################################### +# BDB database definitions +####################################################################### + +database bdb +suffix "o=Linux strongSwan,c=CH" +rootdn "cn=Manager,o=Linux strongSwan,c=CH" +checkpoint 32 30 +rootpw tuxmux +directory /var/lib/ldap +index objectClass eq diff --git a/testing/hosts/winnetou/etc/network/interfaces b/testing/hosts/winnetou/etc/network/interfaces new file mode 100644 index 000000000..7bfb6a9f2 --- /dev/null +++ b/testing/hosts/winnetou/etc/network/interfaces @@ -0,0 +1,12 @@ +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet static + address 192.168.0.150 + netmask 255.255.255.0 + broadcast 192.168.0.255 + gateway 192.168.0.254 +iface eth0 inet6 static + address fec0::15 + netmask 16 diff --git a/testing/hosts/winnetou/etc/openldap/slapd.conf b/testing/hosts/winnetou/etc/openldap/slapd.conf deleted file mode 100644 index 5a99f955d..000000000 --- a/testing/hosts/winnetou/etc/openldap/slapd.conf +++ /dev/null @@ -1,68 +0,0 @@ -# -# See slapd.conf(5) for details on configuration options. -# This file should NOT be world readable. -# -include /etc/openldap/schema/core.schema - -# Define global ACLs to disable default read access. - -# Do not enable referrals until AFTER you have a working directory -# service AND an understanding of referrals. -#referral ldap://root.openldap.org - -pidfile /var/run/openldap/slapd.pid -argsfile /var/run/openldap/slapd.args - -# Load dynamic backend modules: -# modulepath /usr/lib/openldap/openldap -# moduleload back_bdb.la -# moduleload back_ldap.la -# moduleload back_ldbm.la -# moduleload back_passwd.la -# moduleload back_shell.la - -# Sample security restrictions -# Require integrity protection (prevent hijacking) -# Require 112-bit (3DES or better) encryption for updates -# Require 63-bit encryption for simple bind -# security ssf=1 update_ssf=112 simple_bind=64 - -# Sample access control policy: -# Root DSE: allow anyone to read it -# Subschema (sub)entry DSE: allow anyone to read it -# Other DSEs: -# Allow self write access -# Allow authenticated users read access -# Allow anonymous users to authenticate -# Directives needed to implement policy: -# access to dn.base="" by * read -# access to dn.base="cn=Subschema" by * read -# access to * -# by self write -# by users read -# by anonymous auth -# -# if no access controls are present, the default policy -# allows anyone and everyone to read anything but restricts -# updates to rootdn. (e.g., "access to * by * read") -# -# rootdn can always read and write EVERYTHING! - -####################################################################### -# BDB database definitions -####################################################################### - -database bdb -suffix "o=Linux strongSwan,c=CH" -rootdn "cn=Manager,o=Linux strongSwan,c=CH" -checkpoint 32 30 # <kbyte> <min> -# Cleartext passwords, especially for the rootdn, should -# be avoid. See slappasswd(8) and slapd.conf(5) for details. -# Use of strong authentication encouraged. -rootpw tuxmux -# The database directory MUST exist prior to running slapd AND -# should only be accessible by the slapd and slap tools. -# Mode 700 recommended. -directory /var/lib/openldap-data -# Indices to maintain -index objectClass eq diff --git a/testing/hosts/winnetou/etc/openssl/generate-crl b/testing/hosts/winnetou/etc/openssl/generate-crl index 60e53a0a4..839816bf5 100755 --- a/testing/hosts/winnetou/etc/openssl/generate-crl +++ b/testing/hosts/winnetou/etc/openssl/generate-crl @@ -16,30 +16,32 @@ export COMMON_NAME=strongSwan +ROOT=/var/www + cd /etc/openssl openssl ca -gencrl -crldays 30 -config /etc/openssl/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan.crl -cp strongswan.crl /var/www/localhost/htdocs/ -cp strongswanCert.pem /var/www/localhost/htdocs/ -cp index.html /var/www/localhost/htdocs/ +cp strongswan.crl ${ROOT} +cp strongswanCert.pem ${ROOT} +cp index.html ${ROOT} cd /etc/openssl/research openssl ca -gencrl -crldays 15 -config /etc/openssl/research/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out research.crl -cp research.crl /var/www/localhost/htdocs/ +cp research.crl ${ROOT} cd /etc/openssl/sales openssl ca -gencrl -crldays 15 -config /etc/openssl/sales/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out sales.crl -cp sales.crl /var/www/localhost/htdocs/ +cp sales.crl ${ROOT} cd /etc/openssl/ecdsa openssl ca -gencrl -crldays 15 -config /etc/openssl/ecdsa/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan_ec.crl -cp strongswan_ec.crl /var/www/localhost/htdocs/ +cp strongswan_ec.crl ${ROOT} cd /etc/openssl/monster openssl ca -gencrl -crldays 15 -config /etc/openssl/monster/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan-monster.crl -cp strongswan-monster.crl /var/www/localhost/htdocs/ +cp strongswan-monster.crl ${ROOT} cd /etc/openssl/rfc3779 openssl ca -gencrl -crldays 15 -config /etc/openssl/rfc3779/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan_rfc3779.crl -cp strongswan_rfc3779.crl /var/www/localhost/htdocs/ +cp strongswan_rfc3779.crl ${ROOT} diff --git a/testing/hosts/winnetou/etc/openssl/index.html b/testing/hosts/winnetou/etc/openssl/index.html index 1641768ae..8cbb2c482 100644 --- a/testing/hosts/winnetou/etc/openssl/index.html +++ b/testing/hosts/winnetou/etc/openssl/index.html @@ -20,10 +20,10 @@ </li> </ul> - <h2>strongSwan UML Testing Environment</h2> + <h2>strongSwan Testing Environment</h2> <ul> <li> - <a href="testresults/">UML Test Results</a> + <a href="testresults/">Test Results</a> </li> </ul> <a href="images/umlArchitecture_large.png" target="_blank"> diff --git a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index cb585ed08..a62fe16bd 100755 --- a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi index c193e8779..32405f81c 100755 --- a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi +++ b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl/research echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi index c53cb9a76..74a2aebc2 100755 --- a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi +++ b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl/sales echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/hosts/winnetou/etc/runlevels/default/apache2 b/testing/hosts/winnetou/etc/runlevels/default/apache2 deleted file mode 100755 index 5f72d3090..000000000 --- a/testing/hosts/winnetou/etc/runlevels/default/apache2 +++ /dev/null @@ -1,121 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2007 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="configtest fullstatus graceful gracefulstop modules reload" - -depend() { - need net - use mysql dns logger netmount postgresql - after sshd -} - -configtest() { - ebegin "Checking Apache Configuration" - checkconfig - eend $? -} - -checkconfig() { - SERVERROOT="${SERVERROOT:-/usr/lib/apache2}" - if [ ! -d ${SERVERROOT} ]; then - eerror "SERVERROOT does not exist: ${SERVERROOT}" - return 1 - fi - - CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}" - [ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}" - if [ ! -r "${CONFIGFILE}" ]; then - eerror "Unable to read configuration file: ${CONFIGFILE}" - return 1 - fi - - APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}" - APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}" - [ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}" - - APACHE2="/usr/sbin/apache2" - - ${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1 - ret=$? - if [ $ret -ne 0 ]; then - eerror "Apache2 has detected a syntax error in your configuration files:" - ${APACHE2} ${APACHE2_OPTS} -t - fi - - return $ret -} - -start() { - checkconfig || return 1 - ebegin "Starting apache2" - [ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache - - start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start - eend $? -} - -stop() { - checkconfig || return 1 - ebegin "Stopping apache2" - start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -reload() { - RELOAD_TYPE="${RELOAD_TYPE:-graceful}" - - checkconfig || return 1 - if [ "${RELOAD_TYPE}" = "restart" ]; then - ebegin "Restarting apache2" - start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - elif [ "${RELOAD_TYPE}" = "graceful" ]; then - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? - else - eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2" - fi -} - -graceful() { - checkconfig || return 1 - ebegin "Gracefully restarting apache2" - start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -gracefulstop() { - checkconfig || return 1 - - # zap! - if service_started "${myservice}"; then - mark_service_stopped "${myservice}" - fi - - ebegin "Gracefully stopping apache2" - # 28 is SIGWINCH - start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid - eend $? -} - -modules() { - checkconfig || return 1 - - ${APACHE2} ${APACHE2_OPTS} -M 2>&1 -} - -status() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } ' -} - -fullstatus() { - LYNX="${LYNX:-lynx -dump}" - STATUSURL="${STATUSURL:-http://localhost/server-status}" - - ${LYNX} ${STATUSURL} -} diff --git a/testing/hosts/winnetou/etc/runlevels/default/net.eth0 b/testing/hosts/winnetou/etc/runlevels/default/net.eth0 deleted file mode 100755 index 92b3851cf..000000000 --- a/testing/hosts/winnetou/etc/runlevels/default/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from <variable>_<option> to <variable>_<iface> -# option2 takes precedence over option1 -configure_variables() { - local iface="$1" option1="$2" option2="$3" - - local mod= func= x= i= - local -a ivars=() ovars1=() ovars2=() - local ifvar=$(bash_variable "${iface}") - - for mod in ${MODULES[@]}; do - is_function ${mod}_variables || continue - for v in $(${mod}_variables) ; do - x= - [[ -n ${option2} ]] && x="${v}_${option2}[@]" - [[ -z ${!x} ]] && x="${v}_${option1}[@]" - [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )" - done - done - - return 0 -} -# bool module_load_minimum(char *module) -# -# Does the minimum checking on a module - even when forcing -module_load_minimum() { - local f="$1.sh" MODULE="${1##*/}" - - if [[ ! -f ${f} ]] ; then - eerror "${f} does not exist" - return 1 - fi - - if ! source "${f}" ; then - eerror "${MODULE} failed a sanity check" - return 1 - fi - - for f in depend; do - is_function "${MODULE}_${f}" && continue - eerror "${MODULE}.sh does not support the required function ${f}" - return 1 - done - - return 0 -} - -# bool modules_load_auto() -# -# Load and check each module for sanity -# If the module is not installed, the functions are to be removed -modules_load_auto() { - local i j inst - - # Populate the MODULES array - # Basically we treat evey file in ${MODULES_DIR} as a module - MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) ) - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES_DIR}/${MODULES[i]}" - [[ ! -f ${MODULES[i]} ]] && unset MODULES[i] - done - MODULES=( "${MODULES[@]}" ) - - # Each of these sources into the global namespace, so it's - # important that module functions and variables are prefixed with - # the module name, for example iproute2_ - - j="${#MODULES[@]}" - loaded_interface=false - for (( i=0; i<j; i++ )); do - MODULES[i]="${MODULES[i]%.sh*}" - if [[ ${MODULES[i]##*/} == "interface" ]] ; then - eerror "interface is a reserved name - cannot load a module called interface" - return 1 - fi - - ( - u=0; - module_load_minimum "${MODULES[i]}" || u=1; - if [[ ${u} == 0 ]] ; then - inst="${MODULES[i]##*/}_check_installed"; - if is_function "${inst}" ; then - ${inst} false || u=1; - fi - fi - exit "${u}"; - ) - - if [[ $? == 0 ]] ; then - source "${MODULES[i]}.sh" - MODULES[i]="${MODULES[i]##*/}" - else - unset MODULES[i] - fi - done - - MODULES=( "${MODULES[@]}" ) - return 0 -} - -# bool modules_check_installed(void) -# -# Ensure that all modules have the required modules loaded -# This enables us to remove modules from the MODULES array -# Whilst other modules can still explicitly call them -# One example of this is essidnet which configures network -# settings for the specific ESSID connected to as the user -# may be using a daemon to configure wireless instead of our -# iwconfig module -modules_check_installed() { - local i j missingdeps nmods="${#MODULES[@]}" - - for (( i=0; i<nmods; i++ )); do - is_function "${MODULES[i]}_instlled" || continue - for j in $( ${MODULES[i]}_instlled ); do - missingdeps=true - if is_function "${j}_check_installed" ; then - ${j}_check_installed && missingdeps=false - elif is_function "${j}_depend" ; then - missingdeps=false - fi - ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) -} - -# bool modules_check_user(void) -modules_check_user() { - local iface="$1" ifvar=$(bash_variable "${IFACE}") - local i= j= k= l= nmods="${#MODULES[@]}" - local -a umods=() - - # Has the interface got any specific modules? - umods="modules_${ifvar}[@]" - umods=( "${!umods}" ) - - # Global setting follows interface-specific setting - umods=( "${umods[@]}" "${modules[@]}" ) - - # Add our preferred modules - local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" ) - umods=( "${umods[@]}" "${pmods[@]}" ) - - # First we strip any modules that conflict from user settings - # So if the user specifies pump then we don't use dhcpcd - for (( i=0; i<${#umods[@]}; i++ )); do - # Some users will inevitably put "dhcp" in their modules - # list. To keep users from screwing up their system this - # way, ignore this setting so that the default dhcp - # module will be used. - [[ ${umods[i]} == "dhcp" ]] && continue - - # We remove any modules we explicitly don't want - if [[ ${umods[i]} == "!"* ]] ; then - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${umods[i]:1} == "${MODULES[j]}" \ - || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then - # We may need to setup a class wrapper for it even though - # we don't use it directly - # However, we put it into an array and wrap later as - # another module may provide the same thing - ${MODULES[j]}_check_installed \ - && WRAP_MODULES=( - "${WRAP_MODULES[@]}" - "${MODULES[j]} ${PROVIDES[j]}" - ) - unset MODULES[j] - unset PROVIDES[j] - fi - done - continue - fi - - if ! is_function "${umods[i]}_depend" ; then - # If the module is one of our preferred modules, then - # ignore this error; whatever is available will be - # used instead. - (( i < ${#umods[@]} - ${#pmods[@]} )) || continue - - # The function may not exist because the modules software is - # not installed. Load the module and report its error - if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then - source "${MODULES_DIR}/${umods[i]}.sh" - is_function "${umods[i]}_check_installed" \ - && ${umods[i]}_check_installed true - else - eerror "The module \"${umods[i]}\" does not exist" - fi - return 1 - fi - - if is_function "${umods[i]}_provide" ; then - mod=$(${umods[i]}_provide) - else - mod="${umods[i]}" - fi - for (( j=0; j<nmods; j++ )); do - [[ -z ${MODULES[j]} ]] && continue - if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then - # We don't have a match - now ensure that we still provide an - # alternative. This is to handle our preferred modules. - for (( l=0; l<nmods; l++ )); do - [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue - if [[ ${PROVIDES[l]} == "${mod}" ]] ; then - unset MODULES[j] - unset PROVIDES[j] - break - fi - done - fi - done - done - - # Then we strip conflicting modules. - # We only need to do this for 3rd party modules that conflict with - # our own modules and the preferred list AND the user modules - # list doesn't specify a preference. - for (( i=0; i<nmods-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( j=i+1; j<nmods; j++)); do - [[ -z ${MODULES[j]} ]] && continue - [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \ - && unset MODULES[j] && unset PROVIDES[j] - done - done - - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - return 0 -} - -# void modules_sort(void) -# -# Sort our modules -modules_sort() { - local i= j= nmods=${#MODULES[@]} m= - local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=() - - # Make our provide list - for ((i=0; i<nmods; i++)); do - dead[i]="false" - if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then - local provided=false - for ((j=0; j<${#provide[@]}; j++)); do - if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then - provide_list[j]="${provide_list[j]} ${MODULES[i]}" - provided=true - fi - done - if ! ${provided}; then - provide[j]="${PROVIDES[i]}" - provide_list[j]="${MODULES[i]}" - fi - fi - done - - # Create an after array, which holds which modules the module at - # index i must be after - for ((i=0; i<nmods; i++)); do - if is_function "${MODULES[i]}_after" ; then - after[i]=" ${after[i]} $(${MODULES[i]}_after) " - fi - if is_function "${MODULES[i]}_before" ; then - for m in $(${MODULES[i]}_before); do - for ((j=0; j<nmods; j++)) ; do - if [[ ${PROVIDES[j]} == "${m}" ]] ; then - after[j]=" ${after[j]} ${MODULES[i]} " - break - fi - done - done - fi - done - - # Replace the after list modules with real modules - for ((i=0; i<nmods; i++)); do - if [[ -n ${after[i]} ]] ; then - for ((j=0; j<${#provide[@]}; j++)); do - after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }" - done - fi - done - - # We then use the below code to provide a topologial sort - module_after_visit() { - local name="$1" i= x= - - for ((i=0; i<nmods; i++)); do - [[ ${MODULES[i]} == "$1" ]] && break - done - - ${dead[i]} && return - dead[i]="true" - - for x in ${after[i]} ; do - module_after_visit "${x}" - done - - sorted=( "${sorted[@]}" "${MODULES[i]}" ) - sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" ) - } - - for x in ${MODULES[@]}; do - module_after_visit "${x}" - done - - MODULES=( "${sorted[@]}" ) - PROVIDES=( "${sortedp[@]}" ) -} - -# bool modules_check_depends(bool showprovides) -modules_check_depends() { - local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod= - local missingdeps= p= interface=false - - for (( i=0; i<nmods; i++ )); do - if is_function "${MODULES[i]}_need" ; then - for needmod in $(${MODULES[i]}_need); do - missingdeps=true - for (( j=0; j<nmods; j++ )); do - if [[ ${needmod} == "${MODULES[j]}" \ - || ${needmod} == "${PROVIDES[j]}" ]] ; then - missingdeps=false - break - fi - done - if ${missingdeps} ; then - eerror "${MODULES[i]} needs ${needmod} (dependency failure)" - return 1 - fi - done - fi - - if is_function "${MODULES[i]}_functions" ; then - for f in $(${MODULES[i]}_functions); do - if ! is_function "${f}" ; then - eerror "${MODULES[i]}: missing required function \"${f}\"" - return 1 - fi - done - fi - - [[ ${PROVIDES[i]} == "interface" ]] && interface=true - - if ${showprovides} ; then - [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \ - && veinfo "${MODULES[i]} provides ${PROVIDES[i]}" - fi - done - - if ! ${interface} ; then - eerror "no interface module has been loaded" - return 1 - fi - - return 0 -} - -# bool modules_load(char *iface, bool starting) -# -# Loads the defined handler and modules for the interface -# Returns 0 on success, otherwise 1 -modules_load() { - local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k= - local -a x=() - local RC_INDENTATION="${RC_INDENTATION}" - local -a PROVIDES=() WRAP_MODULES=() - - if ! is_loopback "${iface}" ; then - x="modules_force_${iface}[@]" - [[ -n ${!x} ]] && modules_force=( "${!x}" ) - if [[ -n ${modules_force} ]] ; then - ewarn "WARNING: You are forcing modules!" - ewarn "Do not complain or file bugs if things start breaking" - report=true - fi - fi - - veinfo "Loading networking modules for ${iface}" - eindent - - if [[ -z ${modules_force} ]] ; then - modules_load_auto || return 1 - else - j="${#modules_force[@]}" - for (( i=0; i<j; i++ )); do - module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1 - if is_function "${modules_force[i]}_check_installed" ; then - ${modules_force[i]}_check_installed || unset modules_force[i] - fi - done - MODULES=( "${modules_force[@]}" ) - fi - - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - # Now load our dependencies - we need to use the MODULE variable - # here as the after/before/need functions use it - MODULE="${MODULES[i]}" - ${MODULE}_depend - - # expose does exactly the same thing as depend - # However it is more "correct" as it exposes things to other modules - # instead of depending on them ;) - is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose - - # If no provide is given, assume module name - if is_function "${MODULES[i]}_provide" ; then - PROVIDES[i]=$(${MODULES[i]}_provide) - else - PROVIDES[i]="${MODULES[i]}" - fi - done - - if [[ -n ${modules_force[@]} ]] ; then - # Strip any duplicate modules providing the same thing - j="${#MODULES[@]}" - for (( i=0; i<j-1; i++ )); do - [[ -z ${MODULES[i]} ]] && continue - for (( k=i+1; k<j; k++ )); do - if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then - unset MODULES[k] - unset PROVIDES[k] - fi - done - done - MODULES=( "${MODULES[@]}" ) - PROVIDES=( "${PROVIDES[@]}" ) - else - if ${starting}; then - modules_check_user "${iface}" || return 1 - else - # Always prefer iproute2 for taking down interfaces - if is_function iproute2_provide ; then - function_wrap iproute2 "$(iproute2_provide)" - fi - fi - fi - - # Wrap our modules - j="${#MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap "${MODULES[i]}" "${PROVIDES[i]}" - done - j="${#WRAP_MODULES[@]}" - for (( i=0; i<j; i++ )); do - function_wrap ${WRAP_MODULES[i]} - done - - if [[ -z ${modules_force[@]} ]] ; then - modules_check_installed || return 1 - modules_sort || return 1 - fi - - veinfo "modules: ${MODULES[@]}" - eindent - - ${starting} && p=true - modules_check_depends "${p}" || return 1 - return 0 -} - -# bool iface_start(char *interface) -# -# iface_start is called from start. It's expected to start the base -# interface (for example "eth0"), aliases (for example "eth0:1") and to start -# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by -# calling itself recursively. -iface_start() { - local iface="$1" mod config_counter="-1" x config_worked=false - local RC_INDENTATION="${RC_INDENTATION}" - local -a config=() fallback=() fallback_route=() conf=() a=() b=() - local ifvar=$(bash_variable "$1") i= j= metric=0 - - # pre Start any modules with - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_start" ; then - ${mod}_pre_start "${iface}" || { eend 1; return 1; } - fi - done - - x="metric_${ifvar}" - # If we don't have a metric then calculate one - # Our modules will set the metric variable to a suitable base - # in their pre starts. - if [[ -z ${!x} ]] ; then - eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\"" - fi - - # We now expand the configuration parameters and pray that the - # fallbacks expand to the same number as config or there will be - # trouble! - a="config_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - config=( "${config[@]}" "${b[@]}" ) - done - - a="fallback_${ifvar}[@]" - a=( "${!a}" ) - for (( i=0; i<${#a[@]}; i++ )); do - eval b=( $(expand_parameters "${a[i]}") ) - fallback=( "${fallback[@]}" "${b[@]}" ) - done - - # We don't expand routes - fallback_route="fallback_route_${ifvar}[@]" - fallback_route=( "${!fallback_route}" ) - - # We must support old configs - if [[ -z ${config} ]] ; then - interface_get_old_config "${iface}" || return 1 - if [[ -n ${config} ]] ; then - ewarn "You are using a deprecated configuration syntax for ${iface}" - ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly" - fi - fi - - # Handle "noop" correctly - if [[ ${config[0]} == "noop" ]] ; then - if interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - return 0 - fi - - # Remove noop from the config var - config=( "${config[@]:1}" ) - fi - - # Provide a default of DHCP if no configuration is set and we're auto - # Otherwise a default of NULL - if [[ -z ${config} ]] ; then - ewarn "Configuration not set for ${iface} - assuming DHCP" - if is_function "dhcp_start" ; then - config=( "dhcp" ) - else - eerror "No DHCP client installed" - return 1 - fi - fi - - einfo "Bringing up ${iface}" - eindent - for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do - # Handle null and noop correctly - if [[ ${config[config_counter]} == "null" \ - || ${config[config_counter]} == "noop" ]] ; then - eend 0 - config_worked=true - continue - fi - - # We convert it to an array - this has the added - # bonus of trimming spaces! - conf=( ${config[config_counter]} ) - einfo "${conf[0]}" - - # Do we have a function for our config? - if is_function "${conf[0]}_start" ; then - eindent - ${conf[0]}_start "${iface}" ; x=$? - eoutdent - [[ ${x} == 0 ]] && config_worked=true && continue - # We need to test to see if it's an IP address or a function - # We do this by testing if the 1st character is a digit - elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then - x="0" - if ! is_loopback "${iface}" ; then - if [[ " ${MODULES[@]} " == *" arping "* ]] ; then - if arping_address_exists "${iface}" "${conf[0]}" ; then - eerror "${conf[0]%%/*} already taken on ${iface}" - x="1" - fi - fi - fi - [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?" - eend "${x}" && config_worked=true && continue - else - if [[ ${conf[0]} == "dhcp" ]] ; then - eerror "No DHCP client installed" - else - eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)" - fi - fi - - if [[ -n ${fallback[config_counter]} ]] ; then - einfo "Trying fallback configuration" - config[config_counter]="${fallback[config_counter]}" - fallback[config_counter]="" - - # Do we have a fallback route? - if [[ -n ${fallback_route[config_counter]} ]] ; then - x="fallback_route[config_counter]" - eval "routes_${ifvar}=( \"\${!x}\" )" - fallback_route[config_counter]="" - fi - - (( config_counter-- )) # since the loop will increment it - continue - fi - done - eoutdent - - # We return failure if no configuration parameters worked - ${config_worked} || return 1 - - # Start any modules with _post_start - for mod in ${MODULES[@]}; do - if is_function "${mod}_post_start" ; then - ${mod}_post_start "${iface}" || return 1 - fi - done - - return 0 -} - -# bool iface_stop(char *interface) -# -# iface_stop: bring down an interface. Don't trust information in -# /etc/conf.d/net since the configuration might have changed since -# iface_start ran. Instead query for current configuration and bring -# down the interface. -iface_stop() { - local iface="$1" i= aliases= need_begin=false mod= - local RC_INDENTATION="${RC_INDENTATION}" - - # pre Stop any modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_pre_stop" ; then - ${mod}_pre_stop "${iface}" || return 1 - fi - done - - einfo "Bringing down ${iface}" - eindent - - # Collect list of aliases for this interface. - # List will be in reverse order. - if interface_exists "${iface}" ; then - aliases=$(interface_get_aliases_rev "${iface}") - fi - - # Stop aliases before primary interface. - # Note this must be done in reverse order, since ifconfig eth0:1 - # will remove eth0:2, etc. It might be sufficient to simply remove - # the base interface but we're being safe here. - for i in ${aliases} ${iface}; do - # Stop all our modules - for mod in ${MODULES[@]}; do - if is_function "${mod}_stop" ; then - ${mod}_stop "${i}" || return 1 - fi - done - - # A module may have removed the interface - if ! interface_exists "${iface}" ; then - eend 0 - continue - fi - - # We don't delete ppp assigned addresses - if ! is_function pppd_exists || ! pppd_exists "${i}" ; then - # Delete all the addresses for this alias - interface_del_addresses "${i}" - fi - - # Do final shut down of this alias - if [[ ${IN_BACKGROUND} != "true" \ - && ${RC_DOWN_INTERFACE} == "yes" ]] ; then - ebegin "Shutting down ${i}" - interface_iface_stop "${i}" - eend "$?" - fi - done - - # post Stop any modules - for mod in ${MODULES[@]}; do - # We have already taken down the interface, so no need to error - is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}" - done - - return 0 -} - -# bool run_start(char *iface) -# -# Brings up ${IFACE}. Calls preup, iface_start, then postup. -# Returns 0 (success) unless preup or iface_start returns 1 (failure). -# Ignores the return value from postup. -# We cannot check that the device exists ourselves as modules like -# tuntap make create it. -run_start() { - local iface="$1" IFVAR=$(bash_variable "$1") - - # We do this so users can specify additional addresses for lo if they - # need too - additional routes too - # However, no extra modules are loaded as they are just not needed - if [[ ${iface} == "lo" ]] ; then - metric_lo="0" - config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" ) - elif [[ ${iface} == "lo0" ]] ; then - metric_lo0="0" - config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" ) - routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" ) - fi - - # We may not have a loaded module for ${iface} - # Some users may have "alias natsemi eth0" in /etc/modules.d/foo - # so we can work with this - # However, if they do the same with eth1 and try to start it - # but eth0 has not been loaded then the module gets loaded as - # eth0. - # Not much we can do about this :( - # Also, we cannot error here as some modules - such as bridge - # create interfaces - if ! interface_exists "${iface}" ; then - /sbin/modprobe "${iface}" &>/dev/null - fi - - # Call user-defined preup function if it exists - if is_function preup ; then - einfo "Running preup function" - eindent - ( preup "${iface}" ) - eend "$?" "preup ${iface} failed" || return 1 - eoutdent - fi - - # If config is set to noop and the interface is up with an address - # then we don't start it - local config= - config="config_${IFVAR}[@]" - config=( "${!config}" ) - if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then - einfo "Keeping current configuration for ${iface}" - eend 0 - else - # Remove noop from the config var - [[ ${config[0]} == "noop" ]] \ - && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )" - - # There may be existing ip address info - so we strip it - if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \ - && ${IN_BACKGROUND} != "true" ]] ; then - interface_del_addresses "${iface}" - fi - - # Start the interface - if ! iface_start "${iface}" ; then - if [[ ${IN_BACKGROUND} != "true" ]] ; then - interface_exists "${iface}" && interface_down "${iface}" - fi - eend 1 - return 1 - fi - fi - - # Call user-defined postup function if it exists - if is_function postup ; then - # We need to mark the service as started incase a - # postdown function wants to restart services that depend on us - mark_service_started "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postup function" - eindent - ( postup "${iface}" ) - eoutdent - fi - - return 0 -} - -# bool run_stop(char *iface) { -# -# Brings down ${iface}. If predown call returns non-zero, then -# stop returns non-zero to indicate failure bringing down device. -# In all other cases stop returns 0 to indicate success. -run_stop() { - local iface="$1" IFVAR=$(bash_variable "$1") x - - # Load our ESSID variable so users can use it in predown() instead - # of having to write code. - local ESSID=$(get_options ESSID) ESSIDVAR= - [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}") - - # Call user-defined predown function if it exists - if is_function predown ; then - einfo "Running predown function" - eindent - ( predown "${iface}" ) - eend $? "predown ${iface} failed" || return 1 - eoutdent - elif is_net_fs / ; then - eerror "root filesystem is network mounted -- can't stop ${iface}" - return 1 - elif is_union_fs / ; then - for x in $(unionctl "${dir}" --list \ - | sed -e 's/^\(.*\) .*/\1/') ; do - if is_net_fs "${x}" ; then - eerror "Part of the root filesystem is network mounted - cannot stop ${iface}" - return 1 - fi - done - fi - - iface_stop "${iface}" || return 1 # always succeeds, btw - - # Release resolv.conf information. - [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}" - - # Mark us as inactive if called from the background - [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}" - - # Call user-defined postdown function if it exists - if is_function postdown ; then - # We need to mark the service as stopped incase a - # postdown function wants to restart services that depend on us - [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}" - end_service "net.${iface}" 0 - einfo "Running postdown function" - eindent - ( postdown "${iface}" ) - eoutdent - fi - - - return 0 -} - -# bool run(char *iface, char *cmd) -# -# Main start/stop entry point -# We load modules here and remove any functions that they -# added as we may be called inside the same shell scope for another interface -run() { - local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}" - local starting=true - local -a MODULES=() mods=() - local IN_BACKGROUND="${IN_BACKGROUND}" - - if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then - IN_BACKGROUND=true - else - IN_BACKGROUND=false - fi - - # We need to override the exit function as runscript.sh now checks - # for it. We need it so we can mark the service as inactive ourselves. - unset -f exit - - eindent - [[ ${cmd} == "stop" ]] && starting=false - - # We force lo to only use these modules for a major speed boost - if is_loopback "${iface}" ; then - modules_force=( "iproute2" "ifconfig" "system" ) - fi - - if modules_load "${iface}" "${starting}" ; then - if [[ ${cmd} == "stop" ]] ; then - # Reverse the module list for stopping - mods=( "${MODULES[@]}" ) - for ((i = 0; i < ${#mods[@]}; i++)); do - MODULES[i]=${mods[((${#mods[@]} - i - 1))]} - done - - run_stop "${iface}" && r=0 - else - # Only hotplug on ethernet interfaces - if [[ ${IN_HOTPLUG} == 1 ]] ; then - if ! interface_is_ethernet "${iface}" ; then - eerror "We only hotplug for ethernet interfaces" - return 1 - fi - fi - - run_start "${iface}" && r=0 - fi - fi - - if [[ ${r} != "0" ]] ; then - if [[ ${cmd} == "start" ]] ; then - # Call user-defined failup if it exists - if is_function failup ; then - einfo "Running failup function" - eindent - ( failup "${iface}" ) - eoutdent - fi - else - # Call user-defined faildown if it exists - if is_function faildown ; then - einfo "Running faildown function" - eindent - ( faildown "${iface}" ) - eoutdent - fi - fi - [[ ${IN_BACKGROUND} == "true" ]] \ - && mark_service_inactive "net.${iface}" - fi - - return "${r}" -} - -# bool start(void) -# -# Start entry point so that we only have one function -# which localises variables and unsets functions -start() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Starting ${IFACE}" - run "${IFACE}" start -} - -# bool stop(void) -# -# Stop entry point so that we only have one function -# which localises variables and unsets functions -stop() { - declare -r IFACE="${SVCNAME#*.}" - einfo "Stopping ${IFACE}" - run "${IFACE}" stop -} - -# vim:ts=4 diff --git a/testing/make-testing b/testing/make-testing index 7cd3324e0..84ac20bf2 100755 --- a/testing/make-testing +++ b/testing/make-testing @@ -1,87 +1,27 @@ #!/bin/bash -# Create the strongSwan UML testing environment -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -DIR=`dirname $0` +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf -source $DIR/scripts/function.sh +rm -f $LOGFILE +mkdir -p $BUILDDIR -[ -f $DIR/testing.conf ] || die "!! Configuration file 'testing.conf' not found." - -source $DIR/testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -########################################################################## -# build the UML kernel based on a vanilla kernel form kernel.org -# and a matching UML patch from user-mode-linux.sourceforge.net -# -if [ $ENABLE_BUILD_UMLKERNEL = "yes" ] -then - cecho "Building uml kernel (scripts/build-umlkernel)" - $DIR/scripts/build-umlkernel -fi - -########################################################################## -# Adding the ssh RSA public keys to ~/.ssh/known_hosts -# -if [ $ENABLE_BUILD_SSHKEYS = "yes" ] -then - cecho "Adding ssh public keys of the uml instances (scripts/build-sshkeys)" - $DIR/scripts/build-sshkeys -fi - -########################################################################## -# copy the default UML host configurations to $BUILDDIR -# and assign actual IP addresses to the UML hosts -# -if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ] +if [ $ENABLE_BUILD_BASEIMAGE = "yes" ] then - cecho "Building host configurations (scripts/build-hostconfig)" - $DIR/scripts/build-hostconfig + $DIR/scripts/build-baseimage || exit 1 fi -########################################################################## -# build a generic UML root file system based on a Gentoo root file system. -# compile and install a specified strongSwan release into the file system. -# -if [ $ENABLE_BUILD_UMLROOTFS = "yes" ] +if [ $ENABLE_BUILD_ROOTIMAGE = "yes" ] then - cecho "Building uml root file system with strongSwan (scripts/build-umlrootfs)" - $DIR/scripts/build-umlrootfs + $DIR/scripts/build-rootimage || exit 1 fi -########################################################################## -# Creating the root filesystems for the specified UML instances -# -if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ] +if [ $ENABLE_BUILD_GUESTKERNEL = "yes" ] then - cecho "Building uml host root file systems (scripts/build-umlhostfs)" - $DIR/scripts/build-umlhostfs $HOSTS + $DIR/scripts/build-guestkernel || exit 1 fi -########################################################################## -# Start up the UML switches and designated UML instances -# -if [ $ENABLE_START_TESTING = "yes" ] +if [ $ENABLE_BUILD_GUESTIMAGES = "yes" ] then - cecho "Starting the uml switches and instances (start-testing)" - $DIR/start-testing $HOSTS + $DIR/scripts/build-guestimages $HOSTS || exit 1 fi diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage new file mode 100755 index 000000000..1355d7a05 --- /dev/null +++ b/testing/scripts/build-baseimage @@ -0,0 +1,79 @@ +#!/bin/bash + +echo "Building base image" + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +[ `id -u` -eq 0 ] || die "You must be root to run $0" + +check_commands debootstrap mkfs.ext3 partprobe qemu-img qemu-nbd sfdisk + +# package includes/excludes +INC=build-essential,gperf,libgmp-dev,libldap2-dev,libcurl4-openssl-dev,ethtool +INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc +INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libxerces-c2-dev,libltdl-dev +INC=$INC,liblog4cxx10-dev,libboost-thread-dev,libboost-system-dev,git-core +INC=$INC,less,acpid,acpi-support-base +SERVICES="apache2 dbus isc-dhcp-server slapd" +INC=$INC,${SERVICES// /,} +EXC=iptables + +CACHEDIR=$BUILDDIR/cache +APTCACHE=$LOOPDIR/var/cache/apt/archives + +mkdir -p $LOOPDIR +mkdir -p $CACHEDIR +mkdir -p $IMGDIR +rm -f $BASEIMG + +echo "`date`, building $BASEIMG" >>$LOGFILE + +load_qemu_nbd + +log_action "Creating base image $BASEIMG" +execute "qemu-img create -f $IMGEXT $BASEIMG ${BASEIMGSIZE}M" + +log_action "Connecting image to NBD device $NBDEV" +execute "qemu-nbd -c $NBDEV $BASEIMG" +do_on_exit qemu-nbd -d $NBDEV + +log_action "Partitioning disk" +sfdisk /dev/nbd0 -D -uM >>$LOGFILE 2>&1 << EOF +; +EOF +if [ $? != 0 ] +then + log_status 1 + exit 1 +else + log_status 0 +fi +partprobe $NBDEV + +log_action "Creating ext3 filesystem" +execute "mkfs.ext3 $NBDPARTITION" + +log_action "Mounting $NBDPARTITION to $LOOPDIR" +execute "mount $NBDPARTITION $LOOPDIR" +do_on_exit graceful_umount $LOOPDIR + +log_action "Using $CACHEDIR as archive for apt" +mkdir -p $APTCACHE +execute "mount -o bind $CACHEDIR $APTCACHE" +do_on_exit graceful_umount $APTCACHE + +log_action "Running debootstrap ($BASEIMGSUITE, $BASEIMGARCH)" +execute "debootstrap --arch=$BASEIMGARCH --include=$INC --exclude $EXC $BASEIMGSUITE $LOOPDIR $BASEIMGMIRROR" + +for service in $SERVICES +do + log_action "Stopping service $service" + execute_chroot "/etc/init.d/$service stop" + log_action "Disabling service $service" + execute_chroot "update-rc.d -f $service remove" +done + +log_action "Disabling root password" +execute_chroot "passwd -d root" diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages new file mode 100755 index 000000000..f5669040e --- /dev/null +++ b/testing/scripts/build-guestimages @@ -0,0 +1,65 @@ +#!/bin/bash +# create specific guest images +# +# Copyright (C) 2004 Eric Marchionni, Patrik Rayo +# Zuercher Hochschule Winterthur +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. + +echo "Creating guest images" + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +HOSTSDIR=$DIR/../hosts + +[ `id -u` -eq 0 ] || die "You must be root to run $0" +[ -f $ROOTIMG ] || die "Root image $ROOTIMG not found" +[ -f $HOSTDIR ] || die "Hosts directory $HOSTSDIR not found" + +check_commands partprobe qemu-img qemu-nbd + +load_qemu_nbd + +mkdir -p $IMGDIR +mkdir -p $LOOPDIR + +# just to be sure +do_on_exit qemu-nbd -d $NBDEV +do_on_exit umount $LOOPDIR + +for host in $STRONGSWANHOSTS +do + log_action "Creating guest image for $host" + execute "qemu-img create -b $ROOTIMG -f $IMGEXT $IMGDIR/$host.$IMGEXT" 0 + execute "qemu-nbd -c $NBDEV $IMGDIR/$host.$IMGEXT" 0 + partprobe $NBDEV + execute "mount $NBDPARTITION $LOOPDIR" 0 + execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0 + execute "cp -rf $HOSTSDIR/default/* $LOOPDIR" 0 + if [ "$host" = "winnetou" ] + then + execute "mkdir $LOOPDIR/var/log/apache2/ocsp" 0 + execute "cp -rf $DIR/../images $LOOPDIR/var/www/" 0 + execute_chroot "ln -s /etc/openssl/certs /var/www/certs" 0 + execute_chroot "/etc/openssl/generate-crl" 0 + execute_chroot "update-rc.d apache2 defaults" 0 + execute_chroot "update-rc.d slapd defaults" 0 + execute_chroot "rm -rf /var/lib/ldap/*" 0 + execute_chroot "slapadd -l /etc/ldap/ldif.txt -f /etc/ldap/slapd.conf" 0 + execute_chroot "chown -R openldap:openldap /var/lib/ldap" 0 + fi + sync + execute "umount $LOOPDIR" 0 + execute "qemu-nbd -d $NBDEV" 0 + log_status 0 +done diff --git a/testing/scripts/build-guestkernel b/testing/scripts/build-guestkernel new file mode 100755 index 000000000..66a9fe7a4 --- /dev/null +++ b/testing/scripts/build-guestkernel @@ -0,0 +1,49 @@ +#!/bin/bash + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +echo "Building guest kernel version $KERNELVERSION" + +[ -f "$KERNELCONFIG" ] || die "Kernel config $KERNELCONFIG not found" + +check_commands bunzip2 bzcat make wget + +cd $BUILDDIR + +if [ ! -f "$KERNELTARBALL" ] +then + url=ftp://ftp.kernel.org/pub/linux/kernel/v3.x/$KERNELTARBALL + log_action "Downloading $url" + execute "wget -q $url" +fi + +if [[ $KERNELPATCH && ! -f "$KERNELPATCH" ]] +then + url=http://download.strongswan.org/uml/$KERNELPATCH + log_action "Downloading $url" + execute "wget -q $url" +fi + +log_action "Unpacking kernel" +execute "tar xjf $KERNELTARBALL" + +KERNELDIR=$BUILDDIR/$KERNEL +cd $KERNELDIR + +if [ $KERNELPATCH ] +then + log_action "Applying kernel patch" + bzcat ../$KERNELPATCH | patch -p1 >>$LOGFILE 2>&1 + log_status $? + [ $? -eq 0 ] || exit 1 +fi + +execute "cp $KERNELCONFIG .config" 0 + +echo "Creating kernel configuration, you might get prompted for new parameters" +make oldconfig 2>&1 | tee -a $LOGFILE + +log_action "Compiling the kernel" +execute "make -j5" diff --git a/testing/scripts/build-hostconfig b/testing/scripts/build-hostconfig deleted file mode 100755 index 0ebbc5264..000000000 --- a/testing/scripts/build-hostconfig +++ /dev/null @@ -1,122 +0,0 @@ -#!/bin/bash -# build the hosts configuration directory with the actual IP addresses -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found" -[ -d $DIR/../hosts ] || die "!! Directory 'hosts' not found" - -source $DIR/../testing.conf - -if [ ! -d $BUILDDIR ] -then - cecho " * Creating directory '$BUILDDIR'" - mkdir $BUILDDIR -fi - -######################################## -# copy default host configs to $BUILDDIR -# - -HOSTCONFIGDIR=${BUILDDIR}/hosts - -if [ -d $HOSTCONFIGDIR ] -then - rm -r $HOSTCONFIGDIR -fi - -mkdir $HOSTCONFIGDIR -cp -rfp ${UMLTESTDIR}/testing/hosts $BUILDDIR - -cecho " * Copied default host config directory to '$HOSTCONFIGDIR'" - -######################################## -# assign IP for each host to hostname -# - -cecho-n " * Generate default config for.." - -HOSTIP=`ifconfig eth0 |grep inet |sed -e "s/.*inet addr://" -e "s/ Bcast.*//"` - -for host in $STRONGSWANHOSTS -do - cecho-n "${host}.." - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - eval ipv6_${host}="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - - [ "`eval echo \\\$ipv4_${host}`" != "$HOSTIP" ] || die "$host has the same IP as eth0 (Host)! Please change that." - - case $host in - moon) - eval ipv4_moon1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - [ "`eval echo \\\$ipv4_moon1`" != "$HOSTIP" ] || die "eth1 of $host has the same IP as eth0 (Host)! Please change that." - searchandreplace PH_IP_MOON1 $ipv4_moon1 $HOSTCONFIGDIR - searchandreplace PH_IP_MOON $ipv4_moon $HOSTCONFIGDIR - eval ipv6_moon1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_MOON1 $ipv6_moon1 $HOSTCONFIGDIR - searchandreplace PH_IP6_MOON $ipv6_moon $HOSTCONFIGDIR - ;; - sun) - eval ipv4_sun1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - [ "`eval echo \\\$ipv4_sun1`" != "$HOSTIP" ] || die "eth1 of $host has the same IP as eth0 (Host)! Please change that." - searchandreplace PH_IP_SUN1 $ipv4_sun1 $HOSTCONFIGDIR - searchandreplace PH_IP_SUN $ipv4_sun $HOSTCONFIGDIR - eval ipv6_sun1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_SUN1 $ipv6_sun1 $HOSTCONFIGDIR - searchandreplace PH_IP6_SUN $ipv6_sun $HOSTCONFIGDIR - ;; - alice) - eval ipv4_alice1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_ALICE1 $ipv4_alice1 $HOSTCONFIGDIR - searchandreplace PH_IP_ALICE $ipv4_alice $HOSTCONFIGDIR - eval ipv6_alice1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_ALICE1 $ipv6_alice1 $HOSTCONFIGDIR - searchandreplace PH_IP6_ALICE $ipv6_alice $HOSTCONFIGDIR - ;; - venus) - searchandreplace PH_IP_VENUS $ipv4_venus $HOSTCONFIGDIR - searchandreplace PH_IP6_VENUS $ipv6_venus $HOSTCONFIGDIR - ;; - bob) - searchandreplace PH_IP_BOB $ipv4_bob $HOSTCONFIGDIR - searchandreplace PH_IP6_BOB $ipv6_bob $HOSTCONFIGDIR - ;; - carol) - eval ipv4_carol1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_CAROL1 $ipv4_carol1 $HOSTCONFIGDIR - searchandreplace PH_IP_CAROL $ipv4_carol $HOSTCONFIGDIR - eval ipv6_carol1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_CAROL1 $ipv6_carol1 $HOSTCONFIGDIR - searchandreplace PH_IP6_CAROL $ipv6_carol $HOSTCONFIGDIR - ;; - dave) - eval ipv4_dave1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_DAVE1 $ipv4_dave1 $HOSTCONFIGDIR - searchandreplace PH_IP_DAVE $ipv4_dave $HOSTCONFIGDIR - eval ipv6_dave1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP6_DAVE1 $ipv6_dave1 $HOSTCONFIGDIR - searchandreplace PH_IP6_DAVE $ipv6_dave $HOSTCONFIGDIR - ;; - winnetou) - searchandreplace PH_IP_WINNETOU $ipv4_winnetou $HOSTCONFIGDIR - searchandreplace PH_IP6_WINNETOU $ipv6_winnetou $HOSTCONFIGDIR - ;; - esac -done - -cgecho "done" diff --git a/testing/scripts/build-rootimage b/testing/scripts/build-rootimage new file mode 100755 index 000000000..8e10ce5f3 --- /dev/null +++ b/testing/scripts/build-rootimage @@ -0,0 +1,67 @@ +#!/bin/bash +# Create guest root image +# +# Copyright (C) 2004 Eric Marchionni, Patrik Rayo +# Zuercher Hochschule Winterthur +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. + +echo "Building root image" + +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh + +[ `id -u` -eq 0 ] || die "You must be root to run $0" +[ -f "$BASEIMG" ] || die "Base image $BASEIMG not found" + +check_commands partprobe qemu-img qemu-nbd + +load_qemu_nbd + +mkdir -p $LOOPDIR +mkdir -p $SHAREDDIR/compile +mkdir -p $IMGDIR + +log_action "Creating root image $ROOTIMG" +execute "qemu-img create -b $BASEIMG -f $IMGEXT $ROOTIMG" + +log_action "Connecting root image to NBD device $NBDEV" +execute "qemu-nbd -c $NBDEV $ROOTIMG" +do_on_exit qemu-nbd -d $NBDEV +partprobe $NBDEV + +log_action "Mounting $NBDPARTITION to $LOOPDIR" +execute "mount $NBDPARTITION $LOOPDIR" +do_on_exit umount $LOOPDIR + +log_action "Mounting proc filesystem to $LOOPDIR/proc" +execute "mount -t proc none $LOOPDIR/proc" +do_on_exit umount $LOOPDIR/proc + +mkdir -p $LOOPDIR/root/shared +log_action "Mounting $SHAREDDIR as /root/shared" +execute "mount -o bind $SHAREDDIR $LOOPDIR/root/shared" +do_on_exit umount $LOOPDIR/root/shared + +echo "Installing software from source" +RECPDIR=$DIR/recipes +RECIPES=`ls $RECPDIR/*.mk | xargs -n1 basename` +execute "cp -r $RECPDIR/patches $LOOPDIR/root/shared/compile" 0 +for r in $RECIPES +do + cp $RECPDIR/$r ${LOOPDIR}/root/shared/compile + log_action "Installing from recipe $r" + execute_chroot "make SWANVERSION=$SWANVERSION -C /root/shared/compile -f $r" +done + +log_action "Removing /etc/resolv.conf" +execute "rm -f $LOOPDIR/etc/resolv.conf" diff --git a/testing/scripts/build-sshkeys b/testing/scripts/build-sshkeys deleted file mode 100755 index 799078557..000000000 --- a/testing/scripts/build-sshkeys +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# build the hosts configuration directory with the actual IP addresses -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found" -[ -d $DIR/../hosts ] || die "!! Directory 'hosts' not found" - -source $DIR/../testing.conf - -if [ ! -d $BUILDDIR ] -then - cecho " * Creating directory '$BUILDDIR'" - mkdir $BUILDDIR -fi - -LOGFILE=${BUILDDIR}/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -if [ ! -d ~/.ssh ] -then - cecho-n " * Creating directory '~/.ssh'.." - mkdir ~/.ssh - cgecho "done" -fi - -if [ -f ~/.ssh/known_hosts ] -then - cecho-n " * Backing up ~/.ssh/known_hosts to '~/.ssh/known_hosts.before_uml'.." - cp -fp ~/.ssh/known_hosts ~/.ssh/known_hosts.before_uml - cgecho "done" -else - cecho-n " * Creating '~/.ssh/known_hosts'" - touch ~/.ssh/known_hosts - cgecho "done" -fi - -for host in $HOSTNAMEIPV4 -do - HOSTNAME=`echo $host | awk -F, '{ print $1 }'` - IP=`echo $host | awk -F, '{ print $2 }'` - if [ `grep "$IP " ~/.ssh/known_hosts | wc -l` != "0" ] - then - cecho "!! Warning: An entry exists for the following IP address: $IP" - else - cecho-n " * Adding uml host $HOSTNAME ($IP) to '~/.ssh/known_hosts'.." - echo "$HOSTNAME,$IP `cat $DIR/../hosts/ssh_host_rsa_key.pub`" >> ~/.ssh/known_hosts - cgecho "done" - fi -done - -##################################### -# preparing ssh for PK authentication -# - -cecho-n " * Checking for ssh rsa key '~/.ssh/id_rsa.pub'.." -if [ -f ~/.ssh/id_rsa.pub ] -then - cecho "already exists" -else - cecho "not found" - cecho-n " * Generating ssh rsa key pair.." - echo "" | ssh-keygen -N "" -t rsa -f ~/.ssh/id_rsa >> $LOGFILE 2>&1 - cgecho "done" -fi diff --git a/testing/scripts/build-umlhostfs b/testing/scripts/build-umlhostfs deleted file mode 100755 index 75feaa4ed..000000000 --- a/testing/scripts/build-umlhostfs +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# create UML host file systems -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found." - -source $DIR/../testing.conf - -cd $BUILDDIR/root-fs - -[ -f gentoo-fs ] || die "!! Root file system 'gentoo-fs' not found." - -if [ ! -d $BUILDDIR ] -then - cecho-n " * Directory '$BUILDDIR' does not exist..creating.." - mkdir $BUILDDIR - cgecho "done" -fi - -LOGFILE=${BUILDDIR}/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -LOOPDIR=loop - -if [ ! -d $LOOPDIR ] -then - mkdir $LOOPDIR -fi - -cecho-n " * Creating root filesystem for.." - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -for host in $HOSTS -do - cecho-n "$host.." - cp gentoo-fs gentoo-fs-$host - mount -o loop gentoo-fs-$host $LOOPDIR - cp -rf $BUILDDIR/hosts/${host}/etc $LOOPDIR - if [ "$host" = "winnetou" ] - then - mkdir $LOOPDIR/var/log/apache2/ocsp - cp -rf $UMLTESTDIR/testing/images $LOOPDIR/var/www/localhost/htdocs - chroot $LOOPDIR ln -s /etc/openssl/certs /var/www/localhost/htdocs/certs - chroot $LOOPDIR /etc/openssl/generate-crl >> $LOGFILE 2>&1 - fi - chroot $LOOPDIR /etc/init.d/depscan.sh --update >> $LOGFILE 2>&1 - umount $LOOPDIR -done - -cgecho "done" diff --git a/testing/scripts/build-umlkernel b/testing/scripts/build-umlkernel deleted file mode 100755 index b9f0d710d..000000000 --- a/testing/scripts/build-umlkernel +++ /dev/null @@ -1,130 +0,0 @@ -#!/bin/bash -# build an UML kernel based on a vanilla kernel and UML patch -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -cecho-n " * Looking for kernel at '$KERNEL'.." -if [ -f "${KERNEL}" ] -then - cecho "found it" - KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'` - cecho " * Kernel version is $KERNELVERSION" -else - cecho "none" - exit -fi - -if [ ${UMLPATCH} ] -then - cecho-n " * Looking for uml patch at '$UMLPATCH'.." - if [ -f "${UMLPATCH}" ] - then - cecho "found it" - else - cecho "none" - exit - fi -fi - -cecho-n " * Looking for kernel config at '$KERNELCONFIG'.." -if [ -f "${KERNEL}" ] -then - cecho "found it" -else - cecho "none" - exit -fi - -####################################################### -# unpack kernel and create symlink -# - -if [ ! -d $BUILDDIR ] -then - cecho " * Creating directory '$BUILDDIR'" - mkdir $BUILDDIR -fi - -cecho " * Changing to directory '$BUILDDIR'" -cd $BUILDDIR - -LOGFILE=${BUILDDIR}/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -cecho-n " * Unpacking kernel.." -tar xjf $KERNEL >> $LOGFILE 2>&1 -cgecho "done" - -KERNELDIR=${BUILDDIR}/linux-${KERNELVERSION} - -if [ -d $KERNELDIR ] -then - cecho " * Kernel directory is '$KERNELDIR'" - cecho " * Creating symlink 'linux'" - if [ -d linux ] - then - rm linux - fi - ln -s linux-${KERNELVERSION} linux -else - cecho "!! Kernel directory '$KERNELDIR' can not be found" - exit -fi - -####################################################### -# patch kernel -# - -cecho " * Changing to directory '$KERNELDIR'" -cd $KERNELDIR - -if [ $UMLPATCH ] -then - cecho-n " * Applying uml patch.." - bzcat $UMLPATCH | patch -p1 >> $LOGFILE 2>&1 - cgecho "done" -fi - -####################################################### -# copy our default .config to linux and build kernel -# - -cp $KERNELCONFIG .config - -cecho "!!" -cecho "!! Making .config for kernel. You might be prompted for new parameters!" -cecho "!!" -make oldconfig ARCH=um SUBARCH=i386 2>&1 | tee -a $LOGFILE - -cecho-n " * Now compiling uml kernel.." -make linux ARCH=um SUBARCH=i386 >> $LOGFILE 2>&1 -cgecho "done" - -cecho-n " * Copying uml kernel to '${BUILDDIR}/linux-uml-${KERNELVERSION}'.." -mv linux ${BUILDDIR}/linux-uml-${KERNELVERSION} -cgecho "done" diff --git a/testing/scripts/build-umlrootfs b/testing/scripts/build-umlrootfs deleted file mode 100755 index 523a3b536..000000000 --- a/testing/scripts/build-umlrootfs +++ /dev/null @@ -1,461 +0,0 @@ -#!/bin/bash -# Create UML root filesystem -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -STRONGSWANVERSION=`basename $STRONGSWAN .tar.bz2` - -cecho-n " * Looking for strongSwan at '$STRONGSWAN'.." -if [ -f "$STRONGSWAN" ] -then - cecho "found it" - cecho " * strongSwan version is '$STRONGSWANVERSION'" -else - cecho "none" - exit -fi - -cecho-n " * Looking for gentoo root filesystem at '$ROOTFS'.." -if [ -f "$ROOTFS" ] -then - cecho "found it" -else - cecho "none" - exit -fi - -[ -d $BUILDDIR ] || die "!! Directory '$BUILDDIR' does not exist" - -HOSTCONFIGDIR=$BUILDDIR/hosts - -[ -d $HOSTCONFIGDIR ] || die "!! Directory '$HOSTCONFIGDIR' does not exist" - -LOGFILE=$BUILDDIR/testing.log - -if [ ! -f $LOGFILE ] -then - cecho-n " * Logfile '$LOGFILE' does not exist..creating.." - touch $LOGFILE - cgecho "done" -fi - -ROOTFSDIR=$BUILDDIR/root-fs - -if [ ! -d $ROOTFSDIR ] -then - cecho-n " * Root file system directory '$ROOTFSDIR' does not exist..creating.." - mkdir $ROOTFSDIR - cgecho "done" -fi - -cd $ROOTFSDIR - -LOOPDIR=$ROOTFSDIR/loop - -if [ ! -d $LOOPDIR ] -then - mkdir $LOOPDIR -fi - -###################################################### -# creating reiser-based uml root filesystem -# - -cecho-n " * Building basic root filesystem (gentoo).." -dd if=/dev/zero of=gentoo-fs count=$ROOTFSSIZE bs=1M >> $LOGFILE 2>&1 -mkreiserfs -q -f gentoo-fs >> $LOGFILE 2>&1 -mount -o loop gentoo-fs $LOOPDIR >> $LOGFILE 2>&1 -tar xjpf $ROOTFS -C $LOOPDIR >> $LOGFILE 2>&1 -cgecho "done" - -###################################################### -# remove /etc/resolv.conf -# -cecho " * Removing /etc/resolv.conf" -rm -f $LOOPDIR/etc/resolv.conf - -###################################################### -# copying default /etc/hosts to the root filesystem -# -cecho " * Copying '$HOSTCONFIGDIR/default/etc/hosts' to the root filesystem" -cp -fp $HOSTCONFIGDIR/default/etc/hosts $LOOPDIR/etc/hosts - -##################################################### -# extracting strongSwan into the root filesystem -# -cecho " * Extracting strongSwan into the root filesystem" -tar xjf $STRONGSWAN -C $LOOPDIR/root >> $LOGFILE 2>&1 - -###################################################### -# setting up mountpoint for shared source tree -# -if [ "${SHAREDTREE+set}" = "set" ]; then - cecho " * setting up shared strongswan tree at '$SHAREDTREE'" - mkdir $LOOPDIR/root/strongswan-shared - echo "" >> $LOOPDIR/etc/fstab - echo "none /root/strongswan-shared hostfs $SHAREDTREE" >> $LOOPDIR/etc/fstab -fi - -###################################################### -# installing strongSwan and setting the local timezone -# - -INSTALLSHELL=${LOOPDIR}/install.sh - -cecho " * Preparing strongSwan installation script" -echo "ln -sf /usr/share/zoneinfo/${TZUML} /etc/localtime" >> $INSTALLSHELL - -echo "cd /root/${STRONGSWANVERSION}" >> $INSTALLSHELL -echo -n "./configure --sysconfdir=/etc" >> $INSTALLSHELL -echo -n " --with-random-device=/dev/urandom" >> $INSTALLSHELL -echo -n " --disable-load-warning" >> $INSTALLSHELL - -if [ "$USE_LIBCURL" = "yes" ] -then - echo -n " --enable-curl" >> $INSTALLSHELL -fi - -if [ "$USE_LDAP" = "yes" ] -then - echo -n " --enable-ldap" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_AKA" = "yes" ] -then - echo -n " --enable-eap-aka" >> $INSTALLSHELL - echo -n " --enable-eap-aka-3gpp2" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_SIM" = "yes" ] -then - echo -n " --enable-eap-sim" >> $INSTALLSHELL - echo -n " --enable-eap-sim-file" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_MD5" = "yes" ] -then - echo -n " --enable-eap-md5" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_MSCHAPV2" = "yes" ] -then - echo -n " --enable-md4" >> $INSTALLSHELL - echo -n " --enable-eap-mschapv2" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_IDENTITY" = "yes" ] -then - echo -n " --enable-eap-identity" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_RADIUS" = "yes" ] -then - echo -n " --enable-eap-radius" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_DYNAMIC" = "yes" ] -then - echo -n " --enable-eap-dynamic" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_TLS" = "yes" ] -then - echo -n " --enable-eap-tls" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_TTLS" = "yes" ] -then - echo -n " --enable-eap-ttls" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_PEAP" = "yes" ] -then - echo -n " --enable-eap-peap" >> $INSTALLSHELL -fi - -if [ "$USE_EAP_TNC" = "yes" ] -then - echo -n " --enable-eap-tnc" >> $INSTALLSHELL -fi - -if [ "$USE_TNC_PDP" = "yes" ] -then - echo -n " --enable-tnc-pdp" >> $INSTALLSHELL -fi - -if [ "$USE_TNC_IMC" = "yes" ] -then - echo -n " --enable-tnc-imc" >> $INSTALLSHELL -fi - -if [ "$USE_TNC_IMV" = "yes" ] -then - echo -n " --enable-tnc-imv" >> $INSTALLSHELL -fi - -if [ "$USE_TNCCS_11" = "yes" ] -then - echo -n " --enable-tnccs-11" >> $INSTALLSHELL -fi - -if [ "$USE_TNCCS_20" = "yes" ] -then - echo -n " --enable-tnccs-20" >> $INSTALLSHELL -fi - -if [ "$USE_TNCCS_DYNAMIC" = "yes" ] -then - echo -n " --enable-tnccs-dynamic" >> $INSTALLSHELL -fi - -if [ "$USE_IMC_TEST" = "yes" ] -then - echo -n " --enable-imc-test" >> $INSTALLSHELL -fi - -if [ "$USE_IMV_TEST" = "yes" ] -then - echo -n " --enable-imv-test" >> $INSTALLSHELL -fi - -if [ "$USE_IMC_SCANNER" = "yes" ] -then - echo -n " --enable-imc-scanner" >> $INSTALLSHELL -fi - -if [ "$USE_IMV_SCANNER" = "yes" ] -then - echo -n " --enable-imv-scanner" >> $INSTALLSHELL -fi - -if [ "$USE_IMC_OS" = "yes" ] -then - echo -n " --enable-imc-os" >> $INSTALLSHELL -fi - -if [ "$USE_IMV_OS" = "yes" ] -then - echo -n " --enable-imv-os" >> $INSTALLSHELL -fi - -if [ "$USE_IMC_ATTESTATION" = "yes" ] -then - echo -n " --enable-imc-attestation" >> $INSTALLSHELL -fi - -if [ "$USE_IMV_ATTESTATION" = "yes" ] -then - echo -n " --enable-imv-attestation" >> $INSTALLSHELL -fi - -if [ "$USE_SQL" = "yes" ] -then - echo -n " --enable-sql --enable-sqlite" >> $INSTALLSHELL - fi - -if [ "$USE_MEDIATION" = "yes" ] -then - echo -n " --enable-mediation" >> $INSTALLSHELL -fi - -if [ "$USE_OPENSSL" = "yes" ] -then - echo -n " --enable-openssl" >> $INSTALLSHELL -fi - -if [ "$USE_BLOWFISH" = "yes" ] -then - echo -n " --enable-blowfish" >> $INSTALLSHELL -fi - -if [ "$USE_KERNEL_PFKEY" = "yes" ] -then - echo -n " --enable-kernel-pfkey" >> $INSTALLSHELL -fi - -if [ "$USE_INTEGRITY_TEST" = "yes" ] -then - echo -n " --enable-integrity-test" >> $INSTALLSHELL -fi - -if [ "$USE_LEAK_DETECTIVE" = "yes" ] -then - echo -n " --enable-leak-detective" >> $INSTALLSHELL -fi - -if [ "$USE_LOAD_TESTER" = "yes" ] -then - echo -n " --enable-load-tester" >> $INSTALLSHELL -fi - -if [ "$USE_TEST_VECTORS" = "yes" ] -then - echo -n " --enable-test-vectors" >> $INSTALLSHELL -fi - -if [ "$USE_GCRYPT" = "yes" ] -then - echo -n " --enable-gcrypt" >> $INSTALLSHELL -fi - -if [ "$USE_SOCKET_DEFAULT" = "yes" ] -then - echo -n " --enable-socket-default" >> $INSTALLSHELL -fi - -if [ "$USE_SOCKET_DYNAMIC" = "yes" ] -then - echo -n " --enable-socket-dynamic" >> $INSTALLSHELL -fi - -if [ "$USE_DHCP" = "yes" ] -then - echo -n " --enable-dhcp" >> $INSTALLSHELL -fi - -if [ "$USE_FARP" = "yes" ] -then - echo -n " --enable-farp" >> $INSTALLSHELL -fi - -if [ "$USE_ADDRBLOCK" = "yes" ] -then - echo -n " --enable-addrblock" >> $INSTALLSHELL -fi - -if [ "$USE_CTR" = "yes" ] -then - echo -n " --enable-ctr" >> $INSTALLSHELL -fi - -if [ "$USE_CCM" = "yes" ] -then - echo -n " --enable-ccm" >> $INSTALLSHELL -fi - -if [ "$USE_GCM" = "yes" ] -then - echo -n " --enable-gcm" >> $INSTALLSHELL -fi - -if [ "$USE_CMAC" = "yes" ] -then - echo -n " --enable-cmac" >> $INSTALLSHELL -fi - -if [ "$USE_HA" = "yes" ] -then - echo -n " --enable-ha" >> $INSTALLSHELL -fi - -if [ "$USE_AF_ALG" = "yes" ] -then - echo -n " --enable-af-alg" >> $INSTALLSHELL -fi - -if [ "$USE_WHITELIST" = "yes" ] -then - echo -n " --enable-whitelist" >> $INSTALLSHELL -fi - -if [ "$USE_XAUTH_GENERIC" = "yes" ] -then - echo -n " --enable-xauth-generic" >> $INSTALLSHELL -fi - -if [ "$USE_XAUTH_EAP" = "yes" ] -then - echo -n " --enable-xauth-eap" >> $INSTALLSHELL -fi - -if [ "$USE_PKCS8" = "yes" ] -then - echo -n " --enable-pkcs8" >> $INSTALLSHELL -fi - -if [ "$USE_IFMAP" = "yes" ] -then - echo -n " --enable-tnc-ifmap" >> $INSTALLSHELL -fi - -if [ "$USE_CISCO_QUIRKS" = "yes" ] -then - echo -n " --enable-cisco-quirks" >> $INSTALLSHELL -fi - -if [ "$USE_UNITY" = "yes" ] -then - echo -n " --enable-unity" >> $INSTALLSHELL -fi - -echo "" >> $INSTALLSHELL -echo "make -j" >> $INSTALLSHELL -echo "make install" >> $INSTALLSHELL -echo "ldconfig" >> $INSTALLSHELL - -cecho-n " * Compiling $STRONGSWANVERSION within the root file system as chroot.." -chroot $LOOPDIR /bin/bash /install.sh >> $LOGFILE 2>&1 -rm -f $INSTALLSHELL -cgecho "done" - -###################################################### -# copying default /etc/ipsec.d/tables.sql to the root filesystem -# -cecho " * Copying '$HOSTCONFIGDIR/default/etc/ipsec.d/tables.sql' to the root filesystem" -cp -fp $HOSTCONFIGDIR/default/etc/ipsec.d/tables.sql $LOOPDIR/etc/ipsec.d/tables.sql - -###################################################### -# copying the host's ssh public key -# - -if [ ! -d $LOOPDIR/root/.ssh ] -then - mkdir $LOOPDIR/root/.ssh -fi -cp ~/.ssh/id_rsa.pub $LOOPDIR/root/.ssh/authorized_keys - -###################################################### -# setup public key based login among all hosts -# -cp $LOOPDIR/etc/ssh/ssh_host_rsa_key $LOOPDIR/root/.ssh/id_rsa - -for host in $STRONGSWANHOSTS -do - eval ip="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F- '{ print $1 }' | awk '{ print $1 }'`" - echo "$host,$ip `cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub`" >> $LOOPDIR/root/.ssh/known_hosts - echo "`cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub` root@$host" >> $LOOPDIR/root/.ssh/authorized_keys -done - -###################################################### -# defining an empty modules.dep -# - -if [ $UMLPATCH ] -then - mkdir $LOOPDIR/lib/modules/`basename $UMLPATCH .bz2 | sed s/uml-patch-//`um - touch $LOOPDIR/lib/modules/`basename $UMLPATCH .bz2 | sed s/uml-patch-//`um/modules.dep -else - mkdir $LOOPDIR/lib/modules/$KERNELVERSION - touch $LOOPDIR/lib/modules/$KERNELVERSION/modules.dep -fi - -umount $LOOPDIR diff --git a/testing/scripts/function.sh b/testing/scripts/function.sh index e7ecbcf83..c4769678c 100755 --- a/testing/scripts/function.sh +++ b/testing/scripts/function.sh @@ -14,31 +14,146 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. +export TERM=xterm +RED=$(tput setaf 1) +GREEN=$(tput setaf 2) +NORMAL=$(tput op) -############################################ -# print output in color -# +# exit with given error message +# $1 - error message +die() { + echo -e "${RED}$1${NORMAL}" + exit 1 +} -function cecho { - echo -e "\033[1;31m$1\033[0m" +# execute command +# $1 - command to execute +# $2 - whether or not to log command exit status +# (0 -> disable exit status logging) +execute() +{ + cmd=${1} + echo $cmd >>$LOGFILE 2>&1 + $cmd >>$LOGFILE 2>&1 + status=$? + [ "$2" != 0 ] && log_status $status + if [ $status != 0 ]; then + echo + echo "! Command $cmd failed, exiting (status $status)" + echo "! Check why here $LOGFILE" + exit 1 + fi } -function cgecho { - echo -e "\033[1;32m$1\033[0m" + +# execute command in chroot +# $1 - command to execute +execute_chroot() +{ + execute "chroot $LOOPDIR $@" } -function cecho-n { - echo -en "\033[1;31m$1\033[0m" +# write green status message to console +# $1 - msg +echo_ok() +{ + echo -e "${GREEN}$1${NORMAL}" } +# write red status message to console +# $1 - msg +echo_failed() +{ + echo -e "${RED}$1${NORMAL}" +} -############################################# -# output all args to stderr and exit with -# return code 1 -# +# log an action +# $1 - current action description +log_action() +{ + /bin/echo -n "[....] $1 " +} -die() { - echo $* 1>&2 - exit 1 +# log an action status +# $1 - exit status of action +log_status() +{ + tput hpa 0 + if [ $1 -eq 0 ]; then + /bin/echo -ne "[${GREEN} ok ${NORMAL}" + else + /bin/echo -ne "[${RED}FAIL${NORMAL}" + fi + echo +} + +# the following two functions are stolen from [1] +# [1] - http://www.linuxjournal.com/content/use-bash-trap-statement-cleanup-temporary-files + +declare -a on_exit_items + +# perform registered actions on exit +on_exit() +{ + for ((onex=${#on_exit_items[@]}-1; onex>=0; onex--)) + do + echo "On_Exit: ${on_exit_items[$onex]}" >>$LOGFILE + ${on_exit_items[$onex]} >>$LOGFILE 2>&1 + done + on_exit_items="" + trap - EXIT +} + +# register a command to execute when the calling script terminates. The +# registered commands are called in FILO order. +# $* - command to register +do_on_exit() +{ + local n=${#on_exit_items[*]} + on_exit_items[$n]="$*" + if [ $n -eq 0 ]; then + trap on_exit EXIT + fi +} + +# wait for a mount to disappear +# $1 - device/image to wait for +# $2 - maximum time to wait in seconds, default is 5 seconds +graceful_umount() +{ + secs=$2 + [ ! $secs ] && secs=5 + + let steps=$secs*100 + for st in `seq 1 $steps` + do + umount $1 >>$LOGFILE 2>&1 + mount | grep $1 >/dev/null 2>&1 + [ $? -eq 0 ] || return 0 + sleep 0.01 + done + + return 1 +} + +# load qemu NBD kernel module, if not already loaded +load_qemu_nbd() +{ + lsmod | grep ^nbd[[:space:]]* >/dev/null 2>&1 + if [ $? != 0 ] + then + log_action "Loading NBD kernel module" + execute "modprobe nbd max_part=16" + fi +} + +# check if given commands exist in $PATH +# $* - commands to check +check_commands() +{ + for i in $* + do + command -v $i >/dev/null || { die "Required command $i not found"; exit 1; } + done } ############################################# @@ -55,13 +170,6 @@ function searchandreplace { [ -d "$DESTDIR" ] || die "$DESTDIR is not a directory!" - ######################### - # create a temporary file - # - - TMPFILE="/tmp/sr.$$" - - ########################################### # search and replace in each found file the # given string @@ -69,59 +177,7 @@ function searchandreplace { for eachfoundfile in `find $DESTDIR -type f` do - sed -e "s/$SEARCHSTRING/$REPLACESTRING/g" "$eachfoundfile" > "$TMPFILE" - cp -f "$TMPFILE" "$eachfoundfile" + sed -i -e "s/$SEARCHSTRING/$REPLACESTRING/g" "$eachfoundfile" done - - ########################### - # delete the temporary file - # - - rm -f "$TMPFILE" - -} - -############################################# -# add a bridge -# - -function umlbr_add { - brctl addbr "umlbr$1" - brctl setfd "umlbr$1" 0 - brctl setageing "umlbr$1" 3600 - brctl stp "umlbr$1" off - ifconfig "umlbr$1" "$2" netmask "$3" up } - -############################################# -# delete a bridge -# - -function umlbr_del { - ifconfig "umlbr$1" down &> /dev/null 2>&1 - brctl delbr "umlbr$1" &> /dev/null 2>&1 -} - -############################################# -# add a tap interface to a bridge -# - -function umlbr_add_tap { - tunctl -t "tap$1_$2" &> /dev/null 2>&1 - ifconfig "tap$1_$2" 0.0.0.0 promisc up &> /dev/null 2>&1 - brctl addif "umlbr$1" "tap$1_$2" &> /dev/null 2>&1 - cecho-n "$2.." - } - -############################################# -# delete a tap interface from a bridge -# - -function umlbr_del_tap { - ifconfig "umlbr$2" down &> /dev/null 2>&1 - brctl delif "umlbr$1" "tap$1_$2" &> /dev/null 2>&1 - tunctl -d "tap$1_$2" &> /dev/null 2>&1 - cecho-n "$2.." - } - diff --git a/testing/scripts/gstart-umls b/testing/scripts/gstart-umls deleted file mode 100755 index c6fcd26dc..000000000 --- a/testing/scripts/gstart-umls +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# starts the UML instances in an gnome-terminal (requires X11R6) -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -#position of xterm window on the desktop -x0=8 -y0=52 -dx=12 -dy=24 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval gnome-terminal --title=${host} --geometry="+${x0}+${y0}" --show-menubar --execute "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" & - cgecho "done" - sleep 15 - fi - let "x0+=dx" - let "y0+=dy" -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/scripts/install-shared b/testing/scripts/install-shared deleted file mode 100755 index 4cfac9e77..000000000 --- a/testing/scripts/install-shared +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash -# Install strongSwan from mounted strongswan-shared tree -# -# Copyright (C) 2006 Martin Willi -# Hochschule fuer Technik Rapperswil -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -# - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -cecho "installing strongSwan from shared tree" -cecho-n " on: " - -for host in $STRONGSWANHOSTS -do - eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - cecho-n "$host... " - ssh $HOSTLOGIN 'cd ~/strongswan-shared && make install' > /dev/null -done - -cecho diff --git a/testing/scripts/kstart-umls b/testing/scripts/kstart-umls deleted file mode 100755 index 18dc64a9d..000000000 --- a/testing/scripts/kstart-umls +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# starts the UML instances in a konsole (requires KDE) -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -#position of konsole window on the desktop -x0=8 -y0=8 -dx=12 -dy=24 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval konsole -title ${host} --geometry "+${x0}+${y0}" -e "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" & - cgecho "done" - sleep 15 - fi - let "x0+=dx" - let "y0+=dy" -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/scripts/load-testconfig b/testing/scripts/load-testconfig index 43100dbe0..0ea4fbf00 100755 --- a/testing/scripts/load-testconfig +++ b/testing/scripts/load-testconfig @@ -14,13 +14,9 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh ########################################################################## # load-testconfig requires a testname as an argument @@ -58,17 +54,16 @@ for host in $IPSECHOSTS do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/auth.log /var/log/daemon.log; \ - kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1 + kill -SIGHUP `cat /var/run/rsyslogd.pid`' > /dev/null 2>&1 done ########################################################################## -# clear radius.log and daemon.log on FreeRadius servers +# clear radius.log on FreeRadius servers # for host in $RADIUSHOSTS do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/radius/radius.log /var/log/daemon.log; \ - kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1 + ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/freeradius/radius.log' > /dev/null 2>&1 done diff --git a/testing/scripts/recipes/001_libtnc.mk b/testing/scripts/recipes/001_libtnc.mk new file mode 100644 index 000000000..b835958b7 --- /dev/null +++ b/testing/scripts/recipes/001_libtnc.mk @@ -0,0 +1,31 @@ +#!/usr/bin/make + +PV = 1.25 +PKG = libtnc-$(PV) +TAR = $(PKG).tar.gz +SRC = http://downloads.sourceforge.net/project/libtnc/libtnc/$(PV)/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + --sysconfdir=/etc + +all: install + +$(TAR): + wget $(SRC) + +.$(PKG)-unpacked: $(TAR) + tar xfz $(TAR) + @touch $@ + +.$(PKG)-configured: .$(PKG)-unpacked + cd $(PKG) && ./configure $(CONFIG_OPTS) + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG) && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG) && make install diff --git a/testing/scripts/recipes/002_tnc-fhh.mk b/testing/scripts/recipes/002_tnc-fhh.mk new file mode 100644 index 000000000..397cef950 --- /dev/null +++ b/testing/scripts/recipes/002_tnc-fhh.mk @@ -0,0 +1,28 @@ +#!/usr/bin/make + +PKG = fhhtnc +SRC = git://github.com/trustatfhh/tnc-fhh.git + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + -DCOMPONENT=all \ + -DNAL=8021x + +all: install + +.$(PKG)-cloned: + git clone $(SRC) $(PKG) + mkdir $(PKG)/build + @touch $@ + +.$(PKG)-configured: .$(PKG)-cloned + cd $(PKG)/build && cmake $(CONFIG_OPTS) ../ + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG)/build && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG)/build && make install diff --git a/testing/scripts/recipes/003_freeradius.mk b/testing/scripts/recipes/003_freeradius.mk new file mode 100644 index 000000000..7b7a5fe82 --- /dev/null +++ b/testing/scripts/recipes/003_freeradius.mk @@ -0,0 +1,44 @@ +#!/usr/bin/make + +PV = 2.2.0 +PKG = freeradius-server-$(PV) +TAR = $(PKG).tar.bz2 +SRC = ftp://ftp.freeradius.org/pub/freeradius/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + --with-raddbdir=/etc/freeradius \ + --sysconfdir=/etc \ + --with-logdir=/var/log/freeradius \ + --enable-developer \ + --with-experimental-modules + +PATCHES = \ + freeradius-eap-sim-identity \ + freeradius-avp-size \ + freeradius-tnc-fhh + +all: install + +$(TAR): + wget $(SRC) + +.$(PKG)-unpacked: $(TAR) + tar xfj $(TAR) + @touch $@ + +.$(PKG)-patches-applied: .$(PKG)-unpacked + cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1 + @touch $@ + +.$(PKG)-configured: .$(PKG)-patches-applied + cd $(PKG) && ./configure $(CONFIG_OPTS) + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG) && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG) && make install diff --git a/testing/scripts/recipes/004_iptables.mk b/testing/scripts/recipes/004_iptables.mk new file mode 100644 index 000000000..51200201a --- /dev/null +++ b/testing/scripts/recipes/004_iptables.mk @@ -0,0 +1,37 @@ +#!/usr/bin/make + +PV = 1.4.16.3 +PKG = iptables-$(PV) +TAR = $(PKG).tar.bz2 +SRC = http://www.netfilter.org/projects/iptables/files/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = + +PATCHES = \ + iptables-xfrm-hooks + +all: install + +$(TAR): + wget $(SRC) + +.$(PKG)-unpacked: $(TAR) + tar xfj $(TAR) + @touch $@ + +.$(PKG)-patches-applied: .$(PKG)-unpacked + cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1 + @touch $@ + +.$(PKG)-configured: .$(PKG)-patches-applied + cd $(PKG) && ./configure $(CONFIG_OPTS) + @touch $@ + +.$(PKG)-built: .$(PKG)-configured + cd $(PKG) && make -j $(NUM_CPUS) + @touch $@ + +install: .$(PKG)-built + cd $(PKG) && make install diff --git a/testing/scripts/recipes/005_strongswan.mk b/testing/scripts/recipes/005_strongswan.mk new file mode 100644 index 000000000..76d2d0882 --- /dev/null +++ b/testing/scripts/recipes/005_strongswan.mk @@ -0,0 +1,87 @@ +#!/usr/bin/make + +PV = $(SWANVERSION) +PKG = strongswan-$(PV) +TAR = $(PKG).tar.bz2 +SRC = http://download.strongswan.org/$(TAR) + +NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN) + +CONFIG_OPTS = \ + --sysconfdir=/etc \ + --with-random-device=/dev/urandom \ + --disable-load-warning \ + --enable-curl \ + --enable-ldap \ + --enable-eap-aka \ + --enable-eap-aka-3gpp2 \ + --enable-eap-sim \ + --enable-eap-sim-file \ + --enable-eap-md5 \ + --enable-md4 \ + --enable-eap-mschapv2 \ + --enable-eap-identity \ + --enable-eap-radius \ + --enable-eap-dynamic \ + --enable-eap-tls \ + --enable-eap-ttls \ + --enable-eap-peap \ + --enable-eap-tnc \ + --enable-tnc-pdp \ + --enable-tnc-imc \ + --enable-tnc-imv \ + --enable-tnccs-11 \ + --enable-tnccs-20 \ + --enable-tnccs-dynamic \ + --enable-imc-test \ + --enable-imv-test \ + --enable-imc-scanner \ + --enable-imv-scanner \ + --enable-imc-os \ + --enable-imv-os \ + --enable-imc-attestation \ + --enable-imv-attestation \ + --enable-sql \ + --enable-sqlite \ + --enable-mediation \ + --enable-openssl \ + --enable-blowfish \ + --enable-kernel-pfkey \ + --enable-integrity-test \ + --enable-leak-detective \ + --enable-load-tester \ + --enable-test-vectors \ + --enable-gcrypt \ + --enable-socket-default \ + --enable-socket-dynamic \ + --enable-dhcp \ + --enable-farp \ + --enable-addrblock \ + --enable-ctr \ + --enable-ccm \ + --enable-gcm \ + --enable-cmac \ + --enable-ha \ + --enable-af-alg \ + --enable-whitelist \ + --enable-xauth-generic \ + --enable-xauth-eap \ + --enable-pkcs8 \ + --enable-unity + +all: install + +$(TAR): + wget $(SRC) + +$(PKG): $(TAR) + tar xfj $(TAR) + +configure: $(PKG) + cd $(PKG) && ./configure $(CONFIG_OPTS) + +build: configure + cd $(PKG) && make -j $(NUM_CPUS) + +install: build + cd $(PKG) && make install diff --git a/testing/scripts/recipes/patches/freeradius-avp-size b/testing/scripts/recipes/patches/freeradius-avp-size new file mode 100644 index 000000000..e7e1f635b --- /dev/null +++ b/testing/scripts/recipes/patches/freeradius-avp-size @@ -0,0 +1,18 @@ +diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +index 6c9bd13..3344c53 100644 +--- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c ++++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +@@ -201,8 +201,11 @@ static VALUE_PAIR *diameter2vp(REQUEST *request, SSL *ssl, + goto next_attr; + } + +- if (size > 253) { +- RDEBUG2("WARNING: diameter2vp skipping long attribute %u, attr"); ++ /* ++ * EAP-Message AVPs can be larger than 253 octets. ++ */ ++ if ((size > 253) && !((VENDOR(attr) == 0) && (attr == PW_EAP_MESSAGE))) { ++ RDEBUG2("WARNING: diameter2vp skipping long attribute %u", attr); + goto next_attr; + } + diff --git a/testing/scripts/recipes/patches/freeradius-eap-sim-identity b/testing/scripts/recipes/patches/freeradius-eap-sim-identity new file mode 100644 index 000000000..1ab95ecc6 --- /dev/null +++ b/testing/scripts/recipes/patches/freeradius-eap-sim-identity @@ -0,0 +1,30 @@ +--- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:03:05.081225276 +0100 ++++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:46:59.746289881 +0100 +@@ -246,14 +246,21 @@ + newvp->vp_integer = ess->sim_id++; + pairreplace(outvps, newvp); + ++ ess->keys.identitylen = strlen(handler->identity); ++ memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen); ++ + /* make a copy of the identity */ + newvp = pairfind(*invps, ATTRIBUTE_EAP_SIM_BASE + PW_EAP_SIM_IDENTITY); +- if (newvp) { +- ess->keys.identitylen = newvp->length; +- memcpy(ess->keys.identity, newvp->vp_octets, newvp->length); +- } else { +- ess->keys.identitylen = strlen(handler->identity); +- memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen); ++ if (newvp && newvp->length > 2) { ++ uint16_t len; ++ ++ memcpy(&len, newvp->vp_octets, sizeof(uint16_t)); ++ len = ntohs(len); ++ if (len <= newvp->length - 2 && len <= MAX_STRING_LEN) { ++ ess->keys.identitylen = len; ++ memcpy(ess->keys.identity, newvp->vp_octets + 2, ++ ess->keys.identitylen); ++ } + } + + /* all set, calculate keys! */ diff --git a/testing/scripts/recipes/patches/freeradius-tnc-fhh b/testing/scripts/recipes/patches/freeradius-tnc-fhh new file mode 100644 index 000000000..5abc6b25f --- /dev/null +++ b/testing/scripts/recipes/patches/freeradius-tnc-fhh @@ -0,0 +1,6687 @@ +diff -u -r -N freeradius-server-2.2.0.orig/share/dictionary freeradius-server-2.2.0/share/dictionary +--- freeradius-server-2.2.0.orig/share/dictionary 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/share/dictionary 2012-12-04 19:39:42.261423097 +0100 +@@ -196,6 +196,7 @@ + $INCLUDE dictionary.starent + $INCLUDE dictionary.symbol + $INCLUDE dictionary.telebit ++$INCLUDE dictionary.tncfhh + $INCLUDE dictionary.terena + $INCLUDE dictionary.trapeze + $INCLUDE dictionary.tropos +diff -u -r -N freeradius-server-2.2.0.orig/share/dictionary.tncfhh freeradius-server-2.2.0/share/dictionary.tncfhh +--- freeradius-server-2.2.0.orig/share/dictionary.tncfhh 1970-01-01 01:00:00.000000000 +0100 ++++ freeradius-server-2.2.0/share/dictionary.tncfhh 2012-12-04 19:39:49.645421869 +0100 +@@ -0,0 +1,20 @@ ++# -*- text -*- ++# Dictionary for the tnc@fhh Server. ++# ++# Website: http://trust.inform.fh-hannover.de ++# ++# Version: 0.8.4 ++# Author: Bastian Hellmann ++# Email: trust@f4-i.fh-hannover.de ++# ++ ++VENDOR tncfhh 10000 ++BEGIN-VENDOR tncfhh ++ ++ATTRIBUTE TNC-Status 1 integer ++ ++VALUE TNC-Status Access 0 ++VALUE TNC-Status Isolate 1 ++VALUE TNC-Status None 2 ++ ++END-VENDOR tncfhh +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure 2012-12-04 19:38:00.237420970 +0100 +@@ -1,61 +1,84 @@ + #! /bin/sh + # From configure.in Revision. + # Guess values for system-dependent variables and create Makefiles. +-# Generated by GNU Autoconf 2.61. ++# Generated by GNU Autoconf 2.67. ++# + # + # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, +-# 2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc. ++# 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Free Software ++# Foundation, Inc. ++# ++# + # This configure script is free software; the Free Software Foundation + # gives unlimited permission to copy, distribute and modify it. +-## --------------------- ## +-## M4sh Initialization. ## +-## --------------------- ## ++## -------------------- ## ++## M4sh Initialization. ## ++## -------------------- ## + + # Be more Bourne compatible + DUALCASE=1; export DUALCASE # for MKS sh +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then ++if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : + emulate sh + NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which ++ # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' + setopt NO_GLOB_SUBST + else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; ++ case `(set -o) 2>/dev/null` in #( ++ *posix*) : ++ set -o posix ;; #( ++ *) : ++ ;; + esac +- + fi + + +- +- +-# PATH needs CR +-# Avoid depending upon Character Ranges. +-as_cr_letters='abcdefghijklmnopqrstuvwxyz' +-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' +-as_cr_Letters=$as_cr_letters$as_cr_LETTERS +-as_cr_digits='0123456789' +-as_cr_alnum=$as_cr_Letters$as_cr_digits +- +-# The user is always right. +-if test "${PATH_SEPARATOR+set}" != set; then +- echo "#! /bin/sh" >conf$$.sh +- echo "exit 0" >>conf$$.sh +- chmod +x conf$$.sh +- if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then +- PATH_SEPARATOR=';' ++as_nl=' ++' ++export as_nl ++# Printing a long string crashes Solaris 7 /usr/bin/printf. ++as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo ++# Prefer a ksh shell builtin over an external printf program on Solaris, ++# but without wasting forks for bash or zsh. ++if test -z "$BASH_VERSION$ZSH_VERSION" \ ++ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='print -r --' ++ as_echo_n='print -rn --' ++elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='printf %s\n' ++ as_echo_n='printf %s' ++else ++ if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then ++ as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' ++ as_echo_n='/usr/ucb/echo -n' + else +- PATH_SEPARATOR=: ++ as_echo_body='eval expr "X$1" : "X\\(.*\\)"' ++ as_echo_n_body='eval ++ arg=$1; ++ case $arg in #( ++ *"$as_nl"*) ++ expr "X$arg" : "X\\(.*\\)$as_nl"; ++ arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; ++ esac; ++ expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ++ ' ++ export as_echo_n_body ++ as_echo_n='sh -c $as_echo_n_body as_echo' + fi +- rm -f conf$$.sh ++ export as_echo_body ++ as_echo='sh -c $as_echo_body as_echo' + fi + +-# Support unset when possible. +-if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then +- as_unset=unset +-else +- as_unset=false ++# The user is always right. ++if test "${PATH_SEPARATOR+set}" != set; then ++ PATH_SEPARATOR=: ++ (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { ++ (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || ++ PATH_SEPARATOR=';' ++ } + fi + + +@@ -64,20 +87,18 @@ + # there to prevent editors from complaining about space-tab. + # (If _AS_PATH_WALK were called with IFS unset, it would disable word + # splitting by setting IFS to empty value.) +-as_nl=' +-' + IFS=" "" $as_nl" + + # Find who we are. Look in the path if we contain no directory separator. +-case $0 in ++case $0 in #(( + *[\\/]* ) as_myself=$0 ;; + *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR + for as_dir in $PATH + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break +-done ++ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break ++ done + IFS=$as_save_IFS + + ;; +@@ -88,354 +109,321 @@ + as_myself=$0 + fi + if test ! -f "$as_myself"; then +- echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 +- { (exit 1); exit 1; } ++ $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 ++ exit 1 + fi + +-# Work around bugs in pre-3.0 UWIN ksh. +-for as_var in ENV MAIL MAILPATH +-do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var ++# Unset variables that we do not need and which cause bugs (e.g. in ++# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" ++# suppresses any "Segmentation fault" message there. '((' could ++# trigger a bug in pdksh 5.2.14. ++for as_var in BASH_ENV ENV MAIL MAILPATH ++do eval test x\${$as_var+set} = xset \ ++ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : + done + PS1='$ ' + PS2='> ' + PS4='+ ' + + # NLS nuisances. +-for as_var in \ +- LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ +- LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ +- LC_TELEPHONE LC_TIME +-do +- if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then +- eval $as_var=C; export $as_var +- else +- ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var +- fi +-done +- +-# Required to use basename. +-if expr a : '\(a\)' >/dev/null 2>&1 && +- test "X`expr 00001 : '.*\(...\)'`" = X001; then +- as_expr=expr +-else +- as_expr=false +-fi +- +-if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then +- as_basename=basename +-else +- as_basename=false +-fi +- +- +-# Name of the executable. +-as_me=`$as_basename -- "$0" || +-$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ +- X"$0" : 'X\(//\)$' \| \ +- X"$0" : 'X\(/\)' \| . 2>/dev/null || +-echo X/"$0" | +- sed '/^.*\/\([^/][^/]*\)\/*$/{ +- s//\1/ +- q +- } +- /^X\/\(\/\/\)$/{ +- s//\1/ +- q +- } +- /^X\/\(\/\).*/{ +- s//\1/ +- q +- } +- s/.*/./; q'` ++LC_ALL=C ++export LC_ALL ++LANGUAGE=C ++export LANGUAGE + + # CDPATH. +-$as_unset CDPATH +- ++(unset CDPATH) >/dev/null 2>&1 && unset CDPATH + + if test "x$CONFIG_SHELL" = x; then +- if (eval ":") 2>/dev/null; then +- as_have_required=yes ++ as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then : ++ emulate sh ++ NULLCMD=: ++ # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which ++ # is contrary to our usage. Disable this feature. ++ alias -g '\${1+\"\$@\"}'='\"\$@\"' ++ setopt NO_GLOB_SUBST + else +- as_have_required=no ++ case \`(set -o) 2>/dev/null\` in #( ++ *posix*) : ++ set -o posix ;; #( ++ *) : ++ ;; ++esac + fi +- +- if test $as_have_required = yes && (eval ": +-(as_func_return () { +- (exit \$1) +-} +-as_func_success () { +- as_func_return 0 +-} +-as_func_failure () { +- as_func_return 1 +-} +-as_func_ret_success () { +- return 0 +-} +-as_func_ret_failure () { +- return 1 +-} ++" ++ as_required="as_fn_return () { (exit \$1); } ++as_fn_success () { as_fn_return 0; } ++as_fn_failure () { as_fn_return 1; } ++as_fn_ret_success () { return 0; } ++as_fn_ret_failure () { return 1; } + + exitcode=0 +-if as_func_success; then +- : +-else +- exitcode=1 +- echo as_func_success failed. +-fi +- +-if as_func_failure; then +- exitcode=1 +- echo as_func_failure succeeded. +-fi +- +-if as_func_ret_success; then +- : +-else +- exitcode=1 +- echo as_func_ret_success failed. +-fi +- +-if as_func_ret_failure; then +- exitcode=1 +- echo as_func_ret_failure succeeded. +-fi +- +-if ( set x; as_func_ret_success y && test x = \"\$1\" ); then +- : ++as_fn_success || { exitcode=1; echo as_fn_success failed.; } ++as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; } ++as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; } ++as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; } ++if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then : ++ ++else ++ exitcode=1; echo positional parameters were not saved. ++fi ++test x\$exitcode = x0 || exit 1" ++ as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO ++ as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO ++ eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" && ++ test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1 ++test \$(( 1 + 1 )) = 2 || exit 1" ++ if (eval "$as_required") 2>/dev/null; then : ++ as_have_required=yes + else +- exitcode=1 +- echo positional parameters were not saved. ++ as_have_required=no + fi ++ if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then : + +-test \$exitcode = 0) || { (exit 1); exit 1; } +- +-( +- as_lineno_1=\$LINENO +- as_lineno_2=\$LINENO +- test \"x\$as_lineno_1\" != \"x\$as_lineno_2\" && +- test \"x\`expr \$as_lineno_1 + 1\`\" = \"x\$as_lineno_2\") || { (exit 1); exit 1; } +-") 2> /dev/null; then +- : + else +- as_candidate_shells= +- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++as_found=false + for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- case $as_dir in ++ as_found=: ++ case $as_dir in #( + /*) + for as_base in sh bash ksh sh5; do +- as_candidate_shells="$as_candidate_shells $as_dir/$as_base" ++ # Try only shells that exist, to save several forks. ++ as_shell=$as_dir/$as_base ++ if { test -f "$as_shell" || test -f "$as_shell.exe"; } && ++ { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then : ++ CONFIG_SHELL=$as_shell as_have_required=yes ++ if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then : ++ break 2 ++fi ++fi + done;; + esac ++ as_found=false + done ++$as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } && ++ { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then : ++ CONFIG_SHELL=$SHELL as_have_required=yes ++fi; } + IFS=$as_save_IFS + + +- for as_shell in $as_candidate_shells $SHELL; do +- # Try only shells that exist, to save several forks. +- if { test -f "$as_shell" || test -f "$as_shell.exe"; } && +- { ("$as_shell") 2> /dev/null <<\_ASEOF +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then +- emulate sh +- NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which +- # is contrary to our usage. Disable this feature. +- alias -g '${1+"$@"}'='"$@"' +- setopt NO_GLOB_SUBST +-else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; +-esac +- ++ if test "x$CONFIG_SHELL" != x; then : ++ # We cannot yet assume a decent shell, so we have to provide a ++ # neutralization value for shells without unset; and this also ++ # works around shells that cannot unset nonexistent variables. ++ BASH_ENV=/dev/null ++ ENV=/dev/null ++ (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV ++ export CONFIG_SHELL ++ exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"} ++fi ++ ++ if test x$as_have_required = xno; then : ++ $as_echo "$0: This script requires a shell more modern than all" ++ $as_echo "$0: the shells that I found on your system." ++ if test x${ZSH_VERSION+set} = xset ; then ++ $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should" ++ $as_echo "$0: be upgraded to zsh 4.3.4 or later." ++ else ++ $as_echo "$0: Please tell bug-autoconf@gnu.org about your system, ++$0: including any error possibly output before this ++$0: message. Then install a modern shell, or manually run ++$0: the script under such a shell if you do have one." ++ fi ++ exit 1 + fi +- +- +-: +-_ASEOF +-}; then +- CONFIG_SHELL=$as_shell +- as_have_required=yes +- if { "$as_shell" 2> /dev/null <<\_ASEOF +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then +- emulate sh +- NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which +- # is contrary to our usage. Disable this feature. +- alias -g '${1+"$@"}'='"$@"' +- setopt NO_GLOB_SUBST +-else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; +-esac +- + fi ++fi ++SHELL=${CONFIG_SHELL-/bin/sh} ++export SHELL ++# Unset more variables known to interfere with behavior of common tools. ++CLICOLOR_FORCE= GREP_OPTIONS= ++unset CLICOLOR_FORCE GREP_OPTIONS + +- +-: +-(as_func_return () { +- (exit $1) +-} +-as_func_success () { +- as_func_return 0 +-} +-as_func_failure () { +- as_func_return 1 +-} +-as_func_ret_success () { +- return 0 +-} +-as_func_ret_failure () { +- return 1 ++## --------------------- ## ++## M4sh Shell Functions. ## ++## --------------------- ## ++# as_fn_unset VAR ++# --------------- ++# Portably unset VAR. ++as_fn_unset () ++{ ++ { eval $1=; unset $1;} + } ++as_unset=as_fn_unset + +-exitcode=0 +-if as_func_success; then +- : +-else +- exitcode=1 +- echo as_func_success failed. +-fi ++# as_fn_set_status STATUS ++# ----------------------- ++# Set $? to STATUS, without forking. ++as_fn_set_status () ++{ ++ return $1 ++} # as_fn_set_status + +-if as_func_failure; then +- exitcode=1 +- echo as_func_failure succeeded. +-fi ++# as_fn_exit STATUS ++# ----------------- ++# Exit the shell with STATUS, even in a "trap 0" or "set -e" context. ++as_fn_exit () ++{ ++ set +e ++ as_fn_set_status $1 ++ exit $1 ++} # as_fn_exit ++ ++# as_fn_mkdir_p ++# ------------- ++# Create "$as_dir" as a directory, including parents if necessary. ++as_fn_mkdir_p () ++{ + +-if as_func_ret_success; then +- : +-else +- exitcode=1 +- echo as_func_ret_success failed. +-fi ++ case $as_dir in #( ++ -*) as_dir=./$as_dir;; ++ esac ++ test -d "$as_dir" || eval $as_mkdir_p || { ++ as_dirs= ++ while :; do ++ case $as_dir in #( ++ *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( ++ *) as_qdir=$as_dir;; ++ esac ++ as_dirs="'$as_qdir' $as_dirs" ++ as_dir=`$as_dirname -- "$as_dir" || ++$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ ++ X"$as_dir" : 'X\(//\)[^/]' \| \ ++ X"$as_dir" : 'X\(//\)$' \| \ ++ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X"$as_dir" | ++ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)[^/].*/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\).*/{ ++ s//\1/ ++ q ++ } ++ s/.*/./; q'` ++ test -d "$as_dir" && break ++ done ++ test -z "$as_dirs" || eval "mkdir $as_dirs" ++ } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" + +-if as_func_ret_failure; then +- exitcode=1 +- echo as_func_ret_failure succeeded. +-fi + +-if ( set x; as_func_ret_success y && test x = "$1" ); then +- : ++} # as_fn_mkdir_p ++# as_fn_append VAR VALUE ++# ---------------------- ++# Append the text in VALUE to the end of the definition contained in VAR. Take ++# advantage of any shell optimizations that allow amortized linear growth over ++# repeated appends, instead of the typical quadratic growth present in naive ++# implementations. ++if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : ++ eval 'as_fn_append () ++ { ++ eval $1+=\$2 ++ }' + else +- exitcode=1 +- echo positional parameters were not saved. +-fi +- +-test $exitcode = 0) || { (exit 1); exit 1; } +- +-( +- as_lineno_1=$LINENO +- as_lineno_2=$LINENO +- test "x$as_lineno_1" != "x$as_lineno_2" && +- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2") || { (exit 1); exit 1; } +- +-_ASEOF +-}; then +- break +-fi +- +-fi +- +- done +- +- if test "x$CONFIG_SHELL" != x; then +- for as_var in BASH_ENV ENV +- do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var +- done +- export CONFIG_SHELL +- exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"} +-fi +- +- +- if test $as_have_required = no; then +- echo This script requires a shell more modern than all the +- echo shells that I found on your system. Please install a +- echo modern shell, or manually run the script under such a +- echo shell if you do have one. +- { (exit 1); exit 1; } +-fi +- +- +-fi +- +-fi +- ++ as_fn_append () ++ { ++ eval $1=\$$1\$2 ++ } ++fi # as_fn_append ++ ++# as_fn_arith ARG... ++# ------------------ ++# Perform arithmetic evaluation on the ARGs, and store the result in the ++# global $as_val. Take advantage of shells that can avoid forks. The arguments ++# must be portable across $(()) and expr. ++if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : ++ eval 'as_fn_arith () ++ { ++ as_val=$(( $* )) ++ }' ++else ++ as_fn_arith () ++ { ++ as_val=`expr "$@" || test $? -eq 1` ++ } ++fi # as_fn_arith + + +-(eval "as_func_return () { +- (exit \$1) +-} +-as_func_success () { +- as_func_return 0 +-} +-as_func_failure () { +- as_func_return 1 +-} +-as_func_ret_success () { +- return 0 +-} +-as_func_ret_failure () { +- return 1 +-} ++# as_fn_error STATUS ERROR [LINENO LOG_FD] ++# ---------------------------------------- ++# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are ++# provided, also output the error to LOG_FD, referencing LINENO. Then exit the ++# script with STATUS, using 1 if that was 0. ++as_fn_error () ++{ ++ as_status=$1; test $as_status -eq 0 && as_status=1 ++ if test "$4"; then ++ as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 ++ fi ++ $as_echo "$as_me: error: $2" >&2 ++ as_fn_exit $as_status ++} # as_fn_error + +-exitcode=0 +-if as_func_success; then +- : ++if expr a : '\(a\)' >/dev/null 2>&1 && ++ test "X`expr 00001 : '.*\(...\)'`" = X001; then ++ as_expr=expr + else +- exitcode=1 +- echo as_func_success failed. +-fi +- +-if as_func_failure; then +- exitcode=1 +- echo as_func_failure succeeded. ++ as_expr=false + fi + +-if as_func_ret_success; then +- : ++if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then ++ as_basename=basename + else +- exitcode=1 +- echo as_func_ret_success failed. +-fi +- +-if as_func_ret_failure; then +- exitcode=1 +- echo as_func_ret_failure succeeded. ++ as_basename=false + fi + +-if ( set x; as_func_ret_success y && test x = \"\$1\" ); then +- : ++if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then ++ as_dirname=dirname + else +- exitcode=1 +- echo positional parameters were not saved. ++ as_dirname=false + fi + +-test \$exitcode = 0") || { +- echo No shell found that supports shell functions. +- echo Please tell autoconf@gnu.org about your system, +- echo including any error possibly output before this +- echo message +-} ++as_me=`$as_basename -- "$0" || ++$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ ++ X"$0" : 'X\(//\)$' \| \ ++ X"$0" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X/"$0" | ++ sed '/^.*\/\([^/][^/]*\)\/*$/{ ++ s//\1/ ++ q ++ } ++ /^X\/\(\/\/\)$/{ ++ s//\1/ ++ q ++ } ++ /^X\/\(\/\).*/{ ++ s//\1/ ++ q ++ } ++ s/.*/./; q'` + ++# Avoid depending upon Character Ranges. ++as_cr_letters='abcdefghijklmnopqrstuvwxyz' ++as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' ++as_cr_Letters=$as_cr_letters$as_cr_LETTERS ++as_cr_digits='0123456789' ++as_cr_alnum=$as_cr_Letters$as_cr_digits + + +- as_lineno_1=$LINENO +- as_lineno_2=$LINENO +- test "x$as_lineno_1" != "x$as_lineno_2" && +- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || { +- +- # Create $as_me.lineno as a copy of $as_myself, but with $LINENO +- # uniformly replaced by the line number. The first 'sed' inserts a +- # line-number line after each line using $LINENO; the second 'sed' +- # does the real work. The second script uses 'N' to pair each +- # line-number line with the line containing $LINENO, and appends +- # trailing '-' during substitution so that $LINENO is not a special +- # case at line end. +- # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the +- # scripts with optimization help from Paolo Bonzini. Blame Lee +- # E. McMahon (1931-1989) for sed's syntax. :-) ++ as_lineno_1=$LINENO as_lineno_1a=$LINENO ++ as_lineno_2=$LINENO as_lineno_2a=$LINENO ++ eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" && ++ test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || { ++ # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-) + sed -n ' + p + /[$]LINENO/= +@@ -452,8 +440,7 @@ + s/-\n.*// + ' >$as_me.lineno && + chmod +x "$as_me.lineno" || +- { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 +- { (exit 1); exit 1; }; } ++ { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; } + + # Don't try to exec as it changes $[0], causing all sort of problems + # (the dirname of $[0] is not the place where we might find the +@@ -463,49 +450,40 @@ + exit + } + +- +-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then +- as_dirname=dirname +-else +- as_dirname=false +-fi +- + ECHO_C= ECHO_N= ECHO_T= +-case `echo -n x` in ++case `echo -n x` in #((((( + -n*) +- case `echo 'x\c'` in ++ case `echo 'xy\c'` in + *c*) ECHO_T=' ';; # ECHO_T is single tab character. +- *) ECHO_C='\c';; ++ xy) ECHO_C='\c';; ++ *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ++ ECHO_T=' ';; + esac;; + *) + ECHO_N='-n';; + esac + +-if expr a : '\(a\)' >/dev/null 2>&1 && +- test "X`expr 00001 : '.*\(...\)'`" = X001; then +- as_expr=expr +-else +- as_expr=false +-fi +- + rm -f conf$$ conf$$.exe conf$$.file + if test -d conf$$.dir; then + rm -f conf$$.dir/conf$$.file + else + rm -f conf$$.dir +- mkdir conf$$.dir ++ mkdir conf$$.dir 2>/dev/null + fi +-echo >conf$$.file +-if ln -s conf$$.file conf$$ 2>/dev/null; then +- as_ln_s='ln -s' +- # ... but there are two gotchas: +- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. +- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. +- # In both cases, we have to default to `cp -p'. +- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++if (echo >conf$$.file) 2>/dev/null; then ++ if ln -s conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s='ln -s' ++ # ... but there are two gotchas: ++ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. ++ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. ++ # In both cases, we have to default to `cp -p'. ++ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++ as_ln_s='cp -p' ++ elif ln conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s=ln ++ else + as_ln_s='cp -p' +-elif ln conf$$.file conf$$ 2>/dev/null; then +- as_ln_s=ln ++ fi + else + as_ln_s='cp -p' + fi +@@ -513,7 +491,7 @@ + rmdir conf$$.dir 2>/dev/null + + if mkdir -p . 2>/dev/null; then +- as_mkdir_p=: ++ as_mkdir_p='mkdir -p "$as_dir"' + else + test -d ./-p && rmdir ./-p + as_mkdir_p=false +@@ -530,12 +508,12 @@ + as_test_x=' + eval sh -c '\'' + if test -d "$1"; then +- test -d "$1/."; ++ test -d "$1/."; + else +- case $1 in +- -*)set "./$1";; ++ case $1 in #( ++ -*)set "./$1";; + esac; +- case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in ++ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #(( + ???[sx]*):;;*)false;;esac;fi + '\'' sh + ' +@@ -549,11 +527,11 @@ + as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" + + +- +-exec 7<&0 </dev/null 6>&1 ++test -n "$DJDIR" || exec 7<&0 </dev/null ++exec 6>&1 + + # Name of the host. +-# hostname on some systems (SVR3.2, Linux) returns a bogus exit status, ++# hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status, + # so uname gets run too. + ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` + +@@ -568,7 +546,6 @@ + subdirs= + MFLAGS= + MAKEFLAGS= +-SHELL=${CONFIG_SHELL-/bin/sh} + + # Identity of this package. + PACKAGE_NAME= +@@ -576,58 +553,102 @@ + PACKAGE_VERSION= + PACKAGE_STRING= + PACKAGE_BUGREPORT= ++PACKAGE_URL= + + ac_unique_file="rlm_eap_tnc.c" +-ac_subst_vars='SHELL +-PATH_SEPARATOR +-PACKAGE_NAME +-PACKAGE_TARNAME +-PACKAGE_VERSION +-PACKAGE_STRING +-PACKAGE_BUGREPORT +-exec_prefix +-prefix +-program_transform_name +-bindir +-sbindir +-libexecdir +-datarootdir +-datadir +-sysconfdir +-sharedstatedir +-localstatedir +-includedir +-oldincludedir +-docdir +-infodir +-htmldir +-dvidir +-pdfdir +-psdir +-libdir +-localedir +-mandir +-DEFS +-ECHO_C +-ECHO_N +-ECHO_T +-LIBS +-build_alias +-host_alias +-target_alias +-CC +-CFLAGS +-LDFLAGS +-CPPFLAGS +-ac_ct_CC +-EXEEXT +-OBJEXT +-eap_tnc_cflags +-eap_tnc_ldflags +-targetname ++# Factoring default headers for most tests. ++ac_includes_default="\ ++#include <stdio.h> ++#ifdef HAVE_SYS_TYPES_H ++# include <sys/types.h> ++#endif ++#ifdef HAVE_SYS_STAT_H ++# include <sys/stat.h> ++#endif ++#ifdef STDC_HEADERS ++# include <stdlib.h> ++# include <stddef.h> ++#else ++# ifdef HAVE_STDLIB_H ++# include <stdlib.h> ++# endif ++#endif ++#ifdef HAVE_STRING_H ++# if !defined STDC_HEADERS && defined HAVE_MEMORY_H ++# include <memory.h> ++# endif ++# include <string.h> ++#endif ++#ifdef HAVE_STRINGS_H ++# include <strings.h> ++#endif ++#ifdef HAVE_INTTYPES_H ++# include <inttypes.h> ++#endif ++#ifdef HAVE_STDINT_H ++# include <stdint.h> ++#endif ++#ifdef HAVE_UNISTD_H ++# include <unistd.h> ++#endif" ++ ++ac_subst_vars='LTLIBOBJS + LIBOBJS +-LTLIBOBJS' ++targetname ++eap_tnc_ldflags ++eap_tnc_cflags ++EGREP ++GREP ++CPP ++OBJEXT ++EXEEXT ++ac_ct_CC ++CPPFLAGS ++LDFLAGS ++CFLAGS ++CC ++target_alias ++host_alias ++build_alias ++LIBS ++ECHO_T ++ECHO_N ++ECHO_C ++DEFS ++mandir ++localedir ++libdir ++psdir ++pdfdir ++dvidir ++htmldir ++infodir ++docdir ++oldincludedir ++includedir ++localstatedir ++sharedstatedir ++sysconfdir ++datadir ++datarootdir ++libexecdir ++sbindir ++bindir ++program_transform_name ++prefix ++exec_prefix ++PACKAGE_URL ++PACKAGE_BUGREPORT ++PACKAGE_STRING ++PACKAGE_VERSION ++PACKAGE_TARNAME ++PACKAGE_NAME ++PATH_SEPARATOR ++SHELL' + ac_subst_files='' ++ac_user_opts=' ++enable_option_checking ++' + ac_precious_vars='build_alias + host_alias + target_alias +@@ -635,12 +656,15 @@ + CFLAGS + LDFLAGS + LIBS +-CPPFLAGS' ++CPPFLAGS ++CPP' + + + # Initialize some variables set by options. + ac_init_help= + ac_init_version=false ++ac_unrecognized_opts= ++ac_unrecognized_sep= + # The variables have the same names as the options, with + # dashes changed to underlines. + cache_file=/dev/null +@@ -696,8 +720,9 @@ + fi + + case $ac_option in +- *=*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; +- *) ac_optarg=yes ;; ++ *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; ++ *=) ac_optarg= ;; ++ *) ac_optarg=yes ;; + esac + + # Accept the important Cygnus configure options, so we can diagnose typos. +@@ -739,13 +764,20 @@ + datarootdir=$ac_optarg ;; + + -disable-* | --disable-*) +- ac_feature=`expr "x$ac_option" : 'x-*disable-\(.*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid feature name: $ac_feature" >&2 +- { (exit 1); exit 1; }; } +- ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'` +- eval enable_$ac_feature=no ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid feature name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"enable_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval enable_$ac_useropt=no ;; + + -docdir | --docdir | --docdi | --doc | --do) + ac_prev=docdir ;; +@@ -758,13 +790,20 @@ + dvidir=$ac_optarg ;; + + -enable-* | --enable-*) +- ac_feature=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid feature name: $ac_feature" >&2 +- { (exit 1); exit 1; }; } +- ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'` +- eval enable_$ac_feature=\$ac_optarg ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid feature name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"enable_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval enable_$ac_useropt=\$ac_optarg ;; + + -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ + | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ +@@ -955,22 +994,36 @@ + ac_init_version=: ;; + + -with-* | --with-*) +- ac_package=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid package name: $ac_package" >&2 +- { (exit 1); exit 1; }; } +- ac_package=`echo $ac_package | sed 's/[-.]/_/g'` +- eval with_$ac_package=\$ac_optarg ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid package name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"with_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval with_$ac_useropt=\$ac_optarg ;; + + -without-* | --without-*) +- ac_package=`expr "x$ac_option" : 'x-*without-\(.*\)'` ++ ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` + # Reject names that are not valid shell variable names. +- expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid package name: $ac_package" >&2 +- { (exit 1); exit 1; }; } +- ac_package=`echo $ac_package | sed 's/[-.]/_/g'` +- eval with_$ac_package=no ;; ++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && ++ as_fn_error $? "invalid package name: $ac_useropt" ++ ac_useropt_orig=$ac_useropt ++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` ++ case $ac_user_opts in ++ *" ++"with_$ac_useropt" ++"*) ;; ++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ++ ac_unrecognized_sep=', ';; ++ esac ++ eval with_$ac_useropt=no ;; + + --x) + # Obsolete; use --with-x. +@@ -990,25 +1043,25 @@ + | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) + x_libraries=$ac_optarg ;; + +- -*) { echo "$as_me: error: unrecognized option: $ac_option +-Try \`$0 --help' for more information." >&2 +- { (exit 1); exit 1; }; } ++ -*) as_fn_error $? "unrecognized option: \`$ac_option' ++Try \`$0 --help' for more information" + ;; + + *=*) + ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` + # Reject names that are not valid shell variable names. +- expr "x$ac_envvar" : ".*[^_$as_cr_alnum]" >/dev/null && +- { echo "$as_me: error: invalid variable name: $ac_envvar" >&2 +- { (exit 1); exit 1; }; } ++ case $ac_envvar in #( ++ '' | [0-9]* | *[!_$as_cr_alnum]* ) ++ as_fn_error $? "invalid variable name: \`$ac_envvar'" ;; ++ esac + eval $ac_envvar=\$ac_optarg + export $ac_envvar ;; + + *) + # FIXME: should be removed in autoconf 3.0. +- echo "$as_me: WARNING: you should use --build, --host, --target" >&2 ++ $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2 + expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && +- echo "$as_me: WARNING: invalid host type: $ac_option" >&2 ++ $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2 + : ${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option} + ;; + +@@ -1017,23 +1070,36 @@ + + if test -n "$ac_prev"; then + ac_option=--`echo $ac_prev | sed 's/_/-/g'` +- { echo "$as_me: error: missing argument to $ac_option" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "missing argument to $ac_option" ++fi ++ ++if test -n "$ac_unrecognized_opts"; then ++ case $enable_option_checking in ++ no) ;; ++ fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;; ++ *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; ++ esac + fi + +-# Be sure to have absolute directory names. ++# Check all directory arguments for consistency. + for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ + datadir sysconfdir sharedstatedir localstatedir includedir \ + oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ + libdir localedir mandir + do + eval ac_val=\$$ac_var ++ # Remove trailing slashes. ++ case $ac_val in ++ */ ) ++ ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` ++ eval $ac_var=\$ac_val;; ++ esac ++ # Be sure to have absolute directory names. + case $ac_val in + [\\/$]* | ?:[\\/]* ) continue;; + NONE | '' ) case $ac_var in *prefix ) continue;; esac;; + esac +- { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val" + done + + # There might be people who depend on the old broken behavior: `$host' +@@ -1047,8 +1113,8 @@ + if test "x$host_alias" != x; then + if test "x$build_alias" = x; then + cross_compiling=maybe +- echo "$as_me: WARNING: If you wanted to set the --build type, don't use --host. +- If a cross compiler is detected then cross compile mode will be used." >&2 ++ $as_echo "$as_me: WARNING: if you wanted to set the --build type, don't use --host. ++ If a cross compiler is detected then cross compile mode will be used" >&2 + elif test "x$build_alias" != "x$host_alias"; then + cross_compiling=yes + fi +@@ -1063,23 +1129,21 @@ + ac_pwd=`pwd` && test -n "$ac_pwd" && + ac_ls_di=`ls -di .` && + ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || +- { echo "$as_me: error: Working directory cannot be determined" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "working directory cannot be determined" + test "X$ac_ls_di" = "X$ac_pwd_ls_di" || +- { echo "$as_me: error: pwd does not report name of working directory" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "pwd does not report name of working directory" + + + # Find the source files, if location was not specified. + if test -z "$srcdir"; then + ac_srcdir_defaulted=yes + # Try the directory containing this script, then the parent directory. +- ac_confdir=`$as_dirname -- "$0" || +-$as_expr X"$0" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ +- X"$0" : 'X\(//\)[^/]' \| \ +- X"$0" : 'X\(//\)$' \| \ +- X"$0" : 'X\(/\)' \| . 2>/dev/null || +-echo X"$0" | ++ ac_confdir=`$as_dirname -- "$as_myself" || ++$as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ ++ X"$as_myself" : 'X\(//\)[^/]' \| \ ++ X"$as_myself" : 'X\(//\)$' \| \ ++ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X"$as_myself" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ + s//\1/ + q +@@ -1106,13 +1170,11 @@ + fi + if test ! -r "$srcdir/$ac_unique_file"; then + test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." +- { echo "$as_me: error: cannot find sources ($ac_unique_file) in $srcdir" >&2 +- { (exit 1); exit 1; }; } ++ as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir" + fi + ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" + ac_abs_confdir=`( +- cd "$srcdir" && test -r "./$ac_unique_file" || { echo "$as_me: error: $ac_msg" >&2 +- { (exit 1); exit 1; }; } ++ cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg" + pwd)` + # When building in place, set srcdir=. + if test "$ac_abs_confdir" = "$ac_pwd"; then +@@ -1152,7 +1214,7 @@ + --help=short display options specific to this package + --help=recursive display the short help of all the included packages + -V, --version display version information and exit +- -q, --quiet, --silent do not print \`checking...' messages ++ -q, --quiet, --silent do not print \`checking ...' messages + --cache-file=FILE cache test results in FILE [disabled] + -C, --config-cache alias for \`--cache-file=config.cache' + -n, --no-create do not create output files +@@ -1160,9 +1222,9 @@ + + Installation directories: + --prefix=PREFIX install architecture-independent files in PREFIX +- [$ac_default_prefix] ++ [$ac_default_prefix] + --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX +- [PREFIX] ++ [PREFIX] + + By default, \`make install' will install all the files in + \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify +@@ -1172,25 +1234,25 @@ + For better control, use the options below. + + Fine tuning of the installation directories: +- --bindir=DIR user executables [EPREFIX/bin] +- --sbindir=DIR system admin executables [EPREFIX/sbin] +- --libexecdir=DIR program executables [EPREFIX/libexec] +- --sysconfdir=DIR read-only single-machine data [PREFIX/etc] +- --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] +- --localstatedir=DIR modifiable single-machine data [PREFIX/var] +- --libdir=DIR object code libraries [EPREFIX/lib] +- --includedir=DIR C header files [PREFIX/include] +- --oldincludedir=DIR C header files for non-gcc [/usr/include] +- --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] +- --datadir=DIR read-only architecture-independent data [DATAROOTDIR] +- --infodir=DIR info documentation [DATAROOTDIR/info] +- --localedir=DIR locale-dependent data [DATAROOTDIR/locale] +- --mandir=DIR man documentation [DATAROOTDIR/man] +- --docdir=DIR documentation root [DATAROOTDIR/doc/PACKAGE] +- --htmldir=DIR html documentation [DOCDIR] +- --dvidir=DIR dvi documentation [DOCDIR] +- --pdfdir=DIR pdf documentation [DOCDIR] +- --psdir=DIR ps documentation [DOCDIR] ++ --bindir=DIR user executables [EPREFIX/bin] ++ --sbindir=DIR system admin executables [EPREFIX/sbin] ++ --libexecdir=DIR program executables [EPREFIX/libexec] ++ --sysconfdir=DIR read-only single-machine data [PREFIX/etc] ++ --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] ++ --localstatedir=DIR modifiable single-machine data [PREFIX/var] ++ --libdir=DIR object code libraries [EPREFIX/lib] ++ --includedir=DIR C header files [PREFIX/include] ++ --oldincludedir=DIR C header files for non-gcc [/usr/include] ++ --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] ++ --datadir=DIR read-only architecture-independent data [DATAROOTDIR] ++ --infodir=DIR info documentation [DATAROOTDIR/info] ++ --localedir=DIR locale-dependent data [DATAROOTDIR/locale] ++ --mandir=DIR man documentation [DATAROOTDIR/man] ++ --docdir=DIR documentation root [DATAROOTDIR/doc/PACKAGE] ++ --htmldir=DIR html documentation [DOCDIR] ++ --dvidir=DIR dvi documentation [DOCDIR] ++ --pdfdir=DIR pdf documentation [DOCDIR] ++ --psdir=DIR ps documentation [DOCDIR] + _ACEOF + + cat <<\_ACEOF +@@ -1207,12 +1269,14 @@ + LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a + nonstandard directory <lib dir> + LIBS libraries to pass to the linker, e.g. -l<library> +- CPPFLAGS C/C++/Objective C preprocessor flags, e.g. -I<include dir> if ++ CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if + you have headers in a nonstandard directory <include dir> ++ CPP C preprocessor + + Use these variables to override the choices made by `configure' or to help + it to find libraries and programs with nonstandard names/locations. + ++Report bugs to the package provider. + _ACEOF + ac_status=$? + fi +@@ -1220,15 +1284,17 @@ + if test "$ac_init_help" = "recursive"; then + # If there are subdirs, report their specific --help. + for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue +- test -d "$ac_dir" || continue ++ test -d "$ac_dir" || ++ { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || ++ continue + ac_builddir=. + + case "$ac_dir" in + .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) +- ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` ++ ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` + # A ".." for each directory in $ac_dir_suffix. +- ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'` ++ ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` + case $ac_top_builddir_sub in + "") ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; +@@ -1264,7 +1330,7 @@ + echo && + $SHELL "$ac_srcdir/configure" --help=recursive + else +- echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 ++ $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 + fi || ac_status=$? + cd "$ac_pwd" || { ac_status=$?; break; } + done +@@ -1274,21 +1340,305 @@ + if $ac_init_version; then + cat <<\_ACEOF + configure +-generated by GNU Autoconf 2.61 ++generated by GNU Autoconf 2.67 + +-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, +-2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc. ++Copyright (C) 2010 Free Software Foundation, Inc. + This configure script is free software; the Free Software Foundation + gives unlimited permission to copy, distribute and modify it. + _ACEOF + exit + fi ++ ++## ------------------------ ## ++## Autoconf initialization. ## ++## ------------------------ ## ++ ++# ac_fn_c_try_compile LINENO ++# -------------------------- ++# Try to compile conftest.$ac_ext, and return whether this succeeded. ++ac_fn_c_try_compile () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ rm -f conftest.$ac_objext ++ if { { ac_try="$ac_compile" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_compile") 2>conftest.err ++ ac_status=$? ++ if test -s conftest.err; then ++ grep -v '^ *+' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ mv -f conftest.er1 conftest.err ++ fi ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest.$ac_objext; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=1 ++fi ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_compile ++ ++# ac_fn_c_try_link LINENO ++# ----------------------- ++# Try to link conftest.$ac_ext, and return whether this succeeded. ++ac_fn_c_try_link () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ rm -f conftest.$ac_objext conftest$ac_exeext ++ if { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>conftest.err ++ ac_status=$? ++ if test -s conftest.err; then ++ grep -v '^ *+' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ mv -f conftest.er1 conftest.err ++ fi ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest$ac_exeext && { ++ test "$cross_compiling" = yes || ++ $as_test_x conftest$ac_exeext ++ }; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=1 ++fi ++ # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information ++ # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would ++ # interfere with the next link command; also delete a directory that is ++ # left behind by Apple's compiler. We do this before executing the actions. ++ rm -rf conftest.dSYM conftest_ipa8_conftest.oo ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_link ++ ++# ac_fn_c_try_cpp LINENO ++# ---------------------- ++# Try to preprocess conftest.$ac_ext, and return whether this succeeded. ++ac_fn_c_try_cpp () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ if { { ac_try="$ac_cpp conftest.$ac_ext" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err ++ ac_status=$? ++ if test -s conftest.err; then ++ grep -v '^ *+' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ mv -f conftest.er1 conftest.err ++ fi ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } > conftest.i && { ++ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || ++ test ! -s conftest.err ++ }; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=1 ++fi ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_cpp ++ ++# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES ++# ------------------------------------------------------- ++# Tests whether HEADER exists, giving a warning if it cannot be compiled using ++# the include files in INCLUDES and setting the cache variable VAR ++# accordingly. ++ac_fn_c_check_header_mongrel () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ if eval "test \"\${$3+set}\"" = set; then : ++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 ++$as_echo_n "checking for $2... " >&6; } ++if eval "test \"\${$3+set}\"" = set; then : ++ $as_echo_n "(cached) " >&6 ++fi ++eval ac_res=\$$3 ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 ++$as_echo "$ac_res" >&6; } ++else ++ # Is the header compilable? ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5 ++$as_echo_n "checking $2 usability... " >&6; } ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++$4 ++#include <$2> ++_ACEOF ++if ac_fn_c_try_compile "$LINENO"; then : ++ ac_header_compiler=yes ++else ++ ac_header_compiler=no ++fi ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5 ++$as_echo "$ac_header_compiler" >&6; } ++ ++# Is the header present? ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5 ++$as_echo_n "checking $2 presence... " >&6; } ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <$2> ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ ac_header_preproc=yes ++else ++ ac_header_preproc=no ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5 ++$as_echo "$ac_header_preproc" >&6; } ++ ++# So? What about this header? ++case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #(( ++ yes:no: ) ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5 ++$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 ++$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ++ ;; ++ no:yes:* ) ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5 ++$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5 ++$as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5 ++$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5 ++$as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 ++$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ++ ;; ++esac ++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 ++$as_echo_n "checking for $2... " >&6; } ++if eval "test \"\${$3+set}\"" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ eval "$3=\$ac_header_compiler" ++fi ++eval ac_res=\$$3 ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 ++$as_echo "$ac_res" >&6; } ++fi ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ ++} # ac_fn_c_check_header_mongrel ++ ++# ac_fn_c_try_run LINENO ++# ---------------------- ++# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes ++# that executables *can* be run. ++ac_fn_c_try_run () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ if { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } && { ac_try='./conftest$ac_exeext' ++ { { case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_try") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; }; then : ++ ac_retval=0 ++else ++ $as_echo "$as_me: program exited with status $ac_status" >&5 ++ $as_echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_retval=$ac_status ++fi ++ rm -rf conftest.dSYM conftest_ipa8_conftest.oo ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ as_fn_set_status $ac_retval ++ ++} # ac_fn_c_try_run ++ ++# ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES ++# ------------------------------------------------------- ++# Tests whether HEADER exists and can be compiled using the include files in ++# INCLUDES, setting the cache variable VAR accordingly. ++ac_fn_c_check_header_compile () ++{ ++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 ++$as_echo_n "checking for $2... " >&6; } ++if eval "test \"\${$3+set}\"" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++$4 ++#include <$2> ++_ACEOF ++if ac_fn_c_try_compile "$LINENO"; then : ++ eval "$3=yes" ++else ++ eval "$3=no" ++fi ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++fi ++eval ac_res=\$$3 ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 ++$as_echo "$ac_res" >&6; } ++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;} ++ ++} # ac_fn_c_check_header_compile + cat >config.log <<_ACEOF + This file contains any messages produced by compilers while + running configure, to aid debugging if configure makes a mistake. + + It was created by $as_me, which was +-generated by GNU Autoconf 2.61. Invocation command line was ++generated by GNU Autoconf 2.67. Invocation command line was + + $ $0 $@ + +@@ -1324,8 +1674,8 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- echo "PATH: $as_dir" +-done ++ $as_echo "PATH: $as_dir" ++ done + IFS=$as_save_IFS + + } >&5 +@@ -1359,12 +1709,12 @@ + | -silent | --silent | --silen | --sile | --sil) + continue ;; + *\'*) +- ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; ++ ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; + esac + case $ac_pass in +- 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;; ++ 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;; + 2) +- ac_configure_args1="$ac_configure_args1 '$ac_arg'" ++ as_fn_append ac_configure_args1 " '$ac_arg'" + if test $ac_must_keep_next = true; then + ac_must_keep_next=false # Got value, back to normal. + else +@@ -1380,13 +1730,13 @@ + -* ) ac_must_keep_next=true ;; + esac + fi +- ac_configure_args="$ac_configure_args '$ac_arg'" ++ as_fn_append ac_configure_args " '$ac_arg'" + ;; + esac + done + done +-$as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; } +-$as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; } ++{ ac_configure_args0=; unset ac_configure_args0;} ++{ ac_configure_args1=; unset ac_configure_args1;} + + # When interrupted or exit'd, cleanup temporary files, and complete + # config.log. We remove comments because anyway the quotes in there +@@ -1398,11 +1748,9 @@ + { + echo + +- cat <<\_ASBOX +-## ---------------- ## ++ $as_echo "## ---------------- ## + ## Cache variables. ## +-## ---------------- ## +-_ASBOX ++## ---------------- ##" + echo + # The following way of writing the cache mishandles newlines in values, + ( +@@ -1411,12 +1759,13 @@ + case $ac_val in #( + *${as_nl}*) + case $ac_var in #( +- *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5 +-echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;; ++ *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 ++$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; + esac + case $ac_var in #( + _ | IFS | as_nl) ;; #( +- *) $as_unset $ac_var ;; ++ BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( ++ *) { eval $ac_var=; unset $ac_var;} ;; + esac ;; + esac + done +@@ -1435,128 +1784,136 @@ + ) + echo + +- cat <<\_ASBOX +-## ----------------- ## ++ $as_echo "## ----------------- ## + ## Output variables. ## +-## ----------------- ## +-_ASBOX ++## ----------------- ##" + echo + for ac_var in $ac_subst_vars + do + eval ac_val=\$$ac_var + case $ac_val in +- *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; ++ *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; + esac +- echo "$ac_var='\''$ac_val'\''" ++ $as_echo "$ac_var='\''$ac_val'\''" + done | sort + echo + + if test -n "$ac_subst_files"; then +- cat <<\_ASBOX +-## ------------------- ## ++ $as_echo "## ------------------- ## + ## File substitutions. ## +-## ------------------- ## +-_ASBOX ++## ------------------- ##" + echo + for ac_var in $ac_subst_files + do + eval ac_val=\$$ac_var + case $ac_val in +- *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; ++ *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; + esac +- echo "$ac_var='\''$ac_val'\''" ++ $as_echo "$ac_var='\''$ac_val'\''" + done | sort + echo + fi + + if test -s confdefs.h; then +- cat <<\_ASBOX +-## ----------- ## ++ $as_echo "## ----------- ## + ## confdefs.h. ## +-## ----------- ## +-_ASBOX ++## ----------- ##" + echo + cat confdefs.h + echo + fi + test "$ac_signal" != 0 && +- echo "$as_me: caught signal $ac_signal" +- echo "$as_me: exit $exit_status" ++ $as_echo "$as_me: caught signal $ac_signal" ++ $as_echo "$as_me: exit $exit_status" + } >&5 + rm -f core *.core core.conftest.* && + rm -f -r conftest* confdefs* conf$$* $ac_clean_files && + exit $exit_status + ' 0 + for ac_signal in 1 2 13 15; do +- trap 'ac_signal='$ac_signal'; { (exit 1); exit 1; }' $ac_signal ++ trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal + done + ac_signal=0 + + # confdefs.h avoids OS command line length limits that DEFS can exceed. + rm -f -r conftest* confdefs.h + ++$as_echo "/* confdefs.h */" > confdefs.h ++ + # Predefined preprocessor variables. + + cat >>confdefs.h <<_ACEOF + #define PACKAGE_NAME "$PACKAGE_NAME" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_TARNAME "$PACKAGE_TARNAME" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_VERSION "$PACKAGE_VERSION" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_STRING "$PACKAGE_STRING" + _ACEOF + +- + cat >>confdefs.h <<_ACEOF + #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" + _ACEOF + ++cat >>confdefs.h <<_ACEOF ++#define PACKAGE_URL "$PACKAGE_URL" ++_ACEOF ++ + + # Let the site file select an alternate cache file if it wants to. +-# Prefer explicitly selected file to automatically selected ones. ++# Prefer an explicitly selected file to automatically selected ones. ++ac_site_file1=NONE ++ac_site_file2=NONE + if test -n "$CONFIG_SITE"; then +- set x "$CONFIG_SITE" ++ # We do not want a PATH search for config.site. ++ case $CONFIG_SITE in #(( ++ -*) ac_site_file1=./$CONFIG_SITE;; ++ */*) ac_site_file1=$CONFIG_SITE;; ++ *) ac_site_file1=./$CONFIG_SITE;; ++ esac + elif test "x$prefix" != xNONE; then +- set x "$prefix/share/config.site" "$prefix/etc/config.site" ++ ac_site_file1=$prefix/share/config.site ++ ac_site_file2=$prefix/etc/config.site + else +- set x "$ac_default_prefix/share/config.site" \ +- "$ac_default_prefix/etc/config.site" ++ ac_site_file1=$ac_default_prefix/share/config.site ++ ac_site_file2=$ac_default_prefix/etc/config.site + fi +-shift +-for ac_site_file ++for ac_site_file in "$ac_site_file1" "$ac_site_file2" + do +- if test -r "$ac_site_file"; then +- { echo "$as_me:$LINENO: loading site script $ac_site_file" >&5 +-echo "$as_me: loading site script $ac_site_file" >&6;} ++ test "x$ac_site_file" = xNONE && continue ++ if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5 ++$as_echo "$as_me: loading site script $ac_site_file" >&6;} + sed 's/^/| /' "$ac_site_file" >&5 +- . "$ac_site_file" ++ . "$ac_site_file" \ ++ || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "failed to load site script $ac_site_file ++See \`config.log' for more details" "$LINENO" 5 ; } + fi + done + + if test -r "$cache_file"; then +- # Some versions of bash will fail to source /dev/null (special +- # files actually), so we avoid doing that. +- if test -f "$cache_file"; then +- { echo "$as_me:$LINENO: loading cache $cache_file" >&5 +-echo "$as_me: loading cache $cache_file" >&6;} ++ # Some versions of bash will fail to source /dev/null (special files ++ # actually), so we avoid doing that. DJGPP emulates it as a regular file. ++ if test /dev/null != "$cache_file" && test -f "$cache_file"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5 ++$as_echo "$as_me: loading cache $cache_file" >&6;} + case $cache_file in + [\\/]* | ?:[\\/]* ) . "$cache_file";; + *) . "./$cache_file";; + esac + fi + else +- { echo "$as_me:$LINENO: creating cache $cache_file" >&5 +-echo "$as_me: creating cache $cache_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5 ++$as_echo "$as_me: creating cache $cache_file" >&6;} + >$cache_file + fi + +@@ -1570,60 +1927,56 @@ + eval ac_new_val=\$ac_env_${ac_var}_value + case $ac_old_set,$ac_new_set in + set,) +- { echo "$as_me:$LINENO: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 +-echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 ++$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} + ac_cache_corrupted=: ;; + ,set) +- { echo "$as_me:$LINENO: error: \`$ac_var' was not set in the previous run" >&5 +-echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5 ++$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} + ac_cache_corrupted=: ;; + ,);; + *) + if test "x$ac_old_val" != "x$ac_new_val"; then +- { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5 +-echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} +- { echo "$as_me:$LINENO: former value: $ac_old_val" >&5 +-echo "$as_me: former value: $ac_old_val" >&2;} +- { echo "$as_me:$LINENO: current value: $ac_new_val" >&5 +-echo "$as_me: current value: $ac_new_val" >&2;} +- ac_cache_corrupted=: ++ # differences in whitespace do not lead to failure. ++ ac_old_val_w=`echo x $ac_old_val` ++ ac_new_val_w=`echo x $ac_new_val` ++ if test "$ac_old_val_w" != "$ac_new_val_w"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5 ++$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ++ ac_cache_corrupted=: ++ else ++ { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 ++$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} ++ eval $ac_var=\$ac_old_val ++ fi ++ { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5 ++$as_echo "$as_me: former value: \`$ac_old_val'" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5 ++$as_echo "$as_me: current value: \`$ac_new_val'" >&2;} + fi;; + esac + # Pass precious variables to config.status. + if test "$ac_new_set" = set; then + case $ac_new_val in +- *\'*) ac_arg=$ac_var=`echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; ++ *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; + *) ac_arg=$ac_var=$ac_new_val ;; + esac + case " $ac_configure_args " in + *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. +- *) ac_configure_args="$ac_configure_args '$ac_arg'" ;; ++ *) as_fn_append ac_configure_args " '$ac_arg'" ;; + esac + fi + done + if $ac_cache_corrupted; then +- { echo "$as_me:$LINENO: error: changes in the environment can compromise the build" >&5 +-echo "$as_me: error: changes in the environment can compromise the build" >&2;} +- { { echo "$as_me:$LINENO: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&5 +-echo "$as_me: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&2;} +- { (exit 1); exit 1; }; } +-fi +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5 ++$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;} ++ as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5 ++fi ++## -------------------- ## ++## Main body of script. ## ++## -------------------- ## + + ac_ext=c + ac_cpp='$CPP $CPPFLAGS' +@@ -1635,6 +1988,9 @@ + + + ++eap_tnc_cflags= ++eap_tnc_ldflags=-lnaaeap ++ + if test x$with_rlm_eap_tnc != xno; then + + ac_ext=c +@@ -1645,10 +2001,10 @@ + if test -n "$ac_tool_prefix"; then + # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. + set dummy ${ac_tool_prefix}gcc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1658,25 +2014,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_CC="${ac_tool_prefix}gcc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1685,10 +2041,10 @@ + ac_ct_CC=$CC + # Extract the first word of "gcc", so it can be a program name with args. + set dummy gcc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_ac_ct_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_ac_ct_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$ac_ct_CC"; then + ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. +@@ -1698,25 +2054,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_ac_ct_CC="gcc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + ac_ct_CC=$ac_cv_prog_ac_ct_CC + if test -n "$ac_ct_CC"; then +- { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5 +-echo "${ECHO_T}$ac_ct_CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 ++$as_echo "$ac_ct_CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + if test "x$ac_ct_CC" = x; then +@@ -1724,12 +2080,8 @@ + else + case $cross_compiling:$ac_tool_warned in + yes:) +-{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&5 +-echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&2;} ++{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 ++$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} + ac_tool_warned=yes ;; + esac + CC=$ac_ct_CC +@@ -1742,10 +2094,10 @@ + if test -n "$ac_tool_prefix"; then + # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. + set dummy ${ac_tool_prefix}cc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1755,25 +2107,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_CC="${ac_tool_prefix}cc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1782,10 +2134,10 @@ + if test -z "$CC"; then + # Extract the first word of "cc", so it can be a program name with args. + set dummy cc; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1796,18 +2148,18 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then + ac_prog_rejected=yes + continue + fi + ac_cv_prog_CC="cc" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + if test $ac_prog_rejected = yes; then +@@ -1826,11 +2178,11 @@ + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1841,10 +2193,10 @@ + do + # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. + set dummy $ac_tool_prefix$ac_prog; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$CC"; then + ac_cv_prog_CC="$CC" # Let the user override the test. +@@ -1854,25 +2206,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_CC="$ac_tool_prefix$ac_prog" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + CC=$ac_cv_prog_CC + if test -n "$CC"; then +- { echo "$as_me:$LINENO: result: $CC" >&5 +-echo "${ECHO_T}$CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 ++$as_echo "$CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1885,10 +2237,10 @@ + do + # Extract the first word of "$ac_prog", so it can be a program name with args. + set dummy $ac_prog; ac_word=$2 +-{ echo "$as_me:$LINENO: checking for $ac_word" >&5 +-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; } +-if test "${ac_cv_prog_ac_ct_CC+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 ++$as_echo_n "checking for $ac_word... " >&6; } ++if test "${ac_cv_prog_ac_ct_CC+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + if test -n "$ac_ct_CC"; then + ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. +@@ -1898,25 +2250,25 @@ + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- for ac_exec_ext in '' $ac_executable_extensions; do ++ for ac_exec_ext in '' $ac_executable_extensions; do + if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then + ac_cv_prog_ac_ct_CC="$ac_prog" +- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 ++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi + done +-done ++ done + IFS=$as_save_IFS + + fi + fi + ac_ct_CC=$ac_cv_prog_ac_ct_CC + if test -n "$ac_ct_CC"; then +- { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5 +-echo "${ECHO_T}$ac_ct_CC" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 ++$as_echo "$ac_ct_CC" >&6; } + else +- { echo "$as_me:$LINENO: result: no" >&5 +-echo "${ECHO_T}no" >&6; } ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } + fi + + +@@ -1928,12 +2280,8 @@ + else + case $cross_compiling:$ac_tool_warned in + yes:) +-{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&5 +-echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools +-whose name does not start with the host triplet. If you think this +-configuration is useful to you, please write to autoconf@gnu.org." >&2;} ++{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 ++$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} + ac_tool_warned=yes ;; + esac + CC=$ac_ct_CC +@@ -1943,51 +2291,37 @@ + fi + + +-test -z "$CC" && { { echo "$as_me:$LINENO: error: no acceptable C compiler found in \$PATH +-See \`config.log' for more details." >&5 +-echo "$as_me: error: no acceptable C compiler found in \$PATH +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } ++test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "no acceptable C compiler found in \$PATH ++See \`config.log' for more details" "$LINENO" 5 ; } + + # Provide some information about the compiler. +-echo "$as_me:$LINENO: checking for C compiler version" >&5 +-ac_compiler=`set X $ac_compile; echo $2` +-{ (ac_try="$ac_compiler --version >&5" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compiler --version >&5") 2>&5 +- ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } +-{ (ac_try="$ac_compiler -v >&5" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compiler -v >&5") 2>&5 +- ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } +-{ (ac_try="$ac_compiler -V >&5" ++$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 ++set X $ac_compile ++ac_compiler=$2 ++for ac_option in --version -v -V -qversion; do ++ { { ac_try="$ac_compiler $ac_option >&5" + case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compiler -V >&5") 2>&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_compiler $ac_option >&5") 2>conftest.err + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } ++ if test -s conftest.err; then ++ sed '10a\ ++... rest of stderr output deleted ... ++ 10q' conftest.err >conftest.er1 ++ cat conftest.er1 >&5 ++ fi ++ rm -f conftest.er1 conftest.err ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } ++done + +-cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -1999,42 +2333,38 @@ + } + _ACEOF + ac_clean_files_save=$ac_clean_files +-ac_clean_files="$ac_clean_files a.out a.exe b.out" ++ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out" + # Try to create an executable without -o first, disregard a.out. + # It will help us diagnose broken compilers, and finding out an intuition + # of exeext. +-{ echo "$as_me:$LINENO: checking for C compiler default output file name" >&5 +-echo $ECHO_N "checking for C compiler default output file name... $ECHO_C" >&6; } +-ac_link_default=`echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` +-# +-# List of possible output files, starting from the most likely. +-# The algorithm is not robust to junk in `.', hence go to wildcards (a.*) +-# only as a last resort. b.out is created by i960 compilers. +-ac_files='a_out.exe a.exe conftest.exe a.out conftest a.* conftest.* b.out' +-# +-# The IRIX 6 linker writes into existing files which may not be +-# executable, retaining their permissions. Remove them first so a +-# subsequent execution test works. ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5 ++$as_echo_n "checking whether the C compiler works... " >&6; } ++ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` ++ ++# The possible output files: ++ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*" ++ + ac_rmfiles= + for ac_file in $ac_files + do + case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;; ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; + * ) ac_rmfiles="$ac_rmfiles $ac_file";; + esac + done + rm -f $ac_rmfiles + +-if { (ac_try="$ac_link_default" ++if { { ac_try="$ac_link_default" + case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 + (eval "$ac_link_default") 2>&5 + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; then ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; then : + # Autoconf-2.13 could set the ac_cv_exeext variable to `no'. + # So ignore a value of `no', otherwise this would lead to `EXEEXT = no' + # in a Makefile. We should not override ac_cv_exeext if it was cached, +@@ -2044,14 +2374,14 @@ + do + test -f "$ac_file" || continue + case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) + ;; + [ab].out ) + # We found the default executable, but exeext='' is most + # certainly right. + break;; + *.* ) +- if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; ++ if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; + then :; else + ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` + fi +@@ -2070,116 +2400,132 @@ + else + ac_file='' + fi +- +-{ echo "$as_me:$LINENO: result: $ac_file" >&5 +-echo "${ECHO_T}$ac_file" >&6; } +-if test -z "$ac_file"; then +- echo "$as_me: failed program was:" >&5 ++if test -z "$ac_file"; then : ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 ++$as_echo "no" >&6; } ++$as_echo "$as_me: failed program was:" >&5 + sed 's/^/| /' conftest.$ac_ext >&5 + +-{ { echo "$as_me:$LINENO: error: C compiler cannot create executables +-See \`config.log' for more details." >&5 +-echo "$as_me: error: C compiler cannot create executables +-See \`config.log' for more details." >&2;} +- { (exit 77); exit 77; }; } +-fi +- ++{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error 77 "C compiler cannot create executables ++See \`config.log' for more details" "$LINENO" 5 ; } ++else ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 ++$as_echo "yes" >&6; } ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5 ++$as_echo_n "checking for C compiler default output file name... " >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5 ++$as_echo "$ac_file" >&6; } + ac_exeext=$ac_cv_exeext + ++rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out ++ac_clean_files=$ac_clean_files_save ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5 ++$as_echo_n "checking for suffix of executables... " >&6; } ++if { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; then : ++ # If both `conftest.exe' and `conftest' are `present' (well, observable) ++# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will ++# work properly (i.e., refer to `conftest.exe'), while it won't with ++# `rm'. ++for ac_file in conftest.exe conftest conftest.*; do ++ test -f "$ac_file" || continue ++ case $ac_file in ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; ++ *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` ++ break;; ++ * ) break;; ++ esac ++done ++else ++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "cannot compute suffix of executables: cannot compile and link ++See \`config.log' for more details" "$LINENO" 5 ; } ++fi ++rm -f conftest conftest$ac_cv_exeext ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5 ++$as_echo "$ac_cv_exeext" >&6; } ++ ++rm -f conftest.$ac_ext ++EXEEXT=$ac_cv_exeext ++ac_exeext=$EXEEXT ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <stdio.h> ++int ++main () ++{ ++FILE *f = fopen ("conftest.out", "w"); ++ return ferror (f) || fclose (f) != 0; ++ ++ ; ++ return 0; ++} ++_ACEOF ++ac_clean_files="$ac_clean_files conftest.out" + # Check that the compiler produces executables we can run. If not, either + # the compiler is broken, or we cross compile. +-{ echo "$as_me:$LINENO: checking whether the C compiler works" >&5 +-echo $ECHO_N "checking whether the C compiler works... $ECHO_C" >&6; } +-# FIXME: These cross compiler hacks should be removed for Autoconf 3.0 +-# If not cross compiling, check that we can run a simple program. ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5 ++$as_echo_n "checking whether we are cross compiling... " >&6; } + if test "$cross_compiling" != yes; then +- if { ac_try='./$ac_file' +- { (case "(($ac_try" in ++ { { ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 ++ (eval "$ac_link") 2>&5 ++ ac_status=$? ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; } ++ if { ac_try='./conftest$ac_cv_exeext' ++ { { case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 + (eval "$ac_try") 2>&5 + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; }; then ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; }; then + cross_compiling=no + else + if test "$cross_compiling" = maybe; then + cross_compiling=yes + else +- { { echo "$as_me:$LINENO: error: cannot run C compiled programs. +-If you meant to cross compile, use \`--host'. +-See \`config.log' for more details." >&5 +-echo "$as_me: error: cannot run C compiled programs. ++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "cannot run C compiled programs. + If you meant to cross compile, use \`--host'. +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } ++See \`config.log' for more details" "$LINENO" 5 ; } + fi + fi + fi +-{ echo "$as_me:$LINENO: result: yes" >&5 +-echo "${ECHO_T}yes" >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5 ++$as_echo "$cross_compiling" >&6; } + +-rm -f a.out a.exe conftest$ac_cv_exeext b.out ++rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out + ac_clean_files=$ac_clean_files_save +-# Check that the compiler produces executables we can run. If not, either +-# the compiler is broken, or we cross compile. +-{ echo "$as_me:$LINENO: checking whether we are cross compiling" >&5 +-echo $ECHO_N "checking whether we are cross compiling... $ECHO_C" >&6; } +-{ echo "$as_me:$LINENO: result: $cross_compiling" >&5 +-echo "${ECHO_T}$cross_compiling" >&6; } +- +-{ echo "$as_me:$LINENO: checking for suffix of executables" >&5 +-echo $ECHO_N "checking for suffix of executables... $ECHO_C" >&6; } +-if { (ac_try="$ac_link" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_link") 2>&5 +- ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; then +- # If both `conftest.exe' and `conftest' are `present' (well, observable) +-# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will +-# work properly (i.e., refer to `conftest.exe'), while it won't with +-# `rm'. +-for ac_file in conftest.exe conftest conftest.*; do +- test -f "$ac_file" || continue +- case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;; +- *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` +- break;; +- * ) break;; +- esac +-done ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5 ++$as_echo_n "checking for suffix of object files... " >&6; } ++if test "${ac_cv_objext+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else +- { { echo "$as_me:$LINENO: error: cannot compute suffix of executables: cannot compile and link +-See \`config.log' for more details." >&5 +-echo "$as_me: error: cannot compute suffix of executables: cannot compile and link +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } +-fi +- +-rm -f conftest$ac_cv_exeext +-{ echo "$as_me:$LINENO: result: $ac_cv_exeext" >&5 +-echo "${ECHO_T}$ac_cv_exeext" >&6; } +- +-rm -f conftest.$ac_ext +-EXEEXT=$ac_cv_exeext +-ac_exeext=$EXEEXT +-{ echo "$as_me:$LINENO: checking for suffix of object files" >&5 +-echo $ECHO_N "checking for suffix of object files... $ECHO_C" >&6; } +-if test "${ac_cv_objext+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 +-else +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2191,51 +2537,46 @@ + } + _ACEOF + rm -f conftest.o conftest.obj +-if { (ac_try="$ac_compile" ++if { { ac_try="$ac_compile" + case "(($ac_try" in + *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; + *) ac_try_echo=$ac_try;; + esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" ++$as_echo "$ac_try_echo"; } >&5 + (eval "$ac_compile") 2>&5 + ac_status=$? +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); }; then ++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 ++ test $ac_status = 0; }; then : + for ac_file in conftest.o conftest.obj conftest.*; do + test -f "$ac_file" || continue; + case $ac_file in +- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf ) ;; ++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; + *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` + break;; + esac + done + else +- echo "$as_me: failed program was:" >&5 ++ $as_echo "$as_me: failed program was:" >&5 + sed 's/^/| /' conftest.$ac_ext >&5 + +-{ { echo "$as_me:$LINENO: error: cannot compute suffix of object files: cannot compile +-See \`config.log' for more details." >&5 +-echo "$as_me: error: cannot compute suffix of object files: cannot compile +-See \`config.log' for more details." >&2;} +- { (exit 1); exit 1; }; } ++{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "cannot compute suffix of object files: cannot compile ++See \`config.log' for more details" "$LINENO" 5 ; } + fi +- + rm -f conftest.$ac_cv_objext conftest.$ac_ext + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_objext" >&5 +-echo "${ECHO_T}$ac_cv_objext" >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5 ++$as_echo "$ac_cv_objext" >&6; } + OBJEXT=$ac_cv_objext + ac_objext=$OBJEXT +-{ echo "$as_me:$LINENO: checking whether we are using the GNU C compiler" >&5 +-echo $ECHO_N "checking whether we are using the GNU C compiler... $ECHO_C" >&6; } +-if test "${ac_cv_c_compiler_gnu+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5 ++$as_echo_n "checking whether we are using the GNU C compiler... " >&6; } ++if test "${ac_cv_c_compiler_gnu+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2249,54 +2590,34 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++if ac_fn_c_try_compile "$LINENO"; then : + ac_compiler_gnu=yes + else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- ac_compiler_gnu=no ++ ac_compiler_gnu=no + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + ac_cv_c_compiler_gnu=$ac_compiler_gnu + + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_c_compiler_gnu" >&5 +-echo "${ECHO_T}$ac_cv_c_compiler_gnu" >&6; } +-GCC=`test $ac_compiler_gnu = yes && echo yes` ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 ++$as_echo "$ac_cv_c_compiler_gnu" >&6; } ++if test $ac_compiler_gnu = yes; then ++ GCC=yes ++else ++ GCC= ++fi + ac_test_CFLAGS=${CFLAGS+set} + ac_save_CFLAGS=$CFLAGS +-{ echo "$as_me:$LINENO: checking whether $CC accepts -g" >&5 +-echo $ECHO_N "checking whether $CC accepts -g... $ECHO_C" >&6; } +-if test "${ac_cv_prog_cc_g+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 ++$as_echo_n "checking whether $CC accepts -g... " >&6; } ++if test "${ac_cv_prog_cc_g+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + ac_save_c_werror_flag=$ac_c_werror_flag + ac_c_werror_flag=yes + ac_cv_prog_cc_g=no + CFLAGS="-g" +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2307,34 +2628,11 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++if ac_fn_c_try_compile "$LINENO"; then : + ac_cv_prog_cc_g=yes + else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- CFLAGS="" +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ CFLAGS="" ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2345,35 +2643,12 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then +- : +-else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 ++if ac_fn_c_try_compile "$LINENO"; then : + +- ac_c_werror_flag=$ac_save_c_werror_flag ++else ++ ac_c_werror_flag=$ac_save_c_werror_flag + CFLAGS="-g" +- cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + + int +@@ -2384,42 +2659,18 @@ + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++if ac_fn_c_try_compile "$LINENO"; then : + ac_cv_prog_cc_g=yes +-else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + fi +- + rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + ac_c_werror_flag=$ac_save_c_werror_flag + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_prog_cc_g" >&5 +-echo "${ECHO_T}$ac_cv_prog_cc_g" >&6; } ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 ++$as_echo "$ac_cv_prog_cc_g" >&6; } + if test "$ac_test_CFLAGS" = set; then + CFLAGS=$ac_save_CFLAGS + elif test $ac_cv_prog_cc_g = yes; then +@@ -2435,18 +2686,14 @@ + CFLAGS= + fi + fi +-{ echo "$as_me:$LINENO: checking for $CC option to accept ISO C89" >&5 +-echo $ECHO_N "checking for $CC option to accept ISO C89... $ECHO_C" >&6; } +-if test "${ac_cv_prog_cc_c89+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5 ++$as_echo_n "checking for $CC option to accept ISO C89... " >&6; } ++if test "${ac_cv_prog_cc_c89+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + ac_cv_prog_cc_c89=no + ac_save_CC=$CC +-cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ +-_ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + #include <stdarg.h> + #include <stdio.h> +@@ -2503,31 +2750,9 @@ + -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" + do + CC="$ac_save_CC $ac_arg" +- rm -f conftest.$ac_objext +-if { (ac_try="$ac_compile" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_compile") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest.$ac_objext; then ++ if ac_fn_c_try_compile "$LINENO"; then : + ac_cv_prog_cc_c89=$ac_arg +-else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 +- +- + fi +- + rm -f core conftest.err conftest.$ac_objext + test "x$ac_cv_prog_cc_c89" != "xno" && break + done +@@ -2538,17 +2763,19 @@ + # AC_CACHE_VAL + case "x$ac_cv_prog_cc_c89" in + x) +- { echo "$as_me:$LINENO: result: none needed" >&5 +-echo "${ECHO_T}none needed" >&6; } ;; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 ++$as_echo "none needed" >&6; } ;; + xno) +- { echo "$as_me:$LINENO: result: unsupported" >&5 +-echo "${ECHO_T}unsupported" >&6; } ;; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 ++$as_echo "unsupported" >&6; } ;; + *) + CC="$CC $ac_cv_prog_cc_c89" +- { echo "$as_me:$LINENO: result: $ac_cv_prog_cc_c89" >&5 +-echo "${ECHO_T}$ac_cv_prog_cc_c89" >&6; } ;; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 ++$as_echo "$ac_cv_prog_cc_c89" >&6; } ;; + esac ++if test "x$ac_cv_prog_cc_c89" != xno; then : + ++fi + + ac_ext=c + ac_cpp='$CPP $CPPFLAGS' +@@ -2557,81 +2784,474 @@ + ac_compiler_gnu=$ac_cv_c_compiler_gnu + + +- +-{ echo "$as_me:$LINENO: checking for exchangeTNCCSMessages in -lTNCS" >&5 +-echo $ECHO_N "checking for exchangeTNCCSMessages in -lTNCS... $ECHO_C" >&6; } +-if test "${ac_cv_lib_TNCS_exchangeTNCCSMessages+set}" = set; then +- echo $ECHO_N "(cached) $ECHO_C" >&6 ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for processEAPTNCData in -lnaaeap" >&5 ++$as_echo_n "checking for processEAPTNCData in -lnaaeap... " >&6; } ++if test "${ac_cv_lib_naaeap_processEAPTNCData+set}" = set; then : ++ $as_echo_n "(cached) " >&6 + else + ac_check_lib_save_LIBS=$LIBS +-LIBS="-lTNCS $LIBS" +-cat >conftest.$ac_ext <<_ACEOF +-/* confdefs.h. */ ++LIBS="-lnaaeap $LIBS" ++cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++ ++/* Override any GCC internal prototype to avoid an error. ++ Use char because int might match the return type of a GCC ++ builtin and then its argument prototype would still apply. */ ++#ifdef __cplusplus ++extern "C" ++#endif ++char processEAPTNCData (); ++int ++main () ++{ ++return processEAPTNCData (); ++ ; ++ return 0; ++} ++_ACEOF ++if ac_fn_c_try_link "$LINENO"; then : ++ ac_cv_lib_naaeap_processEAPTNCData=yes ++else ++ ac_cv_lib_naaeap_processEAPTNCData=no ++fi ++rm -f core conftest.err conftest.$ac_objext \ ++ conftest$ac_exeext conftest.$ac_ext ++LIBS=$ac_check_lib_save_LIBS ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_naaeap_processEAPTNCData" >&5 ++$as_echo "$ac_cv_lib_naaeap_processEAPTNCData" >&6; } ++if test "x$ac_cv_lib_naaeap_processEAPTNCData" = x""yes; then : ++ cat >>confdefs.h <<_ACEOF ++#define HAVE_LIBNAAEAP 1 ++_ACEOF ++ ++ LIBS="-lnaaeap $LIBS" ++ ++else ++ fail="$fail -lnaaeap" ++fi ++ ++ if test -x"$ac_cv_lib_NAAEAP_processEAPTNCData" == -x"no"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: the NAAEAP library was not found!" >&5 ++$as_echo "$as_me: WARNING: the NAAEAP library was not found!" >&2;} ++ fail="$fail -lNAAEAP" ++ fi ++ ++ ac_ext=c ++ac_cpp='$CPP $CPPFLAGS' ++ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ++ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ++ac_compiler_gnu=$ac_cv_c_compiler_gnu ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5 ++$as_echo_n "checking how to run the C preprocessor... " >&6; } ++# On Suns, sometimes $CPP names a directory. ++if test -n "$CPP" && test -d "$CPP"; then ++ CPP= ++fi ++if test -z "$CPP"; then ++ if test "${ac_cv_prog_CPP+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ # Double quotes because CPP needs to be expanded ++ for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp" ++ do ++ ac_preproc_ok=false ++for ac_c_preproc_warn_flag in '' yes ++do ++ # Use a header file that comes with gcc, so configuring glibc ++ # with a fresh cross-compiler works. ++ # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since ++ # <limits.h> exists even on freestanding compilers. ++ # On the NeXT, cc -E runs the code through the compiler's parser, ++ # not just through cpp. "Syntax error" is here to catch this case. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#ifdef __STDC__ ++# include <limits.h> ++#else ++# include <assert.h> ++#endif ++ Syntax error ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ ++else ++ # Broken: fails on valid input. ++continue ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++ # OK, works on sane cases. Now check whether nonexistent headers ++ # can be detected and how. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <ac_nonexistent.h> ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ # Broken: success on invalid input. ++continue ++else ++ # Passes both tests. ++ac_preproc_ok=: ++break ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++done ++# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. ++rm -f conftest.i conftest.err conftest.$ac_ext ++if $ac_preproc_ok; then : ++ break ++fi ++ ++ done ++ ac_cv_prog_CPP=$CPP ++ ++fi ++ CPP=$ac_cv_prog_CPP ++else ++ ac_cv_prog_CPP=$CPP ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5 ++$as_echo "$CPP" >&6; } ++ac_preproc_ok=false ++for ac_c_preproc_warn_flag in '' yes ++do ++ # Use a header file that comes with gcc, so configuring glibc ++ # with a fresh cross-compiler works. ++ # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since ++ # <limits.h> exists even on freestanding compilers. ++ # On the NeXT, cc -E runs the code through the compiler's parser, ++ # not just through cpp. "Syntax error" is here to catch this case. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#ifdef __STDC__ ++# include <limits.h> ++#else ++# include <assert.h> ++#endif ++ Syntax error ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ ++else ++ # Broken: fails on valid input. ++continue ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++ # OK, works on sane cases. Now check whether nonexistent headers ++ # can be detected and how. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <ac_nonexistent.h> ++_ACEOF ++if ac_fn_c_try_cpp "$LINENO"; then : ++ # Broken: success on invalid input. ++continue ++else ++ # Passes both tests. ++ac_preproc_ok=: ++break ++fi ++rm -f conftest.err conftest.i conftest.$ac_ext ++ ++done ++# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. ++rm -f conftest.i conftest.err conftest.$ac_ext ++if $ac_preproc_ok; then : ++ ++else ++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 ++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} ++as_fn_error $? "C preprocessor \"$CPP\" fails sanity check ++See \`config.log' for more details" "$LINENO" 5 ; } ++fi ++ ++ac_ext=c ++ac_cpp='$CPP $CPPFLAGS' ++ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ++ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ++ac_compiler_gnu=$ac_cv_c_compiler_gnu ++ ++ ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5 ++$as_echo_n "checking for grep that handles long lines and -e... " >&6; } ++if test "${ac_cv_path_GREP+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ if test -z "$GREP"; then ++ ac_path_GREP_found=false ++ # Loop through the user's path and test for each of PROGNAME-LIST ++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin ++do ++ IFS=$as_save_IFS ++ test -z "$as_dir" && as_dir=. ++ for ac_prog in grep ggrep; do ++ for ac_exec_ext in '' $ac_executable_extensions; do ++ ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext" ++ { test -f "$ac_path_GREP" && $as_test_x "$ac_path_GREP"; } || continue ++# Check for GNU ac_path_GREP and select it if it is found. ++ # Check for GNU $ac_path_GREP ++case `"$ac_path_GREP" --version 2>&1` in ++*GNU*) ++ ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;; ++*) ++ ac_count=0 ++ $as_echo_n 0123456789 >"conftest.in" ++ while : ++ do ++ cat "conftest.in" "conftest.in" >"conftest.tmp" ++ mv "conftest.tmp" "conftest.in" ++ cp "conftest.in" "conftest.nl" ++ $as_echo 'GREP' >> "conftest.nl" ++ "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break ++ diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break ++ as_fn_arith $ac_count + 1 && ac_count=$as_val ++ if test $ac_count -gt ${ac_path_GREP_max-0}; then ++ # Best one so far, save it but keep looking for a better one ++ ac_cv_path_GREP="$ac_path_GREP" ++ ac_path_GREP_max=$ac_count ++ fi ++ # 10*(2^10) chars as input seems more than enough ++ test $ac_count -gt 10 && break ++ done ++ rm -f conftest.in conftest.tmp conftest.nl conftest.out;; ++esac ++ ++ $ac_path_GREP_found && break 3 ++ done ++ done ++ done ++IFS=$as_save_IFS ++ if test -z "$ac_cv_path_GREP"; then ++ as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 ++ fi ++else ++ ac_cv_path_GREP=$GREP ++fi ++ ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5 ++$as_echo "$ac_cv_path_GREP" >&6; } ++ GREP="$ac_cv_path_GREP" ++ ++ ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5 ++$as_echo_n "checking for egrep... " >&6; } ++if test "${ac_cv_path_EGREP+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ if echo a | $GREP -E '(a|b)' >/dev/null 2>&1 ++ then ac_cv_path_EGREP="$GREP -E" ++ else ++ if test -z "$EGREP"; then ++ ac_path_EGREP_found=false ++ # Loop through the user's path and test for each of PROGNAME-LIST ++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR ++for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin ++do ++ IFS=$as_save_IFS ++ test -z "$as_dir" && as_dir=. ++ for ac_prog in egrep; do ++ for ac_exec_ext in '' $ac_executable_extensions; do ++ ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext" ++ { test -f "$ac_path_EGREP" && $as_test_x "$ac_path_EGREP"; } || continue ++# Check for GNU ac_path_EGREP and select it if it is found. ++ # Check for GNU $ac_path_EGREP ++case `"$ac_path_EGREP" --version 2>&1` in ++*GNU*) ++ ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;; ++*) ++ ac_count=0 ++ $as_echo_n 0123456789 >"conftest.in" ++ while : ++ do ++ cat "conftest.in" "conftest.in" >"conftest.tmp" ++ mv "conftest.tmp" "conftest.in" ++ cp "conftest.in" "conftest.nl" ++ $as_echo 'EGREP' >> "conftest.nl" ++ "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break ++ diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break ++ as_fn_arith $ac_count + 1 && ac_count=$as_val ++ if test $ac_count -gt ${ac_path_EGREP_max-0}; then ++ # Best one so far, save it but keep looking for a better one ++ ac_cv_path_EGREP="$ac_path_EGREP" ++ ac_path_EGREP_max=$ac_count ++ fi ++ # 10*(2^10) chars as input seems more than enough ++ test $ac_count -gt 10 && break ++ done ++ rm -f conftest.in conftest.tmp conftest.nl conftest.out;; ++esac ++ ++ $ac_path_EGREP_found && break 3 ++ done ++ done ++ done ++IFS=$as_save_IFS ++ if test -z "$ac_cv_path_EGREP"; then ++ as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 ++ fi ++else ++ ac_cv_path_EGREP=$EGREP ++fi ++ ++ fi ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5 ++$as_echo "$ac_cv_path_EGREP" >&6; } ++ EGREP="$ac_cv_path_EGREP" ++ ++ ++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5 ++$as_echo_n "checking for ANSI C header files... " >&6; } ++if test "${ac_cv_header_stdc+set}" = set; then : ++ $as_echo_n "(cached) " >&6 ++else ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <stdlib.h> ++#include <stdarg.h> ++#include <string.h> ++#include <float.h> ++ ++int ++main () ++{ ++ ++ ; ++ return 0; ++} ++_ACEOF ++if ac_fn_c_try_compile "$LINENO"; then : ++ ac_cv_header_stdc=yes ++else ++ ac_cv_header_stdc=no ++fi ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++ ++if test $ac_cv_header_stdc = yes; then ++ # SunOS 4.x string.h does not declare mem*, contrary to ANSI. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <string.h> ++ + _ACEOF +-cat confdefs.h >>conftest.$ac_ext +-cat >>conftest.$ac_ext <<_ACEOF ++if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | ++ $EGREP "memchr" >/dev/null 2>&1; then : ++ ++else ++ ac_cv_header_stdc=no ++fi ++rm -f conftest* ++ ++fi ++ ++if test $ac_cv_header_stdc = yes; then ++ # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI. ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext ++/* end confdefs.h. */ ++#include <stdlib.h> ++ ++_ACEOF ++if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | ++ $EGREP "free" >/dev/null 2>&1; then : ++ ++else ++ ac_cv_header_stdc=no ++fi ++rm -f conftest* ++ ++fi ++ ++if test $ac_cv_header_stdc = yes; then ++ # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. ++ if test "$cross_compiling" = yes; then : ++ : ++else ++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ +- +-/* Override any GCC internal prototype to avoid an error. +- Use char because int might match the return type of a GCC +- builtin and then its argument prototype would still apply. */ +-#ifdef __cplusplus +-extern "C" ++#include <ctype.h> ++#include <stdlib.h> ++#if ((' ' & 0x0FF) == 0x020) ++# define ISLOWER(c) ('a' <= (c) && (c) <= 'z') ++# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) ++#else ++# define ISLOWER(c) \ ++ (('a' <= (c) && (c) <= 'i') \ ++ || ('j' <= (c) && (c) <= 'r') \ ++ || ('s' <= (c) && (c) <= 'z')) ++# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c)) + #endif +-char exchangeTNCCSMessages (); ++ ++#define XOR(e, f) (((e) && !(f)) || (!(e) && (f))) + int + main () + { +-return exchangeTNCCSMessages (); +- ; ++ int i; ++ for (i = 0; i < 256; i++) ++ if (XOR (islower (i), ISLOWER (i)) ++ || toupper (i) != TOUPPER (i)) ++ return 2; + return 0; + } + _ACEOF +-rm -f conftest.$ac_objext conftest$ac_exeext +-if { (ac_try="$ac_link" +-case "(($ac_try" in +- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; +- *) ac_try_echo=$ac_try;; +-esac +-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 +- (eval "$ac_link") 2>conftest.er1 +- ac_status=$? +- grep -v '^ *+' conftest.er1 >conftest.err +- rm -f conftest.er1 +- cat conftest.err >&5 +- echo "$as_me:$LINENO: \$? = $ac_status" >&5 +- (exit $ac_status); } && { +- test -z "$ac_c_werror_flag" || +- test ! -s conftest.err +- } && test -s conftest$ac_exeext && +- $as_test_x conftest$ac_exeext; then +- ac_cv_lib_TNCS_exchangeTNCCSMessages=yes ++if ac_fn_c_try_run "$LINENO"; then : ++ + else +- echo "$as_me: failed program was:" >&5 +-sed 's/^/| /' conftest.$ac_ext >&5 ++ ac_cv_header_stdc=no ++fi ++rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ ++ conftest.$ac_objext conftest.beam conftest.$ac_ext ++fi + +- ac_cv_lib_TNCS_exchangeTNCCSMessages=no + fi ++fi ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5 ++$as_echo "$ac_cv_header_stdc" >&6; } ++if test $ac_cv_header_stdc = yes; then ++ ++$as_echo "#define STDC_HEADERS 1" >>confdefs.h + +-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ +- conftest$ac_exeext conftest.$ac_ext +-LIBS=$ac_check_lib_save_LIBS + fi +-{ echo "$as_me:$LINENO: result: $ac_cv_lib_TNCS_exchangeTNCCSMessages" >&5 +-echo "${ECHO_T}$ac_cv_lib_TNCS_exchangeTNCCSMessages" >&6; } +-if test $ac_cv_lib_TNCS_exchangeTNCCSMessages = yes; then ++ ++# On IRIX 5.3, sys/types and inttypes.h are conflicting. ++for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \ ++ inttypes.h stdint.h unistd.h ++do : ++ as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ++ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default ++" ++if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : + cat >>confdefs.h <<_ACEOF +-#define HAVE_LIBTNCS 1 ++#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 + _ACEOF + +- LIBS="-lTNCS $LIBS" ++fi ++ ++done ++ ++ ++for ac_header in naaeap/naaeap.h ++do : ++ ac_fn_c_check_header_mongrel "$LINENO" "naaeap/naaeap.h" "ac_cv_header_naaeap_naaeap_h" "$ac_includes_default" ++if test "x$ac_cv_header_naaeap_naaeap_h" = x""yes; then : ++ cat >>confdefs.h <<_ACEOF ++#define HAVE_NAAEAP_NAAEAP_H 1 ++_ACEOF + ++else ++ fail="$fail -Inaaeap.h" + fi + +- if test "x$ac_cv_lib_tncs_exchangetnccsmessages" != xyes; then +- { echo "$as_me:$LINENO: WARNING: the TNCS library isn't found!" >&5 +-echo "$as_me: WARNING: the TNCS library isn't found!" >&2;} +- fail="$fail -lTNCS" ++done ++ ++ if test -x"$ac_cv_header_naaeap_h" == -x"no"; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: the naaeap header was not found!" >&5 ++$as_echo "$as_me: WARNING: the naaeap header was not found!" >&2;} ++ fail="$fail -Inaaeap.h" + fi + + targetname=rlm_eap_tnc +@@ -2642,14 +3262,12 @@ + + if test x"$fail" != x""; then + if test x"${enable_strict_dependencies}" = x"yes"; then +- { { echo "$as_me:$LINENO: error: set --without-rlm_eap_tnc to disable it explicitly." >&5 +-echo "$as_me: error: set --without-rlm_eap_tnc to disable it explicitly." >&2;} +- { (exit 1); exit 1; }; } ++ as_fn_error $? "set --without-rlm_eap_tnc to disable it explicitly." "$LINENO" 5 + else +- { echo "$as_me:$LINENO: WARNING: silently not building rlm_eap_tnc." >&5 +-echo "$as_me: WARNING: silently not building rlm_eap_tnc." >&2;} +- { echo "$as_me:$LINENO: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&5 +-echo "$as_me: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&2;}; ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: silently not building rlm_eap_tnc." >&5 ++$as_echo "$as_me: WARNING: silently not building rlm_eap_tnc." >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&5 ++$as_echo "$as_me: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&2;}; + targetname="" + fi + fi +@@ -2658,11 +3276,7 @@ + + + +- +- unset ac_cv_env_LIBS_set +- unset ac_cv_env_LIBS_value +- +- ac_config_files="$ac_config_files Makefile" ++ac_config_files="$ac_config_files Makefile" + + cat >confcache <<\_ACEOF + # This file is a shell script that caches the results of configure +@@ -2691,12 +3305,13 @@ + case $ac_val in #( + *${as_nl}*) + case $ac_var in #( +- *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5 +-echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;; ++ *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 ++$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; + esac + case $ac_var in #( + _ | IFS | as_nl) ;; #( +- *) $as_unset $ac_var ;; ++ BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( ++ *) { eval $ac_var=; unset $ac_var;} ;; + esac ;; + esac + done +@@ -2704,8 +3319,8 @@ + (set) 2>&1 | + case $as_nl`(ac_space=' '; set) 2>&1` in #( + *${as_nl}ac_space=\ *) +- # `set' does not quote correctly, so add quotes (double-quote +- # substitution turns \\\\ into \\, and sed turns \\ into \). ++ # `set' does not quote correctly, so add quotes: double-quote ++ # substitution turns \\\\ into \\, and sed turns \\ into \. + sed -n \ + "s/'/'\\\\''/g; + s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" +@@ -2728,12 +3343,12 @@ + if diff "$cache_file" confcache >/dev/null 2>&1; then :; else + if test -w "$cache_file"; then + test "x$cache_file" != "x/dev/null" && +- { echo "$as_me:$LINENO: updating cache $cache_file" >&5 +-echo "$as_me: updating cache $cache_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5 ++$as_echo "$as_me: updating cache $cache_file" >&6;} + cat confcache >$cache_file + else +- { echo "$as_me:$LINENO: not updating unwritable cache $cache_file" >&5 +-echo "$as_me: not updating unwritable cache $cache_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5 ++$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;} + fi + fi + rm -f confcache +@@ -2750,6 +3365,12 @@ + # take arguments), then branch to the quote section. Otherwise, + # look for a macro that doesn't take arguments. + ac_script=' ++:mline ++/\\$/{ ++ N ++ s,\\\n,, ++ b mline ++} + t clear + :clear + s/^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\)/-D\1=\2/g +@@ -2776,14 +3397,15 @@ + + ac_libobjs= + ac_ltlibobjs= ++U= + for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue + # 1. Remove the extension, and $U if already installed. + ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' +- ac_i=`echo "$ac_i" | sed "$ac_script"` ++ ac_i=`$as_echo "$ac_i" | sed "$ac_script"` + # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR + # will be set to the directory where LIBOBJS objects are built. +- ac_libobjs="$ac_libobjs \${LIBOBJDIR}$ac_i\$U.$ac_objext" +- ac_ltlibobjs="$ac_ltlibobjs \${LIBOBJDIR}$ac_i"'$U.lo' ++ as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext" ++ as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo' + done + LIBOBJS=$ac_libobjs + +@@ -2792,11 +3414,13 @@ + + + : ${CONFIG_STATUS=./config.status} ++ac_write_fail=0 + ac_clean_files_save=$ac_clean_files + ac_clean_files="$ac_clean_files $CONFIG_STATUS" +-{ echo "$as_me:$LINENO: creating $CONFIG_STATUS" >&5 +-echo "$as_me: creating $CONFIG_STATUS" >&6;} +-cat >$CONFIG_STATUS <<_ACEOF ++{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5 ++$as_echo "$as_me: creating $CONFIG_STATUS" >&6;} ++as_write_fail=0 ++cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1 + #! $SHELL + # Generated by $as_me. + # Run this file to recreate the current configuration. +@@ -2806,59 +3430,79 @@ + debug=false + ac_cs_recheck=false + ac_cs_silent=false +-SHELL=\${CONFIG_SHELL-$SHELL} +-_ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF +-## --------------------- ## +-## M4sh Initialization. ## +-## --------------------- ## ++SHELL=\${CONFIG_SHELL-$SHELL} ++export SHELL ++_ASEOF ++cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1 ++## -------------------- ## ++## M4sh Initialization. ## ++## -------------------- ## + + # Be more Bourne compatible + DUALCASE=1; export DUALCASE # for MKS sh +-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then ++if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : + emulate sh + NULLCMD=: +- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which ++ # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' + setopt NO_GLOB_SUBST + else +- case `(set -o) 2>/dev/null` in +- *posix*) set -o posix ;; ++ case `(set -o) 2>/dev/null` in #( ++ *posix*) : ++ set -o posix ;; #( ++ *) : ++ ;; + esac +- + fi + + +- +- +-# PATH needs CR +-# Avoid depending upon Character Ranges. +-as_cr_letters='abcdefghijklmnopqrstuvwxyz' +-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' +-as_cr_Letters=$as_cr_letters$as_cr_LETTERS +-as_cr_digits='0123456789' +-as_cr_alnum=$as_cr_Letters$as_cr_digits +- +-# The user is always right. +-if test "${PATH_SEPARATOR+set}" != set; then +- echo "#! /bin/sh" >conf$$.sh +- echo "exit 0" >>conf$$.sh +- chmod +x conf$$.sh +- if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then +- PATH_SEPARATOR=';' ++as_nl=' ++' ++export as_nl ++# Printing a long string crashes Solaris 7 /usr/bin/printf. ++as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo ++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo ++# Prefer a ksh shell builtin over an external printf program on Solaris, ++# but without wasting forks for bash or zsh. ++if test -z "$BASH_VERSION$ZSH_VERSION" \ ++ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='print -r --' ++ as_echo_n='print -rn --' ++elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then ++ as_echo='printf %s\n' ++ as_echo_n='printf %s' ++else ++ if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then ++ as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' ++ as_echo_n='/usr/ucb/echo -n' + else +- PATH_SEPARATOR=: ++ as_echo_body='eval expr "X$1" : "X\\(.*\\)"' ++ as_echo_n_body='eval ++ arg=$1; ++ case $arg in #( ++ *"$as_nl"*) ++ expr "X$arg" : "X\\(.*\\)$as_nl"; ++ arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; ++ esac; ++ expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ++ ' ++ export as_echo_n_body ++ as_echo_n='sh -c $as_echo_n_body as_echo' + fi +- rm -f conf$$.sh ++ export as_echo_body ++ as_echo='sh -c $as_echo_body as_echo' + fi + +-# Support unset when possible. +-if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then +- as_unset=unset +-else +- as_unset=false ++# The user is always right. ++if test "${PATH_SEPARATOR+set}" != set; then ++ PATH_SEPARATOR=: ++ (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { ++ (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || ++ PATH_SEPARATOR=';' ++ } + fi + + +@@ -2867,20 +3511,18 @@ + # there to prevent editors from complaining about space-tab. + # (If _AS_PATH_WALK were called with IFS unset, it would disable word + # splitting by setting IFS to empty value.) +-as_nl=' +-' + IFS=" "" $as_nl" + + # Find who we are. Look in the path if we contain no directory separator. +-case $0 in ++case $0 in #(( + *[\\/]* ) as_myself=$0 ;; + *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR + for as_dir in $PATH + do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. +- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break +-done ++ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break ++ done + IFS=$as_save_IFS + + ;; +@@ -2891,32 +3533,111 @@ + as_myself=$0 + fi + if test ! -f "$as_myself"; then +- echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 +- { (exit 1); exit 1; } ++ $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 ++ exit 1 + fi + +-# Work around bugs in pre-3.0 UWIN ksh. +-for as_var in ENV MAIL MAILPATH +-do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var ++# Unset variables that we do not need and which cause bugs (e.g. in ++# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" ++# suppresses any "Segmentation fault" message there. '((' could ++# trigger a bug in pdksh 5.2.14. ++for as_var in BASH_ENV ENV MAIL MAILPATH ++do eval test x\${$as_var+set} = xset \ ++ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : + done + PS1='$ ' + PS2='> ' + PS4='+ ' + + # NLS nuisances. +-for as_var in \ +- LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ +- LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ +- LC_TELEPHONE LC_TIME +-do +- if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then +- eval $as_var=C; export $as_var +- else +- ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var ++LC_ALL=C ++export LC_ALL ++LANGUAGE=C ++export LANGUAGE ++ ++# CDPATH. ++(unset CDPATH) >/dev/null 2>&1 && unset CDPATH ++ ++ ++# as_fn_error STATUS ERROR [LINENO LOG_FD] ++# ---------------------------------------- ++# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are ++# provided, also output the error to LOG_FD, referencing LINENO. Then exit the ++# script with STATUS, using 1 if that was 0. ++as_fn_error () ++{ ++ as_status=$1; test $as_status -eq 0 && as_status=1 ++ if test "$4"; then ++ as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack ++ $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 + fi +-done ++ $as_echo "$as_me: error: $2" >&2 ++ as_fn_exit $as_status ++} # as_fn_error ++ ++ ++# as_fn_set_status STATUS ++# ----------------------- ++# Set $? to STATUS, without forking. ++as_fn_set_status () ++{ ++ return $1 ++} # as_fn_set_status ++ ++# as_fn_exit STATUS ++# ----------------- ++# Exit the shell with STATUS, even in a "trap 0" or "set -e" context. ++as_fn_exit () ++{ ++ set +e ++ as_fn_set_status $1 ++ exit $1 ++} # as_fn_exit ++ ++# as_fn_unset VAR ++# --------------- ++# Portably unset VAR. ++as_fn_unset () ++{ ++ { eval $1=; unset $1;} ++} ++as_unset=as_fn_unset ++# as_fn_append VAR VALUE ++# ---------------------- ++# Append the text in VALUE to the end of the definition contained in VAR. Take ++# advantage of any shell optimizations that allow amortized linear growth over ++# repeated appends, instead of the typical quadratic growth present in naive ++# implementations. ++if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : ++ eval 'as_fn_append () ++ { ++ eval $1+=\$2 ++ }' ++else ++ as_fn_append () ++ { ++ eval $1=\$$1\$2 ++ } ++fi # as_fn_append ++ ++# as_fn_arith ARG... ++# ------------------ ++# Perform arithmetic evaluation on the ARGs, and store the result in the ++# global $as_val. Take advantage of shells that can avoid forks. The arguments ++# must be portable across $(()) and expr. ++if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : ++ eval 'as_fn_arith () ++ { ++ as_val=$(( $* )) ++ }' ++else ++ as_fn_arith () ++ { ++ as_val=`expr "$@" || test $? -eq 1` ++ } ++fi # as_fn_arith ++ + +-# Required to use basename. + if expr a : '\(a\)' >/dev/null 2>&1 && + test "X`expr 00001 : '.*\(...\)'`" = X001; then + as_expr=expr +@@ -2930,13 +3651,17 @@ + as_basename=false + fi + ++if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then ++ as_dirname=dirname ++else ++ as_dirname=false ++fi + +-# Name of the executable. + as_me=`$as_basename -- "$0" || + $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ + X"$0" : 'X\(//\)$' \| \ + X"$0" : 'X\(/\)' \| . 2>/dev/null || +-echo X/"$0" | ++$as_echo X/"$0" | + sed '/^.*\/\([^/][^/]*\)\/*$/{ + s//\1/ + q +@@ -2951,104 +3676,103 @@ + } + s/.*/./; q'` + +-# CDPATH. +-$as_unset CDPATH +- +- +- +- as_lineno_1=$LINENO +- as_lineno_2=$LINENO +- test "x$as_lineno_1" != "x$as_lineno_2" && +- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || { +- +- # Create $as_me.lineno as a copy of $as_myself, but with $LINENO +- # uniformly replaced by the line number. The first 'sed' inserts a +- # line-number line after each line using $LINENO; the second 'sed' +- # does the real work. The second script uses 'N' to pair each +- # line-number line with the line containing $LINENO, and appends +- # trailing '-' during substitution so that $LINENO is not a special +- # case at line end. +- # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the +- # scripts with optimization help from Paolo Bonzini. Blame Lee +- # E. McMahon (1931-1989) for sed's syntax. :-) +- sed -n ' +- p +- /[$]LINENO/= +- ' <$as_myself | +- sed ' +- s/[$]LINENO.*/&-/ +- t lineno +- b +- :lineno +- N +- :loop +- s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ +- t loop +- s/-\n.*// +- ' >$as_me.lineno && +- chmod +x "$as_me.lineno" || +- { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 +- { (exit 1); exit 1; }; } +- +- # Don't try to exec as it changes $[0], causing all sort of problems +- # (the dirname of $[0] is not the place where we might find the +- # original and so on. Autoconf is especially sensitive to this). +- . "./$as_me.lineno" +- # Exit status is that of the last command. +- exit +-} +- +- +-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then +- as_dirname=dirname +-else +- as_dirname=false +-fi ++# Avoid depending upon Character Ranges. ++as_cr_letters='abcdefghijklmnopqrstuvwxyz' ++as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' ++as_cr_Letters=$as_cr_letters$as_cr_LETTERS ++as_cr_digits='0123456789' ++as_cr_alnum=$as_cr_Letters$as_cr_digits + + ECHO_C= ECHO_N= ECHO_T= +-case `echo -n x` in ++case `echo -n x` in #((((( + -n*) +- case `echo 'x\c'` in ++ case `echo 'xy\c'` in + *c*) ECHO_T=' ';; # ECHO_T is single tab character. +- *) ECHO_C='\c';; ++ xy) ECHO_C='\c';; ++ *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ++ ECHO_T=' ';; + esac;; + *) + ECHO_N='-n';; + esac + +-if expr a : '\(a\)' >/dev/null 2>&1 && +- test "X`expr 00001 : '.*\(...\)'`" = X001; then +- as_expr=expr +-else +- as_expr=false +-fi +- + rm -f conf$$ conf$$.exe conf$$.file + if test -d conf$$.dir; then + rm -f conf$$.dir/conf$$.file + else + rm -f conf$$.dir +- mkdir conf$$.dir ++ mkdir conf$$.dir 2>/dev/null + fi +-echo >conf$$.file +-if ln -s conf$$.file conf$$ 2>/dev/null; then +- as_ln_s='ln -s' +- # ... but there are two gotchas: +- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. +- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. +- # In both cases, we have to default to `cp -p'. +- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++if (echo >conf$$.file) 2>/dev/null; then ++ if ln -s conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s='ln -s' ++ # ... but there are two gotchas: ++ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. ++ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. ++ # In both cases, we have to default to `cp -p'. ++ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || ++ as_ln_s='cp -p' ++ elif ln conf$$.file conf$$ 2>/dev/null; then ++ as_ln_s=ln ++ else + as_ln_s='cp -p' +-elif ln conf$$.file conf$$ 2>/dev/null; then +- as_ln_s=ln ++ fi + else + as_ln_s='cp -p' + fi + rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file + rmdir conf$$.dir 2>/dev/null + ++ ++# as_fn_mkdir_p ++# ------------- ++# Create "$as_dir" as a directory, including parents if necessary. ++as_fn_mkdir_p () ++{ ++ ++ case $as_dir in #( ++ -*) as_dir=./$as_dir;; ++ esac ++ test -d "$as_dir" || eval $as_mkdir_p || { ++ as_dirs= ++ while :; do ++ case $as_dir in #( ++ *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( ++ *) as_qdir=$as_dir;; ++ esac ++ as_dirs="'$as_qdir' $as_dirs" ++ as_dir=`$as_dirname -- "$as_dir" || ++$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ ++ X"$as_dir" : 'X\(//\)[^/]' \| \ ++ X"$as_dir" : 'X\(//\)$' \| \ ++ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || ++$as_echo X"$as_dir" | ++ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)[^/].*/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\/\)$/{ ++ s//\1/ ++ q ++ } ++ /^X\(\/\).*/{ ++ s//\1/ ++ q ++ } ++ s/.*/./; q'` ++ test -d "$as_dir" && break ++ done ++ test -z "$as_dirs" || eval "mkdir $as_dirs" ++ } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" ++ ++ ++} # as_fn_mkdir_p + if mkdir -p . 2>/dev/null; then +- as_mkdir_p=: ++ as_mkdir_p='mkdir -p "$as_dir"' + else + test -d ./-p && rmdir ./-p + as_mkdir_p=false +@@ -3065,12 +3789,12 @@ + as_test_x=' + eval sh -c '\'' + if test -d "$1"; then +- test -d "$1/."; ++ test -d "$1/."; + else +- case $1 in +- -*)set "./$1";; ++ case $1 in #( ++ -*)set "./$1";; + esac; +- case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in ++ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #(( + ???[sx]*):;;*)false;;esac;fi + '\'' sh + ' +@@ -3085,13 +3809,19 @@ + + + exec 6>&1 ++## ----------------------------------- ## ++## Main body of $CONFIG_STATUS script. ## ++## ----------------------------------- ## ++_ASEOF ++test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1 + +-# Save the log message, to keep $[0] and so on meaningful, and to ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ++# Save the log message, to keep $0 and so on meaningful, and to + # report actual input values of CONFIG_FILES etc. instead of their + # values after options handling. + ac_log=" + This file was extended by $as_me, which was +-generated by GNU Autoconf 2.61. Invocation command line was ++generated by GNU Autoconf 2.67. Invocation command line was + + CONFIG_FILES = $CONFIG_FILES + CONFIG_HEADERS = $CONFIG_HEADERS +@@ -3104,59 +3834,74 @@ + + _ACEOF + +-cat >>$CONFIG_STATUS <<_ACEOF ++case $ac_config_files in *" ++"*) set x $ac_config_files; shift; ac_config_files=$*;; ++esac ++ ++ ++ ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + # Files that config.status was made for. + config_files="$ac_config_files" + + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + ac_cs_usage="\ +-\`$as_me' instantiates files from templates according to the +-current configuration. ++\`$as_me' instantiates files and other configuration actions ++from templates according to the current configuration. Unless the files ++and actions are specified as TAGs, all are instantiated by default. + +-Usage: $0 [OPTIONS] [FILE]... ++Usage: $0 [OPTION]... [TAG]... + + -h, --help print this help, then exit + -V, --version print version number and configuration settings, then exit +- -q, --quiet do not print progress messages ++ --config print configuration, then exit ++ -q, --quiet, --silent ++ do not print progress messages + -d, --debug don't remove temporary files + --recheck update $as_me by reconfiguring in the same conditions +- --file=FILE[:TEMPLATE] +- instantiate the configuration file FILE ++ --file=FILE[:TEMPLATE] ++ instantiate the configuration file FILE + + Configuration files: + $config_files + +-Report bugs to <bug-autoconf@gnu.org>." ++Report bugs to the package provider." + + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" + ac_cs_version="\\ + config.status +-configured by $0, generated by GNU Autoconf 2.61, +- with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\" ++configured by $0, generated by GNU Autoconf 2.67, ++ with options \\"\$ac_cs_config\\" + +-Copyright (C) 2006 Free Software Foundation, Inc. ++Copyright (C) 2010 Free Software Foundation, Inc. + This config.status script is free software; the Free Software Foundation + gives unlimited permission to copy, distribute and modify it." + + ac_pwd='$ac_pwd' + srcdir='$srcdir' ++test -n "\$AWK" || AWK=awk + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF +-# If no file are specified by the user, then we need to provide default +-# value. By we need to know if files were specified by the user. ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ++# The default lists apply if the user does not specify any file. + ac_need_defaults=: + while test $# != 0 + do + case $1 in +- --*=*) ++ --*=?*) + ac_option=`expr "X$1" : 'X\([^=]*\)='` + ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` + ac_shift=: + ;; ++ --*=) ++ ac_option=`expr "X$1" : 'X\([^=]*\)='` ++ ac_optarg= ++ ac_shift=: ++ ;; + *) + ac_option=$1 + ac_optarg=$2 +@@ -3169,25 +3914,30 @@ + -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) + ac_cs_recheck=: ;; + --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) +- echo "$ac_cs_version"; exit ;; ++ $as_echo "$ac_cs_version"; exit ;; ++ --config | --confi | --conf | --con | --co | --c ) ++ $as_echo "$ac_cs_config"; exit ;; + --debug | --debu | --deb | --de | --d | -d ) + debug=: ;; + --file | --fil | --fi | --f ) + $ac_shift +- CONFIG_FILES="$CONFIG_FILES $ac_optarg" ++ case $ac_optarg in ++ *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; ++ '') as_fn_error $? "missing file argument" ;; ++ esac ++ as_fn_append CONFIG_FILES " '$ac_optarg'" + ac_need_defaults=false;; + --he | --h | --help | --hel | -h ) +- echo "$ac_cs_usage"; exit ;; ++ $as_echo "$ac_cs_usage"; exit ;; + -q | -quiet | --quiet | --quie | --qui | --qu | --q \ + | -silent | --silent | --silen | --sile | --sil | --si | --s) + ac_cs_silent=: ;; + + # This is an error. +- -*) { echo "$as_me: error: unrecognized option: $1 +-Try \`$0 --help' for more information." >&2 +- { (exit 1); exit 1; }; } ;; ++ -*) as_fn_error $? "unrecognized option: \`$1' ++Try \`$0 --help' for more information." ;; + +- *) ac_config_targets="$ac_config_targets $1" ++ *) as_fn_append ac_config_targets " $1" + ac_need_defaults=false ;; + + esac +@@ -3202,30 +3952,32 @@ + fi + + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + if \$ac_cs_recheck; then +- echo "running CONFIG_SHELL=$SHELL $SHELL $0 "$ac_configure_args \$ac_configure_extra_args " --no-create --no-recursion" >&6 +- CONFIG_SHELL=$SHELL ++ set X '$SHELL' '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion ++ shift ++ \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6 ++ CONFIG_SHELL='$SHELL' + export CONFIG_SHELL +- exec $SHELL "$0"$ac_configure_args \$ac_configure_extra_args --no-create --no-recursion ++ exec "\$@" + fi + + _ACEOF +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + exec 5>>config.log + { + echo + sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX + ## Running $as_me. ## + _ASBOX +- echo "$ac_log" ++ $as_echo "$ac_log" + } >&5 + + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + + # Handling of arguments. + for ac_config_target in $ac_config_targets +@@ -3233,9 +3985,7 @@ + case $ac_config_target in + "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; + +- *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5 +-echo "$as_me: error: invalid argument: $ac_config_target" >&2;} +- { (exit 1); exit 1; }; };; ++ *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5 ;; + esac + done + +@@ -3260,7 +4010,7 @@ + trap 'exit_status=$? + { test -z "$tmp" || test ! -d "$tmp" || rm -fr "$tmp"; } && exit $exit_status + ' 0 +- trap '{ (exit 1); exit 1; }' 1 2 13 15 ++ trap 'as_fn_exit 1' 1 2 13 15 + } + # Create a (secure) tmp directory for tmp files. + +@@ -3271,145 +4021,177 @@ + { + tmp=./conf$$-$RANDOM + (umask 077 && mkdir "$tmp") +-} || +-{ +- echo "$me: cannot create a temporary directory in ." >&2 +- { (exit 1); exit 1; } +-} +- +-# +-# Set up the sed scripts for CONFIG_FILES section. +-# ++} || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5 + +-# No need to generate the scripts if there are no CONFIG_FILES. +-# This happens for instance when ./config.status config.h ++# Set up the scripts for CONFIG_FILES section. ++# No need to generate them if there are no CONFIG_FILES. ++# This happens for instance with `./config.status config.h'. + if test -n "$CONFIG_FILES"; then + +-_ACEOF + ++ac_cr=`echo X | tr X '\015'` ++# On cygwin, bash can eat \r inside `` if the user requested igncr. ++# But we know of no other shell where ac_cr would be empty at this ++# point, so we can use a bashism as a fallback. ++if test "x$ac_cr" = x; then ++ eval ac_cr=\$\'\\r\' ++fi ++ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' </dev/null 2>/dev/null` ++if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ++ ac_cs_awk_cr='\\r' ++else ++ ac_cs_awk_cr=$ac_cr ++fi ++ ++echo 'BEGIN {' >"$tmp/subs1.awk" && ++_ACEOF + + ++{ ++ echo "cat >conf$$subs.awk <<_ACEOF" && ++ echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && ++ echo "_ACEOF" ++} >conf$$subs.sh || ++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ++ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'` + ac_delim='%!_!# ' + for ac_last_try in false false false false false :; do +- cat >conf$$subs.sed <<_ACEOF +-SHELL!$SHELL$ac_delim +-PATH_SEPARATOR!$PATH_SEPARATOR$ac_delim +-PACKAGE_NAME!$PACKAGE_NAME$ac_delim +-PACKAGE_TARNAME!$PACKAGE_TARNAME$ac_delim +-PACKAGE_VERSION!$PACKAGE_VERSION$ac_delim +-PACKAGE_STRING!$PACKAGE_STRING$ac_delim +-PACKAGE_BUGREPORT!$PACKAGE_BUGREPORT$ac_delim +-exec_prefix!$exec_prefix$ac_delim +-prefix!$prefix$ac_delim +-program_transform_name!$program_transform_name$ac_delim +-bindir!$bindir$ac_delim +-sbindir!$sbindir$ac_delim +-libexecdir!$libexecdir$ac_delim +-datarootdir!$datarootdir$ac_delim +-datadir!$datadir$ac_delim +-sysconfdir!$sysconfdir$ac_delim +-sharedstatedir!$sharedstatedir$ac_delim +-localstatedir!$localstatedir$ac_delim +-includedir!$includedir$ac_delim +-oldincludedir!$oldincludedir$ac_delim +-docdir!$docdir$ac_delim +-infodir!$infodir$ac_delim +-htmldir!$htmldir$ac_delim +-dvidir!$dvidir$ac_delim +-pdfdir!$pdfdir$ac_delim +-psdir!$psdir$ac_delim +-libdir!$libdir$ac_delim +-localedir!$localedir$ac_delim +-mandir!$mandir$ac_delim +-DEFS!$DEFS$ac_delim +-ECHO_C!$ECHO_C$ac_delim +-ECHO_N!$ECHO_N$ac_delim +-ECHO_T!$ECHO_T$ac_delim +-LIBS!$LIBS$ac_delim +-build_alias!$build_alias$ac_delim +-host_alias!$host_alias$ac_delim +-target_alias!$target_alias$ac_delim +-CC!$CC$ac_delim +-CFLAGS!$CFLAGS$ac_delim +-LDFLAGS!$LDFLAGS$ac_delim +-CPPFLAGS!$CPPFLAGS$ac_delim +-ac_ct_CC!$ac_ct_CC$ac_delim +-EXEEXT!$EXEEXT$ac_delim +-OBJEXT!$OBJEXT$ac_delim +-eap_tnc_cflags!$eap_tnc_cflags$ac_delim +-eap_tnc_ldflags!$eap_tnc_ldflags$ac_delim +-targetname!$targetname$ac_delim +-LIBOBJS!$LIBOBJS$ac_delim +-LTLIBOBJS!$LTLIBOBJS$ac_delim +-_ACEOF ++ . ./conf$$subs.sh || ++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 + +- if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 49; then ++ ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` ++ if test $ac_delim_n = $ac_delim_num; then + break + elif $ac_last_try; then +- { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 +-echo "$as_me: error: could not make $CONFIG_STATUS" >&2;} +- { (exit 1); exit 1; }; } ++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 + else + ac_delim="$ac_delim!$ac_delim _$ac_delim!! " + fi + done ++rm -f conf$$subs.sh + +-ac_eof=`sed -n '/^CEOF[0-9]*$/s/CEOF/0/p' conf$$subs.sed` +-if test -n "$ac_eof"; then +- ac_eof=`echo "$ac_eof" | sort -nru | sed 1q` +- ac_eof=`expr $ac_eof + 1` +-fi +- +-cat >>$CONFIG_STATUS <<_ACEOF +-cat >"\$tmp/subs-1.sed" <<\CEOF$ac_eof +-/@[a-zA-Z_][a-zA-Z_0-9]*@/!b end +-_ACEOF +-sed ' +-s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g +-s/^/s,@/; s/!/@,|#_!!_#|/ +-:n +-t n +-s/'"$ac_delim"'$/,g/; t +-s/$/\\/; p +-N; s/^.*\n//; s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g; b n +-' >>$CONFIG_STATUS <conf$$subs.sed +-rm -f conf$$subs.sed +-cat >>$CONFIG_STATUS <<_ACEOF +-:end +-s/|#_!!_#|//g +-CEOF$ac_eof ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++cat >>"\$tmp/subs1.awk" <<\\_ACAWK && + _ACEOF ++sed -n ' ++h ++s/^/S["/; s/!.*/"]=/ ++p ++g ++s/^[^!]*!// ++:repl ++t repl ++s/'"$ac_delim"'$// ++t delim ++:nl ++h ++s/\(.\{148\}\)..*/\1/ ++t more1 ++s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ ++p ++n ++b repl ++:more1 ++s/["\\]/\\&/g; s/^/"/; s/$/"\\/ ++p ++g ++s/.\{148\}// ++t nl ++:delim ++h ++s/\(.\{148\}\)..*/\1/ ++t more2 ++s/["\\]/\\&/g; s/^/"/; s/$/"/ ++p ++b ++:more2 ++s/["\\]/\\&/g; s/^/"/; s/$/"\\/ ++p ++g ++s/.\{148\}// ++t delim ++' <conf$$subs.awk | sed ' ++/^[^""]/{ ++ N ++ s/\n// ++} ++' >>$CONFIG_STATUS || ac_write_fail=1 ++rm -f conf$$subs.awk ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++_ACAWK ++cat >>"\$tmp/subs1.awk" <<_ACAWK && ++ for (key in S) S_is_set[key] = 1 ++ FS = "" ++ ++} ++{ ++ line = $ 0 ++ nfields = split(line, field, "@") ++ substed = 0 ++ len = length(field[1]) ++ for (i = 2; i < nfields; i++) { ++ key = field[i] ++ keylen = length(key) ++ if (S_is_set[key]) { ++ value = S[key] ++ line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) ++ len += length(value) + length(field[++i]) ++ substed = 1 ++ } else ++ len += 1 + keylen ++ } ++ ++ print line ++} + ++_ACAWK ++_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ++if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then ++ sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" ++else ++ cat ++fi < "$tmp/subs1.awk" > "$tmp/subs.awk" \ ++ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5 ++_ACEOF + +-# VPATH may cause trouble with some makes, so we remove $(srcdir), +-# ${srcdir} and @srcdir@ from VPATH if srcdir is ".", strip leading and ++# VPATH may cause trouble with some makes, so we remove sole $(srcdir), ++# ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and + # trailing colons and then remove the whole line if VPATH becomes empty + # (actually we leave an empty line to preserve line numbers). + if test "x$srcdir" = x.; then +- ac_vpsub='/^[ ]*VPATH[ ]*=/{ +-s/:*\$(srcdir):*/:/ +-s/:*\${srcdir}:*/:/ +-s/:*@srcdir@:*/:/ +-s/^\([^=]*=[ ]*\):*/\1/ ++ ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{ ++h ++s/// ++s/^/:/ ++s/[ ]*$/:/ ++s/:\$(srcdir):/:/g ++s/:\${srcdir}:/:/g ++s/:@srcdir@:/:/g ++s/^:*// + s/:*$// ++x ++s/\(=[ ]*\).*/\1/ ++G ++s/\n// + s/^[^=]*=[ ]*$// + }' + fi + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + fi # test -n "$CONFIG_FILES" + + +-for ac_tag in :F $CONFIG_FILES ++eval set X " :F $CONFIG_FILES " ++shift ++for ac_tag + do + case $ac_tag in + :[FHLC]) ac_mode=$ac_tag; continue;; + esac + case $ac_mode$ac_tag in + :[FHL]*:*);; +- :L* | :C*:*) { { echo "$as_me:$LINENO: error: Invalid tag $ac_tag." >&5 +-echo "$as_me: error: Invalid tag $ac_tag." >&2;} +- { (exit 1); exit 1; }; };; ++ :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5 ;; + :[FH]-) ac_tag=-:-;; + :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; + esac +@@ -3437,26 +4219,34 @@ + [\\/$]*) false;; + *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; + esac || +- { { echo "$as_me:$LINENO: error: cannot find input file: $ac_f" >&5 +-echo "$as_me: error: cannot find input file: $ac_f" >&2;} +- { (exit 1); exit 1; }; };; ++ as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5 ;; + esac +- ac_file_inputs="$ac_file_inputs $ac_f" ++ case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac ++ as_fn_append ac_file_inputs " '$ac_f'" + done + + # Let's still pretend it is `configure' which instantiates (i.e., don't + # use $as_me), people would be surprised to read: + # /* config.h. Generated by config.status. */ +- configure_input="Generated from "`IFS=: +- echo $* | sed 's|^[^:]*/||;s|:[^:]*/|, |g'`" by configure." ++ configure_input='Generated from '` ++ $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' ++ `' by configure.' + if test x"$ac_file" != x-; then + configure_input="$ac_file. $configure_input" +- { echo "$as_me:$LINENO: creating $ac_file" >&5 +-echo "$as_me: creating $ac_file" >&6;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5 ++$as_echo "$as_me: creating $ac_file" >&6;} + fi ++ # Neutralize special characters interpreted by sed in replacement strings. ++ case $configure_input in #( ++ *\&* | *\|* | *\\* ) ++ ac_sed_conf_input=`$as_echo "$configure_input" | ++ sed 's/[\\\\&|]/\\\\&/g'`;; #( ++ *) ac_sed_conf_input=$configure_input;; ++ esac + + case $ac_tag in +- *:-:* | *:-) cat >"$tmp/stdin";; ++ *:-:* | *:-) cat >"$tmp/stdin" \ ++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; + esac + ;; + esac +@@ -3466,42 +4256,7 @@ + X"$ac_file" : 'X\(//\)[^/]' \| \ + X"$ac_file" : 'X\(//\)$' \| \ + X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || +-echo X"$ac_file" | +- sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ +- s//\1/ +- q +- } +- /^X\(\/\/\)[^/].*/{ +- s//\1/ +- q +- } +- /^X\(\/\/\)$/{ +- s//\1/ +- q +- } +- /^X\(\/\).*/{ +- s//\1/ +- q +- } +- s/.*/./; q'` +- { as_dir="$ac_dir" +- case $as_dir in #( +- -*) as_dir=./$as_dir;; +- esac +- test -d "$as_dir" || { $as_mkdir_p && mkdir -p "$as_dir"; } || { +- as_dirs= +- while :; do +- case $as_dir in #( +- *\'*) as_qdir=`echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #( +- *) as_qdir=$as_dir;; +- esac +- as_dirs="'$as_qdir' $as_dirs" +- as_dir=`$as_dirname -- "$as_dir" || +-$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ +- X"$as_dir" : 'X\(//\)[^/]' \| \ +- X"$as_dir" : 'X\(//\)$' \| \ +- X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || +-echo X"$as_dir" | ++$as_echo X"$ac_file" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ + s//\1/ + q +@@ -3519,20 +4274,15 @@ + q + } + s/.*/./; q'` +- test -d "$as_dir" && break +- done +- test -z "$as_dirs" || eval "mkdir $as_dirs" +- } || test -d "$as_dir" || { { echo "$as_me:$LINENO: error: cannot create directory $as_dir" >&5 +-echo "$as_me: error: cannot create directory $as_dir" >&2;} +- { (exit 1); exit 1; }; }; } ++ as_dir="$ac_dir"; as_fn_mkdir_p + ac_builddir=. + + case "$ac_dir" in + .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) +- ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` ++ ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` + # A ".." for each directory in $ac_dir_suffix. +- ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'` ++ ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` + case $ac_top_builddir_sub in + "") ac_top_builddir_sub=. ac_top_build_prefix= ;; + *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; +@@ -3568,12 +4318,12 @@ + + _ACEOF + +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + # If the template does not know about datarootdir, expand it. + # FIXME: This hack should be removed a few years after 2.60. + ac_datarootdir_hack=; ac_datarootdir_seen= +- +-case `sed -n '/datarootdir/ { ++ac_sed_dataroot=' ++/datarootdir/ { + p + q + } +@@ -3581,36 +4331,37 @@ + /@docdir@/p + /@infodir@/p + /@localedir@/p +-/@mandir@/p +-' $ac_file_inputs` in ++/@mandir@/p' ++case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in + *datarootdir*) ac_datarootdir_seen=yes;; + *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) +- { echo "$as_me:$LINENO: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 +-echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 ++$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} + _ACEOF +-cat >>$CONFIG_STATUS <<_ACEOF ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + ac_datarootdir_hack=' + s&@datadir@&$datadir&g + s&@docdir@&$docdir&g + s&@infodir@&$infodir&g + s&@localedir@&$localedir&g + s&@mandir@&$mandir&g +- s&\\\${datarootdir}&$datarootdir&g' ;; ++ s&\\\${datarootdir}&$datarootdir&g' ;; + esac + _ACEOF + + # Neutralize VPATH when `$srcdir' = `.'. + # Shell code in configure.ac might set extrasub. + # FIXME: do we really want to maintain this feature? +-cat >>$CONFIG_STATUS <<_ACEOF +- sed "$ac_vpsub ++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ++ac_sed_extra="$ac_vpsub + $extrasub + _ACEOF +-cat >>$CONFIG_STATUS <<\_ACEOF ++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + :t + /@[a-zA-Z_][a-zA-Z_0-9]*@/!b +-s&@configure_input@&$configure_input&;t t ++s|@configure_input@|$ac_sed_conf_input|;t t + s&@top_builddir@&$ac_top_builddir_sub&;t t ++s&@top_build_prefix@&$ac_top_build_prefix&;t t + s&@srcdir@&$ac_srcdir&;t t + s&@abs_srcdir@&$ac_abs_srcdir&;t t + s&@top_srcdir@&$ac_top_srcdir&;t t +@@ -3619,21 +4370,24 @@ + s&@abs_builddir@&$ac_abs_builddir&;t t + s&@abs_top_builddir@&$ac_abs_top_builddir&;t t + $ac_datarootdir_hack +-" $ac_file_inputs | sed -f "$tmp/subs-1.sed" >$tmp/out ++" ++eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$tmp/subs.awk" >$tmp/out \ ++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 + + test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && + { ac_out=`sed -n '/\${datarootdir}/p' "$tmp/out"`; test -n "$ac_out"; } && + { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' "$tmp/out"`; test -z "$ac_out"; } && +- { echo "$as_me:$LINENO: WARNING: $ac_file contains a reference to the variable \`datarootdir' +-which seems to be undefined. Please make sure it is defined." >&5 +-echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' +-which seems to be undefined. Please make sure it is defined." >&2;} ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir' ++which seems to be undefined. Please make sure it is defined" >&5 ++$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' ++which seems to be undefined. Please make sure it is defined" >&2;} + + rm -f "$tmp/stdin" + case $ac_file in +- -) cat "$tmp/out"; rm -f "$tmp/out";; +- *) rm -f "$ac_file"; mv "$tmp/out" $ac_file;; +- esac ++ -) cat "$tmp/out" && rm -f "$tmp/out";; ++ *) rm -f "$ac_file" && mv "$tmp/out" "$ac_file";; ++ esac \ ++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 + ;; + + +@@ -3643,11 +4397,13 @@ + done # for ac_tag + + +-{ (exit 0); exit 0; } ++as_fn_exit 0 + _ACEOF +-chmod +x $CONFIG_STATUS + ac_clean_files=$ac_clean_files_save + ++test $ac_write_fail = 0 || ++ as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5 ++ + + # configure is writing to config.log, and then calls config.status. + # config.status does its own redirection, appending to config.log. +@@ -3667,7 +4423,10 @@ + exec 5>>config.log + # Use ||, not &&, to avoid exiting from the if with $? = 1, which + # would make configure fail if this is the last instruction. +- $ac_cs_success || { (exit 1); exit 1; } ++ $ac_cs_success || as_fn_exit 1 ++fi ++if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then ++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 ++$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} + fi +- + +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in 2012-12-04 19:38:00.241420966 +0100 +@@ -2,12 +2,21 @@ + AC_REVISION($Revision$) + AC_DEFUN(modname,[rlm_eap_tnc]) + ++eap_tnc_cflags= ++eap_tnc_ldflags=-lnaaeap ++ + if test x$with_[]modname != xno; then + +- AC_CHECK_LIB(TNCS, exchangeTNCCSMessages) +- if test "x$ac_cv_lib_tncs_exchangetnccsmessages" != xyes; then +- AC_MSG_WARN([the TNCS library isn't found!]) +- fail="$fail -lTNCS" ++ AC_CHECK_LIB(naaeap,processEAPTNCData,,fail="$fail -lnaaeap",) ++ if test -x"$ac_cv_lib_NAAEAP_processEAPTNCData" == -x"no"; then ++ AC_MSG_WARN([the NAAEAP library was not found!]) ++ fail="$fail -lNAAEAP" ++ fi ++ ++ AC_CHECK_HEADERS(naaeap/naaeap.h,,fail="$fail -Inaaeap.h",) ++ if test -x"$ac_cv_header_naaeap_h" == -x"no"; then ++ AC_MSG_WARN([the naaeap header was not found!]) ++ fail="$fail -Inaaeap.h" + fi + + targetname=modname +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c 2012-12-04 19:38:00.241420966 +0100 +@@ -1,12 +1,12 @@ + /* + * eap_tnc.c EAP TNC functionality. + * +- * This software is Copyright (C) 2006,2007 FH Hannover ++ * This software is Copyright (C) 2006-2009 FH Hannover + * + * Portions of this code unrelated to FreeRADIUS are available + * separately under a commercial license. If you require an + * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. ++ * contact trust@f4-i.fh-hannover.de for details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +@@ -23,230 +23,41 @@ + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + */ +-#include <freeradius-devel/ident.h> +-RCSID("$Id$") +- +- +-/* +- * +- * MD5 Packet Format in EAP Type-Data +- * --- ------ ------ -- --- --------- +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Value-Size | Value ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Name ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * +- * EAP-TNC Packet Format in EAP Type-Data +- * +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Flags |Ver | Data Length ... +- * |L M S R R|=1 | +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * |... | Data ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- +- * +- */ +- + #include <stdio.h> + #include <stdlib.h> + #include "eap.h" + + #include "eap_tnc.h" + +- /* +- * WTF is wrong with htonl ? +- */ +-static uint32_t ByteSwap2 (uint32_t nLongNumber) +-{ +- return (((nLongNumber&0x000000FF)<<24)+((nLongNumber&0x0000FF00)<<8)+ +- ((nLongNumber&0x00FF0000)>>8)+((nLongNumber&0xFF000000)>>24)); +-} +- + /* +- * Allocate a new TNC_PACKET ++ * Forms an EAP_REQUEST packet from the EAP_TNC specific data. + */ +-TNC_PACKET *eaptnc_alloc(void) ++int eaptnc_compose(EAP_HANDLER *handler, TNC_BufferReference request, TNC_UInt32 length, uint8_t code) + { +- TNC_PACKET *rp; +- +- if ((rp = malloc(sizeof(TNC_PACKET))) == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- return NULL; ++ // check parameters ++ if(handler == NULL || (request == NULL && length != 0) || (request != NULL && length < 1) || code > PW_EAP_MAX_CODES){ ++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler == %p, request == %p, length == %lu, code == %u", handler, request, length, code); ++ return 0; + } +- memset(rp, 0, sizeof(TNC_PACKET)); +- return rp; +-} +- +-/* +- * Free TNC_PACKET +- */ +-void eaptnc_free(TNC_PACKET **tnc_packet_ptr) +-{ +- TNC_PACKET *tnc_packet; +- +- if (!tnc_packet_ptr) return; +- tnc_packet = *tnc_packet_ptr; +- if (tnc_packet == NULL) return; +- +- if (tnc_packet->data) free(tnc_packet->data); + +- free(tnc_packet); +- +- *tnc_packet_ptr = NULL; +-} +- +-/* +- * We expect only RESPONSE for which REQUEST, SUCCESS or FAILURE is sent back +- */ +-TNC_PACKET *eaptnc_extract(EAP_DS *eap_ds) +-{ +- tnc_packet_t *data; +- TNC_PACKET *packet; +- /* +- * We need a response, of type EAP-TNC +- */ +- if (!eap_ds || +- !eap_ds->response || +- (eap_ds->response->code != PW_TNC_RESPONSE) || +- eap_ds->response->type.type != PW_EAP_TNC || +- !eap_ds->response->type.data || +- (eap_ds->response->length <= TNC_HEADER_LEN) || +- (eap_ds->response->type.data[0] <= 0)) { +- radlog(L_ERR, "rlm_eap_tnc: corrupted data"); +- return NULL; ++ // further check parameters ++ if(handler->opaque == NULL || handler->eap_ds == NULL){ ++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler->opaque == %p, handler->eap_ds == %p", handler->opaque, handler->eap_ds); ++ return 0; + } +- packet = eaptnc_alloc(); +- if (!packet) return NULL; +- + +- packet->code = eap_ds->response->code; +- packet->id = eap_ds->response->id; +- packet->length = eap_ds->response->length; +- +- data = (tnc_packet_t *)eap_ds->response->type.data; +- /* +- * Already checked the size above. +- */ +- packet->flags_ver = data->flags_ver; +- unsigned char *ptr = (unsigned char*)data; +- +- +- DEBUG2("Flags/Ver: %x\n", packet->flags_ver); +- int thisDataLength; +- int dataStart; +- if(TNC_LENGTH_INCLUDED(packet->flags_ver)){ +- DEBUG2("data_length included\n"); +-// memcpy(&packet->flags_ver[1], &data->flags_ver[1], 4); +- //packet->data_length = data->data_length; +- memcpy(&packet->data_length, &ptr[1], TNC_DATA_LENGTH_LENGTH); +- DEBUG2("data_length: %x\n", packet->data_length); +- DEBUG2("data_length: %d\n", packet->data_length); +- DEBUG2("data_length: %x\n", ByteSwap2(packet->data_length)); +- DEBUG2("data_length: %d\n", ByteSwap2(packet->data_length)); +- packet->data_length = ByteSwap2(packet->data_length); +- thisDataLength = packet->length-TNC_PACKET_LENGTH; //1: we need space for flags_ver +- dataStart = TNC_DATA_LENGTH_LENGTH+TNC_FLAGS_VERSION_LENGTH; +- }else{ +- DEBUG2("no data_length included\n"); +- thisDataLength = packet->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- packet->data_length = 0; +- dataStart = TNC_FLAGS_VERSION_LENGTH; +- +- } +- /* +- * Allocate room for the data, and copy over the data. +- */ +- packet->data = malloc(thisDataLength); +- if (packet->data == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- eaptnc_free(&packet); +- return NULL; ++ if(handler->eap_ds->request == NULL){ ++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler->eap_ds->request == %p", handler->eap_ds->request); ++ return 0; + } +- +- memcpy(packet->data, &(eap_ds->response->type.data[dataStart]), thisDataLength); +- +- return packet; +-} + +- +-/* +- * Compose the portions of the reply packet specific to the +- * EAP-TNC protocol, in the EAP reply typedata +- */ +-int eaptnc_compose(EAP_DS *eap_ds, TNC_PACKET *reply) +-{ +- uint8_t *ptr; +- +- +- if (reply->code < 3) { +- //fill: EAP-Type (0x888e) +- eap_ds->request->type.type = PW_EAP_TNC; +- DEBUG2("TYPE: EAP-TNC set\n"); +- rad_assert(reply->length > 0); +- +- //alloc enough space for whole TNC-Packet (from Code on) +- eap_ds->request->type.data = calloc(reply->length, sizeof(unsigned char*)); +- DEBUG2("Malloc %d bytes for packet\n", reply->length); +- if (eap_ds->request->type.data == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- return 0; +- } +- //put pointer at position where data starts (behind Type) +- ptr = eap_ds->request->type.data; +- //*ptr = (uint8_t)(reply->data_length & 0xFF); +- +- //ptr++; +- *ptr = reply->flags_ver; +- DEBUG2("Set Flags/Version: %d\n", *ptr); +- if(reply->data_length!=0){ +- DEBUG2("Set data-length: %d\n", reply->data_length); +- ptr++; //move to start-position of "data_length" +- DEBUG2("Set data-length: %x\n", reply->data_length); +- DEBUG2("Set data-length (swapped): %x\n", ByteSwap2(reply->data_length)); +- unsigned long swappedDataLength = ByteSwap2(reply->data_length); +- //DEBUG2("DATA-length: %d", reply->data_ +- memcpy(ptr, &swappedDataLength, 4); +- //*ptr = swappedDataLength; +- } +- uint16_t thisDataLength=0; +- if(reply->data!=NULL){ +- DEBUG2("Adding TNCCS-Data "); +- int offset; +- //if data_length-Field present +- if(reply->data_length !=0){ +- DEBUG2("with Fragmentation\n"); +- offset = TNC_DATA_LENGTH_LENGTH; //length of data_length-field: 4 +- thisDataLength = reply->length-TNC_PACKET_LENGTH; +- }else{ //data_length-Field not present +- DEBUG2("without Fragmentation\n"); +- offset = 1; +- thisDataLength = reply->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- } +- DEBUG2("TNCCS-Datalength: %d\n", thisDataLength); +- ptr=ptr+offset; //move to start-position of "data" +- memcpy(ptr,reply->data, thisDataLength); +- }else{ +- DEBUG2("No TNCCS-Data present"); +- } +- +- //the length of the TNC-packet (behind Type) +- if(reply->data_length!=0){ +- eap_ds->request->type.length = TNC_DATA_LENGTH_LENGTH+TNC_FLAGS_VERSION_LENGTH+thisDataLength; //4:data_length, 1: flags_ver +- }else{ +- eap_ds->request->type.length = TNC_FLAGS_VERSION_LENGTH+thisDataLength; //1: flags_ver +- } +- DEBUG2("Packet built\n"); +- +- } else { +- eap_ds->request->type.length = 0; +- } +- eap_ds->request->code = reply->code; ++ // fill EAP data to handler ++ handler->eap_ds->request->code = code; ++ handler->eap_ds->request->type.type = PW_EAP_TNC; ++ // fill EAP TYPE specific data to handler ++ handler->eap_ds->request->type.length = length; ++ free(handler->eap_ds->request->type.data); ++ handler->eap_ds->request->type.data = request; + + return 1; + } +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h 2012-12-04 19:38:00.241420966 +0100 +@@ -1,10 +1,10 @@ + /* +- * This software is Copyright (C) 2006,2007 FH Hannover ++ * This software is Copyright (C) 2006-2009 FH Hannover + * + * Portions of this code unrelated to FreeRADIUS are available + * separately under a commercial license. If you require an + * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. ++ * contact trust@f4-i.fh-hannover.de for details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +@@ -26,105 +26,20 @@ + #define _EAP_TNC_H + + #include "eap.h" ++#include <naaeap/naaeap.h> + +-#define PW_TNC_REQUEST 1 +-#define PW_TNC_RESPONSE 2 +-#define PW_TNC_SUCCESS 3 +-#define PW_TNC_FAILURE 4 +-#define PW_TNC_MAX_CODES 4 +- +-#define TNC_HEADER_LEN 4 +-#define TNC_CHALLENGE_LEN 16 +-#define TNC_START_LEN 8 +- +-#define TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH 6 +-#define TNC_PACKET_LENGTH 10 +-#define TNC_DATA_LENGTH_LENGTH 4 +-#define TNC_FLAGS_VERSION_LENGTH 1 +- +-typedef unsigned int VlanAccessMode; +- +-#define VLAN_ISOLATE 97 +-#define VLAN_ACCESS 2 +-/* +- **** +- * EAP - MD5 doesnot specify code, id & length but chap specifies them, +- * for generalization purpose, complete header should be sent +- * and not just value_size, value and name. +- * future implementation. +- * +- * Huh? What does that mean? +- */ ++#define SET_START(x) ((x) | (0x20)) + +-/* ++/** ++ * Composes the EAP packet. + * +- * MD5 Packet Format in EAP Type-Data +- * --- ------ ------ -- --- --------- +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Value-Size | Value ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Name ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * +- * EAP-TNC Packet Format in EAP Type-Data +- * +- * 0 1 2 3 +- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * | Flags |Ver | Data Length ... +- * |L M S R R|=1 | +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- * |... | Data ... +- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- ++ * @param handler The EAP_HANDLER from tnc_initiate() or tnc_authenticate ++ * @param request The EAP_TNC packet received from NAA-TNCS ++ * @param length The length of the EAP_TNC packet received from NAA-TNCS ++ * @param code EAP_CODE for the request + * ++ * @return True if operation was successful, otherwise false. + */ +- +-/* eap packet structure */ +-typedef struct tnc_packet_t { +-/* +- uint8_t code; +- uint8_t id; +- uint16_t length; +-*/ +- uint8_t flags_ver; +- uint32_t data_length; +- uint8_t *data; +-} tnc_packet_t; +- +-typedef struct tnc_packet { +- uint8_t code; +- uint8_t id; +- uint16_t length; +- uint8_t flags_ver; +- uint32_t data_length; +- uint8_t *data; +-} TNC_PACKET; +- +-#define TNC_START(x) (((x) & 0x20) != 0) +-#define TNC_MORE_FRAGMENTS(x) (((x) & 0x40) != 0) +-#define TNC_LENGTH_INCLUDED(x) (((x) & 0x80) != 0) +-#define TNC_RESERVED_EQ_NULL(x) (((x) & 0x10) == 0 && ((x) & 0x8) == 0) +-#define TNC_VERSION_EQ_ONE(x) (((x) & 0x07) == 1) +- +-#define SET_START(x) ((x) | (0x20)) +-#define SET_MORE_FRAGMENTS(x) ((x) | (0x40)) +-#define SET_LENGTH_INCLUDED(x) ((x) | (0x80)) +- +- +-/* function declarations here */ +- +-TNC_PACKET *eaptnc_alloc(void); +-void eaptnc_free(TNC_PACKET **tnc_packet_ptr); +- +-int eaptnc_compose(EAP_DS *auth, TNC_PACKET *reply); +-TNC_PACKET *eaptnc_extract(EAP_DS *auth); +-int eaptnc_verify(TNC_PACKET *pkt, VALUE_PAIR* pwd, uint8_t *ch); +- +- +- +- ++int eaptnc_compose(EAP_HANDLER *handler, TNC_BufferReference request, TNC_UInt32 length, uint8_t code); + + #endif /*_EAP_TNC_H*/ +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in 2012-12-04 19:38:49.277421870 +0100 +@@ -3,8 +3,8 @@ + # + + TARGET = @targetname@ +-SRCS = rlm_eap_tnc.c eap_tnc.c tncs_connect.c +-HEADERS = eap_tnc.h tncs.h tncs_connect.h ../../eap.h ../../rlm_eap.h ++SRCS = rlm_eap_tnc.c eap_tnc.c ++HEADERS = eap_tnc.h ../../eap.h ../../rlm_eap.h + RLM_CFLAGS = -I../.. -I../../libeap $(OPENSSL_INCLUDE) @eap_tnc_cflags@ + RLM_LIBS = @eap_tnc_ldflags@ ../../libeap/$(LIBPREFIX)freeradius-eap.la $(OPENSSL_LIBS) + RLM_INSTALL = +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c 2012-12-04 19:38:00.241420966 +0100 +@@ -1,12 +1,12 @@ + /* + * rlm_eap_tnc.c Handles that are called from eap + * +- * This software is Copyright (C) 2006,2007 FH Hannover ++ * This software is Copyright (C) 2006-2009 FH Hannover + * + * Portions of this code unrelated to FreeRADIUS are available + * separately under a commercial license. If you require an + * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. ++ * contact trust@f4-i.fh-hannover.de for details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +@@ -26,96 +26,262 @@ + * Copyright (C) 2007 Alan DeKok <aland@deployingradius.com> + */ + +-#include <freeradius-devel/ident.h> +-RCSID("$Id$") ++/* ++ * EAP-TNC Packet with EAP Header, general structure ++ * ++ * 0 1 2 3 ++ * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Code | Identifier | Length | ++ * | | | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Type | Flags | Ver | Data Length | ++ * | |L M S R R| =1 | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Data Length | Data ... ++ * | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ */ + + #include <freeradius-devel/autoconf.h> + + #include <stdio.h> + #include <stdlib.h> + +-#include "tncs_connect.h" + #include "eap_tnc.h" +-#include "tncs.h" ++#include <naaeap/naaeap.h> + #include <freeradius-devel/rad_assert.h> ++//#include <freeradius-devel/libradius.h> + +-typedef struct rlm_eap_tnc_t { +- char *vlan_access; +- char *vlan_isolate; +- char *tnc_path; +-} rlm_eap_tnc_t; ++#include <netinet/in.h> + +-static int sessionCounter=0; ++/** ++ * Calculates an identifying string based upon nas_port, nas_ip and nas_port_type. ++ * The maximum length of the calculated string is 70 (not including the trailing '\0'). ++ * ++ * @return the number of bytes written to out (not including the trailing '\0') ++ */ ++static uint32_t calculateConnectionString(RADIUS_PACKET* radius_packet, char *out, size_t outMaxLength) ++{ ++ VALUE_PAIR *vp = NULL; ++ uint32_t nas_port = 0; ++ uint32_t nas_ip = 0; ++ uint32_t nas_port_type = 0; ++ ++ char out_nas_port[11]; ++ char out_nas_ip_byte_0[4]; ++ char out_nas_ip_byte_1[4]; ++ char out_nas_ip_byte_2[4]; ++ char out_nas_ip_byte_3[4]; ++ char out_nas_port_type[11]; ++ ++ // check for NULL ++ if (radius_packet == NULL) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: calculateConnectionString failed. radius_packet == NULL!"); ++ return 0; ++ } ++ ++ // read NAS port, ip and port type ++ for (vp = radius_packet->vps; vp; vp=vp->next) { ++ switch (vp->attribute) { ++ case PW_NAS_PORT: ++ nas_port = vp->vp_integer; ++ DEBUG("NAS scr port = %u\n", nas_port); ++ break; ++ case PW_NAS_IP_ADDRESS: ++ nas_ip = vp->vp_ipaddr; ++ DEBUG("NAS scr ip = %X\n", ntohl(nas_ip)); ++ break; ++ case PW_NAS_PORT_TYPE: ++ nas_port_type = vp->vp_integer; ++ DEBUG("NAS scr port type = %u\n", nas_port_type); ++ break; ++ } ++ } ++ ++ snprintf(out_nas_port, 11, "%u", nas_port); ++ snprintf(out_nas_ip_byte_0, 4, "%u", nas_ip & 0xFF); ++ snprintf(out_nas_ip_byte_1, 4, "%u", (nas_ip >> 8) & 0xFF); ++ snprintf(out_nas_ip_byte_2, 4, "%u", (nas_ip >> 16) & 0xFF); ++ snprintf(out_nas_ip_byte_3, 4, "%u", (nas_ip >> 24) & 0xFF); ++ snprintf(out_nas_port_type, 11, "%u", nas_port_type); ++ ++ return snprintf(out, outMaxLength, "NAS Port: %s NAS IP: %s.%s.%s.%s NAS_PORT_TYPE: %s", out_nas_port, out_nas_ip_byte_3, out_nas_ip_byte_2, out_nas_ip_byte_1, out_nas_ip_byte_0, out_nas_port_type); ++} ++ ++/* ++ * This function is called when the FreeRADIUS attach this module. ++ */ ++static int tnc_attach(CONF_SECTION *conf, void **type_data) ++{ ++ // initialize NAA-EAP ++ DEBUG2("TNC-ATTACH initializing NAA-EAP"); ++ TNC_Result result = initializeDefault(); ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_attach error while calling NAA-EAP initializeDefault()"); ++ return -1; ++ } ++ return 0; ++} ++ ++/* ++ * This function is called when the FreeRADIUS detach this module. ++ */ ++static int tnc_detach(void *args) ++{ ++ // terminate NAA-EAP ++ DEBUG2("TNC-TERMINATE terminating NAA-EAP"); ++ TNC_Result result = terminate(); ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_attach error while calling NAA-EAP terminate()"); ++ return -1; ++ } ++ return 0; ++} + + /* +- * Initiate the EAP-MD5 session by sending a challenge to the peer. +- * Initiate the EAP-TNC session by sending a EAP Request witch Start Bit set +- * and with no data ++ * This function is called when the first EAP_IDENTITY_RESPONSE message ++ * was received. ++ * ++ * Initiates the EPA_TNC session by sending the first EAP_TNC_RESPONSE ++ * to the peer. The packet has the Start-Bit set and contains no data. ++ * ++ * 0 1 2 3 ++ * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Code | Identifier | Length | ++ * | | | | ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * | Type | Flags | Ver | ++ * | |0 0 1 0 0|0 0 1| ++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ * ++ * For this package, only 'Identifier' has to be set dynamically. Any ++ * other information is static. + */ + static int tnc_initiate(void *type_data, EAP_HANDLER *handler) + { +- uint8_t flags_ver = 1; //set version to 1 +- rlm_eap_tnc_t *inst = type_data; +- TNC_PACKET *reply; ++ size_t buflen = 71; ++ size_t ret = 0; ++ char buf[buflen]; ++ REQUEST * request = NULL; ++ TNC_Result result; ++ TNC_ConnectionID conID; ++ TNC_BufferReference username; + ++ // check if we run inside a secure EAP method. ++ // FIXME check concrete outer EAP method + if (!handler->request || !handler->request->parent) { +- DEBUG("rlm_eap_tnc: EAP-TNC can only be run inside of a TLS-based method."); ++ DEBUG2("rlm_eap_tnc: EAP_TNC must only be used as an inner method within a protected tunneled EAP created by an outer EAP method."); ++ request = handler->request; + return 0; ++ } else { ++ request = handler->request->parent; + } + +- /* +- * FIXME: Update this when the TTLS and PEAP methods can +- * run EAP-TLC *after* the user has been authenticated. +- * This likely means moving the phase2 handlers to a +- * common code base. +- */ +- if (1) { +- DEBUG("rlm-eap_tnc: EAP-TNC can only be run after the user has been authenticated."); ++ if (request->packet == NULL) { ++ DEBUG2("rlm_eap_tnc: ERROR request->packet is NULL."); + return 0; + } + + DEBUG("tnc_initiate: %ld", handler->timestamp); + +- if(connectToTncs(inst->tnc_path)==-1){ +- DEBUG("Could not connect to TNCS"); ++ //calculate connectionString ++ ret = calculateConnectionString(request->packet, buf, buflen); ++ if(ret == 0){ ++ radlog(L_ERR, "rlm_eap_tnc:tnc_attach: calculating connection String failed."); ++ return 0; + } + ++ DEBUG2("TNC-INITIATE getting connection from NAA-EAP"); ++ + /* +- * Allocate an EAP-MD5 packet. ++ * get connection ++ * (uses a function from the NAA-EAP-library) ++ * the presence of the library is checked via the configure-script + */ +- reply = eaptnc_alloc(); +- if (reply == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); ++ result = getConnection(buf, &conID); ++ ++ // check for errors ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_initiate error while calling NAA-EAP getConnection"); + return 0; + } + + /* +- * Fill it with data. ++ * tries to get the username from FreeRADIUS; ++ * copied from modules/rlm_eap/types/rlm_eap_ttls/ttls.c + */ +- reply->code = PW_TNC_REQUEST; +- flags_ver = SET_START(flags_ver); //set start-flag +- DEBUG("$$$$$$$$$$$$$$$$Flags: %d", flags_ver); +- reply->flags_ver = flags_ver; +- reply->length = 1+1; /* one byte of flags_ver */ ++ VALUE_PAIR *usernameValuePair; ++ usernameValuePair = pairfind(request->packet->vps, PW_USER_NAME); + ++ VALUE_PAIR *eapMessageValuePair; ++ if (!usernameValuePair) { ++ eapMessageValuePair = pairfind(request->packet->vps, PW_EAP_MESSAGE); ++ ++ if (eapMessageValuePair && ++ (eapMessageValuePair->length >= EAP_HEADER_LEN + 2) && ++ (eapMessageValuePair->vp_strvalue[0] == PW_EAP_RESPONSE) && ++ (eapMessageValuePair->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) && ++ (eapMessageValuePair->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) { ++ ++ /* ++ * Create & remember a User-Name ++ */ ++ usernameValuePair = pairmake("User-Name", "", T_OP_EQ); ++ rad_assert(usernameValuePair != NULL); ++ ++ memcpy(usernameValuePair->vp_strvalue, eapMessageValuePair->vp_strvalue + 5, ++ eapMessageValuePair->length - 5); ++ usernameValuePair->length = eapMessageValuePair->length - 5; ++ usernameValuePair->vp_strvalue[usernameValuePair->length] = 0; ++ } ++ } ++ ++ username = malloc(usernameValuePair->length + 1); ++ memcpy(username, usernameValuePair->vp_strvalue, usernameValuePair->length); ++ username[usernameValuePair->length] = '\0'; ++ ++ RDEBUG("Username for current TNC connection: %s", username); ++ ++ /* ++ * stores the username of this connection ++ * (uses a function from the NAA-EAP-library) ++ * the presence of the library is checked via the configure-script ++ */ ++ result = storeUsername(conID, username, usernameValuePair->length); ++ ++ // check for errors ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_initiate error while calling NAA-EAP storeUsername"); ++ return 0; ++ } ++ ++ // set connection ID in FreeRADIUS ++ handler->opaque = malloc(sizeof(TNC_ConnectionID)); ++ memcpy(handler->opaque, &conID, sizeof(TNC_ConnectionID)); ++ ++ // build first EAP TNC request ++ TNC_BufferReference eap_tnc_request = malloc(sizeof(unsigned char)); ++ if (eap_tnc_request == NULL) { ++ radlog(L_ERR, "rlm_eap_tnc:tnc_initiate: malloc failed."); ++ return 0; ++ } ++ *eap_tnc_request = SET_START(1); ++ TNC_UInt32 eap_tnc_length = 1; ++ type_data = type_data; /* suppress -Wunused */ + + /* + * Compose the EAP-TNC packet out of the data structure, + * and free it. + */ +- eaptnc_compose(handler->eap_ds, reply); +- eaptnc_free(&reply); ++ eaptnc_compose(handler, eap_tnc_request, eap_tnc_length, PW_EAP_REQUEST); + +- //put sessionAttribute to Handler and increase sessionCounter +- handler->opaque = calloc(sizeof(TNC_ConnectionID), 1); +- if (handler->opaque == NULL) { +- radlog(L_ERR, "rlm_eap_tnc: out of memory"); +- return 0; +- } +- handler->free_opaque = free; +- memcpy(handler->opaque, &sessionCounter, sizeof(int)); +- sessionCounter++; +- + /* + * We don't need to authorize the user at this point. + * +@@ -124,246 +290,114 @@ + * to us... + */ + handler->stage = AUTHENTICATE; +- +- return 1; +-} + +-static void setVlanAttribute(rlm_eap_tnc_t *inst, EAP_HANDLER *handler, +- VlanAccessMode mode){ +- VALUE_PAIR *vp; +- char *vlanNumber = NULL; +- switch(mode){ +- case VLAN_ISOLATE: +- vlanNumber = inst->vlan_isolate; +- vp = pairfind(handler->request->config_items, +- PW_TNC_VLAN_ISOLATE); +- if (vp) vlanNumber = vp->vp_strvalue; +- break; +- case VLAN_ACCESS: +- vlanNumber = inst->vlan_access; +- vp = pairfind(handler->request->config_items, +- PW_TNC_VLAN_ACCESS); +- if (vp) vlanNumber = vp->vp_strvalue; +- break; +- +- default: +- DEBUG2(" rlm_eap_tnc: Internal error. Not setting vlan number"); +- return; +- } +- pairadd(&handler->request->reply->vps, +- pairmake("Tunnel-Type", "VLAN", T_OP_SET)); +- +- pairadd(&handler->request->reply->vps, +- pairmake("Tunnel-Medium-Type", "IEEE-802", T_OP_SET)); +- +- pairadd(&handler->request->reply->vps, +- pairmake("Tunnel-Private-Group-ID", vlanNumber, T_OP_SET)); +- ++ return 1; + } + +-/* +- * Authenticate a previously sent challenge. ++/** ++ * This function is called when a EAP_TNC_RESPONSE was received. ++ * It basically forwards the EAP_TNC data to NAA-TNCS and forms ++ * and appropriate EAP_RESPONSE. Furthermore, it sets the VlanID ++ * based on the TNC_ConnectionState determined by NAA-TNCS. ++ * ++ * @param type_arg The configuration data ++ * @param handler The EAP_HANDLER ++ * @return True, if successfully, else false. + */ +-static int tnc_authenticate(void *type_arg, EAP_HANDLER *handler) +-{ +- TNC_PACKET *packet; +- TNC_PACKET *reply; +- TNC_ConnectionID connId = *((TNC_ConnectionID *) (handler->opaque)); +- TNC_ConnectionState state; +- rlm_eap_tnc_t *inst = type_arg; +- int isAcknowledgement = 0; +- TNC_UInt32 tnccsMsgLength = 0; +- int isLengthIncluded; +- int moreFragments; +- TNC_UInt32 overallLength; +- TNC_BufferReference outMessage; +- TNC_UInt32 outMessageLength = 2; +- int outIsLengthIncluded=0; +- int outMoreFragments=0; +- TNC_UInt32 outOverallLength=0; ++static int tnc_authenticate(void *type_arg, EAP_HANDLER *handler) { + +- DEBUG2("HANDLER_OPAQUE: %d", (int) *((TNC_ConnectionID *) (handler->opaque))); +- DEBUG2("TNC-AUTHENTICATE is starting now for %d..........", (int) connId); ++ rad_assert(handler->request != NULL); // check that request has been sent previously ++ rad_assert(handler->stage == AUTHENTICATE); // check if initiate has been called + +- /* +- * Get the User-Password for this user. +- */ +- rad_assert(handler->request != NULL); +- rad_assert(handler->stage == AUTHENTICATE); +- +- /* +- * Extract the EAP-TNC packet. +- */ +- if (!(packet = eaptnc_extract(handler->eap_ds))) ++ if (handler == NULL) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler == NULL"); + return 0; ++ } ++ if (handler->eap_ds == NULL) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds == NULL"); ++ return 0; ++ } ++ if (handler->eap_ds->response == NULL) { ++ radlog( ++ L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds->resonse == NULL"); ++ return 0; ++ } ++ if (handler->eap_ds->response->type.type != PW_EAP_TNC ++ || handler->eap_ds->response->type.length < 1 ++ || handler->eap_ds->response->type.data == NULL) { ++ radlog( ++ L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds->response->type.type == %X, ->type.length == %u, ->type.data == %p", ++ handler->eap_ds->response->type.type, ++ handler->eap_ds->response->type.length, ++ handler->eap_ds->response->type.data); ++ return 0; ++ } + +- /* +- * Create a reply, and initialize it. +- */ +- reply = eaptnc_alloc(); +- if (!reply) { +- eaptnc_free(&packet); +- return 0; +- } +- +- reply->id = handler->eap_ds->request->id; +- reply->length = 0; +- if(packet->data_length==0){ +- tnccsMsgLength = packet->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- }else{ +- tnccsMsgLength = packet->length-TNC_PACKET_LENGTH; +- } +- isLengthIncluded = TNC_LENGTH_INCLUDED(packet->flags_ver); +- moreFragments = TNC_MORE_FRAGMENTS(packet->flags_ver); +- overallLength = packet->data_length; +- if(isLengthIncluded == 0 +- && moreFragments == 0 +- && overallLength == 0 +- && tnccsMsgLength == 0 +- && TNC_START(packet->flags_ver)==0){ +- +- isAcknowledgement = 1; +- } +- +- DEBUG("Data received: (%d)", (int) tnccsMsgLength); +-/* int i; +- for(i=0;i<tnccsMsgLength;i++){ +- DEBUG2("%c", (packet->data)[i]); +- } +- DEBUG2("\n"); +- */ +- state = exchangeTNCCSMessages(inst->tnc_path, +- connId, +- isAcknowledgement, +- packet->data, +- tnccsMsgLength, +- isLengthIncluded, +- moreFragments, +- overallLength, +- &outMessage, +- &outMessageLength, +- &outIsLengthIncluded, +- &outMoreFragments, +- &outOverallLength); +- DEBUG("GOT State %08x from TNCS", (unsigned int) state); +- if(state == TNC_CONNECTION_EAP_ACKNOWLEDGEMENT){ //send back acknoledgement +- reply->code = PW_TNC_REQUEST; +- reply->data = NULL; +- reply->data_length = 0; +- reply->flags_ver = 1; +- reply->length =TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH; +- }else{ //send back normal message +- DEBUG("GOT Message from TNCS (length: %d)", (int) outMessageLength); +- +- /* for(i=0;i<outMessageLength;i++){ +- DEBUG2("%c", outMessage[i]); +- } +- DEBUG2("\n"); +- */ +- DEBUG("outIsLengthIncluded: %d, outMoreFragments: %d, outOverallLength: %d", +- outIsLengthIncluded, outMoreFragments, (int) outOverallLength); +- DEBUG("NEW STATE: %08x", (unsigned int) state); +- switch(state){ +- case TNC_CONNECTION_STATE_HANDSHAKE: +- reply->code = PW_TNC_REQUEST; +- DEBUG2("Set Reply->Code to EAP-REQUEST\n"); +- break; +- case TNC_CONNECTION_STATE_ACCESS_ALLOWED: +- reply->code = PW_TNC_SUCCESS; +- setVlanAttribute(inst, handler,VLAN_ACCESS); +- break; +- case TNC_CONNECTION_STATE_ACCESS_NONE: +- reply->code = PW_TNC_FAILURE; +- //setVlanAttribute(inst, handler, VLAN_ISOLATE); +- break; +- case TNC_CONNECTION_STATE_ACCESS_ISOLATED: +- reply->code = PW_TNC_SUCCESS; +- setVlanAttribute(inst, handler, VLAN_ISOLATE); +- break; +- default: +- reply->code= PW_TNC_FAILURE; +- +- } +- if(outMessage!=NULL && outMessageLength!=0){ +- reply->data = outMessage; +- } +- reply->flags_ver = 1; +- if(outIsLengthIncluded){ +- reply->flags_ver = SET_LENGTH_INCLUDED(reply->flags_ver); +- reply->data_length = outOverallLength; +- reply->length = TNC_PACKET_LENGTH + outMessageLength; +- DEBUG("SET LENGTH: %d", reply->length); +- DEBUG("SET DATALENGTH: %d", (int) outOverallLength); +- }else{ +- reply->data_length = 0; +- reply->length = TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH + outMessageLength; +- DEBUG("SET LENGTH: %d", reply->length); +- } +- if(outMoreFragments){ +- reply->flags_ver = SET_MORE_FRAGMENTS(reply->flags_ver); +- } +- } +- +- /* +- * Compose the EAP-MD5 packet out of the data structure, +- * and free it. +- */ +- eaptnc_compose(handler->eap_ds, reply); +- eaptnc_free(&reply); +- +- handler->stage = AUTHENTICATE; +- +- eaptnc_free(&packet); +- return 1; +-} +- +-/* +- * Detach the EAP-TNC module. +- */ +-static int tnc_detach(void *arg) +-{ +- free(arg); +- return 0; +-} +- +- +-static CONF_PARSER module_config[] = { +- { "vlan_access", PW_TYPE_STRING_PTR, +- offsetof(rlm_eap_tnc_t, vlan_access), NULL, NULL }, +- { "vlan_isolate", PW_TYPE_STRING_PTR, +- offsetof(rlm_eap_tnc_t, vlan_isolate), NULL, NULL }, +- { "tnc_path", PW_TYPE_STRING_PTR, +- offsetof(rlm_eap_tnc_t, tnc_path), NULL, +- "/usr/local/lib/libTNCS.so"}, ++ // get connection ID ++ TNC_ConnectionID conID = *((TNC_ConnectionID *) (handler->opaque)); + +- { NULL, -1, 0, NULL, NULL } /* end the list */ +-}; ++ DEBUG2("TNC-AUTHENTICATE is starting now for connection ID %lX !", conID); + +-/* +- * Attach the EAP-TNC module. +- */ +-static int tnc_attach(CONF_SECTION *cs, void **instance) +-{ +- rlm_eap_tnc_t *inst; ++ // pass EAP_TNC data to NAA-EAP and get answer data ++ TNC_BufferReference output = NULL; ++ TNC_UInt32 outputLength = 0; ++ TNC_ConnectionState connectionState = TNC_CONNECTION_STATE_CREATE; + +- inst = malloc(sizeof(*inst)); +- if (!inst) return -1; +- memset(inst, 0, sizeof(*inst)); ++ /* ++ * forwards the eap_tnc data to NAA-EAP and gets the response ++ * (uses a function from the NAA-EAP-library) ++ * the presence of the library is checked via the configure-script ++ */ ++ TNC_Result result = processEAPTNCData(conID, handler->eap_ds->response->type.data, ++ handler->eap_ds->response->type.length, &output, &outputLength, ++ &connectionState); ++ ++ // check for errors ++ if (result != TNC_RESULT_SUCCESS) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate error while calling NAA-EAP processEAPTNCData"); ++ return 0; ++ } + +- if (cf_section_parse(cs, inst, module_config) < 0) { +- tnc_detach(inst); +- return -1; ++ // output contains now the answer from NAA-EAP ++ uint8_t eapCode = 0; ++ // determine eapCode for request ++ switch (connectionState) { ++ case TNC_CONNECTION_STATE_HANDSHAKE: ++ eapCode = PW_EAP_REQUEST; ++ break; ++ case TNC_CONNECTION_STATE_ACCESS_NONE: ++ eapCode = PW_EAP_FAILURE; ++ break; ++ case TNC_CONNECTION_STATE_ACCESS_ALLOWED: ++ eapCode = PW_EAP_SUCCESS; ++ pairadd(&handler->request->config_items, pairmake("TNC-Status", "Access", T_OP_SET)); ++ break; ++ case TNC_CONNECTION_STATE_ACCESS_ISOLATED: ++ eapCode = PW_EAP_SUCCESS; ++ pairadd(&handler->request->config_items, pairmake("TNC-Status", "Isolate", T_OP_SET)); ++ break; ++ default: ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate invalid TNC_CONNECTION_STATE."); ++ return 0; + } + +- +- if (!inst->vlan_access || !inst->vlan_isolate) { +- radlog(L_ERR, "rlm_eap_tnc: Must set both vlan_access and vlan_isolate"); +- tnc_detach(inst); +- return -1; ++ // form EAP_REQUEST ++ if (!eaptnc_compose(handler, output, outputLength, eapCode)) { ++ radlog(L_ERR, ++ "rlm_eap_tnc: tnc_authenticate error while forming EAP_REQUEST."); ++ return 0; + } + +- *instance = inst; +- return 0; ++ // FIXME: Why is that needed? ++ handler->stage = AUTHENTICATE; ++ ++ return 1; + } + + /* +@@ -371,10 +405,10 @@ + * That is, everything else should be 'static'. + */ + EAP_TYPE rlm_eap_tnc = { +- "eap_tnc", +- tnc_attach, /* attach */ +- tnc_initiate, /* Start the initial request */ +- NULL, /* authorization */ +- tnc_authenticate, /* authentication */ +- tnc_detach /* detach */ ++ "eap_tnc", ++ tnc_attach, /* attach */ ++ tnc_initiate, /* Start the initial request */ ++ NULL, /* authorization */ ++ tnc_authenticate, /* authentication */ ++ tnc_detach /* detach */ + }; +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c 1970-01-01 01:00:00.000000000 +0100 +@@ -1,146 +0,0 @@ +-/* +- * This software is Copyright (C) 2006,2007 FH Hannover +- * +- * Portions of this code unrelated to FreeRADIUS are available +- * separately under a commercial license. If you require an +- * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or +- * (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA +- * +- */ +-#include <freeradius-devel/ident.h> +-RCSID("$Id$") +- +-#include "tncs_connect.h" +-#include <ltdl.h> +-#include <stdlib.h> +-#include <stdio.h> +-#include <eap.h> +- +- /* +- * FIXME: This linking should really be done at compile time. +- */ +-static lt_dlhandle handle = NULL; +- +-static ExchangeTNCCSMessagePointer callTNCS = NULL; +- +-/* +- * returns the function-pointer to a function of a shared-object +- * +- * soHandle: handle to a shared-object +- * name: name of the requested function +- * +- * return: the procAddress if found, else NULL +- */ +-static void *getProcAddress(lt_dlhandle soHandle, const char *name){ +- void *proc = lt_dlsym(soHandle, name); +- DEBUG("Searching for function %s", name); +- if(proc == NULL){ +- DEBUG("rlm_eap_tnc: Failed to resolve symbol %s: %s", +- name, lt_dlerror()); +- } +- return proc; +-} +- +- +-/* +- * establishs the connection to the TNCCS without calling functionality. +- * That means that the TNCS-shared-object is loaded and the function-pointer +- * to "exchangeTNCCSMessages" is explored. +- * +- * return: -1 if connect failed, 0 if connect was successful +- */ +-int connectToTncs(char *pathToSO){ +- int state = -1; +- if(handle==NULL){ +- handle = lt_dlopen(pathToSO); +- DEBUG("OPENED HANDLE!"); +- } +- +- if(handle==NULL){ +- DEBUG("HANDLE IS NULL"); +- DEBUG("rlm_eap_tnc: Failed to link to library %s: %s", +- pathToSO, lt_dlerror()); +- }else{ +- DEBUG("SO %s found!", pathToSO); +- if(callTNCS==NULL){ +- callTNCS = (ExchangeTNCCSMessagePointer) getProcAddress(handle, "exchangeTNCCSMessages"); +- } +- if(callTNCS!=NULL){ +- DEBUG("TNCS is connected"); +- state = 0; +-// int ret = callTNCS2(2, "Bla", NULL); +- // DEBUG("GOT %d from exchangeTNCCSMessages", ret); +- }else{ +- DEBUG("Could not find exchangeTNCCSMessages"); +- } +- +- } +- return state; +-} +- +-/* +- * Accesspoint to the TNCS for sending and receiving TNCCS-Messages. +- * -pathToSO: Path to TNCCS-Shared Object +- * -connId: identifies the client which the passed message belongs to. +- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant +- * -input: input-TNCCS-message received from the client with connId +- * -inputLength: length of input-TNCCS-message +- * -isFirst: 1 if first message in fragmentation else 0 +- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)? +- * -overallLength: length of all fragments together (only set if fragmentation) +- * -output: answer-TNCCS-message from the TNCS to the client +- * -outputLength: length of answer-TNCCS-message +- * -answerIsFirst: returned answer is first in row +- * -moreFragmentsFollow: more fragments after this answer +- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer +- * +- * return: state of connection as result of the exchange +- */ +-TNC_ConnectionState exchangeTNCCSMessages(/*in*/ char *pathToSO, +- /*in*/ TNC_ConnectionID connId, +- /*in*/ int isAcknoledgement, +- /*in*/ TNC_BufferReference input, +- /*in*/ TNC_UInt32 inputLength, +- /*in*/ int isFirst, +- /*in*/ int moreFragments, +- /*in*/ TNC_UInt32 overallLength, +- /*out*/ TNC_BufferReference *output, +- /*out*/ TNC_UInt32 *outputLength, +- /*out*/ int *answerIsFirst, +- /*out*/ int *moreFragmentsFollow, +- /*out*/ TNC_UInt32 *overallLengthOut){ +- TNC_ConnectionState state = TNC_CONNECTION_STATE_ACCESS_NONE; +- int connectStatus = connectToTncs(pathToSO); +- if(connectStatus!=-1){ +- state = callTNCS(connId, +- isAcknoledgement, +- input, +- inputLength, +- isFirst, +- moreFragments, +- overallLength, +- output, +- outputLength, +- answerIsFirst, +- moreFragmentsFollow, +- overallLengthOut); +- DEBUG("GOT TNC_ConnectionState (juhuuu): %u", (unsigned int) state); +- }else{ +- DEBUG("CAN NOT CONNECT TO TNCS"); +- } +- return state; +-} +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h 1970-01-01 01:00:00.000000000 +0100 +@@ -1,70 +0,0 @@ +-/* +- * This software is Copyright (C) 2006,2007 FH Hannover +- * +- * Portions of this code unrelated to FreeRADIUS are available +- * separately under a commercial license. If you require an +- * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or +- * (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA +- * +- */ +- +-#ifndef _TNCS_CONNECT_H_ +-#define _TNCS_CONNECT_H_ +- +-#include "tncs.h" +- +-/* +- * establishs the connection to the TNCCS without calling functionality. +- * That means that the TNCS-shared-object is loaded and the function-pointer +- * to "exchangeTNCCSMessages" is explored. +- * +- * return: -1 if connect failed, 0 if connect was successful +- */ +-int connectToTncs(char *pathToSO); +-/* +- * Accesspoint to the TNCS for sending and receiving TNCCS-Messages. +- * -pathToSO: Path to TNCCS-Shared Object +- * -connId: identifies the client which the passed message belongs to. +- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant +- * -input: input-TNCCS-message received from the client with connId +- * -inputLength: length of input-TNCCS-message +- * -isFirst: 1 if first message in fragmentation else 0 +- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)? +- * -overallLength: length of all fragments together (only set if fragmentation) +- * -output: answer-TNCCS-message from the TNCS to the client +- * -outputLength: length of answer-TNCCS-message +- * -answerIsFirst: returned answer is first in row +- * -moreFragmentsFollow: more fragments after this answer +- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer +- * +- * return: state of connection as result of the exchange +- */ +-TNC_ConnectionState exchangeTNCCSMessages(/*in*/ char *pathToSO, +- /*in*/ TNC_ConnectionID connId, +- /*in*/ int isAcknoledgement, +- /*in*/ TNC_BufferReference input, +- /*in*/ TNC_UInt32 inputLength, +- /*in*/ int isFirst, +- /*in*/ int moreFragments, +- /*in*/ TNC_UInt32 overallLength, +- /*out*/ TNC_BufferReference *output, +- /*out*/ TNC_UInt32 *outputLength, +- /*out*/ int *answerIsFirst, +- /*out*/ int *moreFragmentsFollow, +- /*out*/ TNC_UInt32 *overallLengthOut); +- +-#endif //_TNCS_CONNECT_H_ +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h 1970-01-01 01:00:00.000000000 +0100 +@@ -1,86 +0,0 @@ +-/* +- * This software is Copyright (C) 2006,2007 FH Hannover +- * +- * Portions of this code unrelated to FreeRADIUS are available +- * separately under a commercial license. If you require an +- * implementation of EAP-TNC that is not under the GPLv2, please +- * contact tnc@inform.fh-hannover.de for details. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or +- * (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA +- * +- */ +- +-#ifndef _TNCS_H_ +-#define _TNCS_H_ +- +- +- +-#ifdef __cplusplus +-extern "C" { +-#endif +- +-/* +- * copied from tncimv.h: +- */ +-typedef unsigned long TNC_UInt32; +-typedef TNC_UInt32 TNC_ConnectionState; +-typedef unsigned char *TNC_BufferReference; +-typedef TNC_UInt32 TNC_ConnectionID; +- +-#define TNC_CONNECTION_STATE_CREATE 0 +-#define TNC_CONNECTION_STATE_HANDSHAKE 1 +-#define TNC_CONNECTION_STATE_ACCESS_ALLOWED 2 +-#define TNC_CONNECTION_STATE_ACCESS_ISOLATED 3 +-#define TNC_CONNECTION_STATE_ACCESS_NONE 4 +-#define TNC_CONNECTION_STATE_DELETE 5 +-#define TNC_CONNECTION_EAP_ACKNOWLEDGEMENT 6 +- +-/* +- * Accesspoint (as function-pointer) to the TNCS for sending and receiving +- * TNCCS-Messages. +- * +- * -connId: identifies the client which the passed message belongs to. +- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant +- * -input: input-TNCCS-message received from the client with connId +- * -inputLength: length of input-TNCCS-message +- * -isFirst: 1 if first message in fragmentation else 0 +- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)? +- * -overallLength: length of all fragments together (only set if fragmentation) +- * -output: answer-TNCCS-message from the TNCS to the client +- * -outputLength: length of answer-TNCCS-message +- * -answerIsFirst: returned answer is first in row +- * -moreFragmentsFollow: more fragments after this answer +- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer +- * +- * return: state of connection as result of the exchange +- */ +-typedef TNC_ConnectionState (*ExchangeTNCCSMessagePointer)(/*in*/ TNC_ConnectionID connId, +- /*in*/ int isAcknoledgement, +- /*in*/ TNC_BufferReference input, +- /*in*/ TNC_UInt32 inputLength, +- /*in*/ int isFirst, +- /*in*/ int moreFragments, +- /*in*/ TNC_UInt32 overallLength, +- /*out*/ TNC_BufferReference *output, +- /*out*/ TNC_UInt32 *outputLength, +- /*out*/ int *answerIsFirst, +- /*out*/ int *moreFragmentsFollow, +- /*out*/ TNC_UInt32 *overallLengthOut +-); +- +-#ifdef __cplusplus +-} +-#endif +-#endif //_TNCS_H_ +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h 2012-12-04 19:39:54.749423138 +0100 +@@ -37,6 +37,10 @@ + int copy_request_to_tunnel; + int use_tunneled_reply; + const char *virtual_server; ++ const char *tnc_virtual_server; // virtual server for EAP-TNC as the second inner method ++ VALUE_PAIR *auth_reply; // cache storage of the last reply of the first inner method ++ int auth_code; // cache storage of the reply-code of the first inner method ++ int doing_tnc; // status if we're doing EAP-TNC + } ttls_tunnel_t; + + /* +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c 2012-12-04 19:39:54.749423138 +0100 +@@ -62,6 +62,11 @@ + * Virtual server for inner tunnel session. + */ + char *virtual_server; ++ ++ /* ++ * Virtual server for the second inner tunnel method, which is EAP-TNC. ++ */ ++ char *tnc_virtual_server; + } rlm_eap_ttls_t; + + +@@ -78,6 +83,9 @@ + { "virtual_server", PW_TYPE_STRING_PTR, + offsetof(rlm_eap_ttls_t, virtual_server), NULL, NULL }, + ++ { "tnc_virtual_server", PW_TYPE_STRING_PTR, ++ offsetof(rlm_eap_ttls_t, tnc_virtual_server), NULL, NULL }, ++ + { "include_length", PW_TYPE_BOOLEAN, + offsetof(rlm_eap_ttls_t, include_length), NULL, "yes" }, + +@@ -171,6 +179,10 @@ + t->copy_request_to_tunnel = inst->copy_request_to_tunnel; + t->use_tunneled_reply = inst->use_tunneled_reply; + t->virtual_server = inst->virtual_server; ++ t->tnc_virtual_server = inst->tnc_virtual_server; // virtual server for EAP-TNC as the second inner method ++ t->auth_reply = NULL; // cache storage of the last reply of the first inner method ++ t->auth_code = -1; // cache storage of the reply-code of the first inner method ++ t->doing_tnc = 0; // status if we're doing EAP-TNC (on start we're doing NOT) + return t; + } + +diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c 2012-09-10 13:51:34.000000000 +0200 ++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c 2012-12-04 19:39:54.749423138 +0100 +@@ -585,6 +585,94 @@ + } + + /* ++ * Start EAP-TNC as a second inner method. ++ * Creates a new fake-request out of the original incoming request (via EAP_HANDLER). ++ * If it's the first time, we create a EAP-START-packet and send ++ * EAP-START := code = PW_EAP_REQUEST ++ * ++ */ ++static REQUEST* start_tnc(EAP_HANDLER *handler, ttls_tunnel_t *t) { ++ REQUEST* request = handler->request; ++ RDEBUG2("EAP-TNC as second inner authentication method starts now"); ++ ++ /* ++ * Allocate a fake REQUEST struct, ++ * to make a new request, based on the original request. ++ */ ++ REQUEST* fake = request_alloc_fake(request); ++ ++ /* ++ * Set the virtual server to that of EAP-TNC. ++ */ ++ fake->server = t->tnc_virtual_server; ++ ++ /* ++ * Build a new EAP-Message. ++ */ ++ VALUE_PAIR *eap_msg; ++ eap_msg = paircreate(PW_EAP_MESSAGE, PW_TYPE_OCTETS); ++ ++ /* ++ * Set the EAP-Message to look like EAP-Start ++ */ ++ eap_msg->vp_octets[0] = PW_EAP_RESPONSE; ++ eap_msg->vp_octets[1] = 0x00; ++ ++ /* ++ * Only setting EAP-TNC here, ++ * because it is intended to do user-authentication in the first inner method, ++ * and then a hardware-authentication (like EAP-TNC) as the second method. ++ */ ++ eap_msg->vp_octets[4] = PW_EAP_TNC; ++ ++ eap_msg->length = 0; ++ ++ /* ++ * Add the EAP-Message to the request. ++ */ ++ pairadd(&(fake->packet->vps), eap_msg); ++ ++ /* ++ * Process the new request by the virtual server configured for ++ * EAP-TNC. ++ */ ++ rad_authenticate(fake); ++ ++ /* ++ * From now on we're doing EAP-TNC as the second inner authentication method. ++ */ ++ t->doing_tnc = TRUE; ++ ++ return fake; ++} ++ ++/* ++ * Stop EAP-TNC as a second inner method. ++ * Copy the value pairs from the cached Access-Accept of the first inner method ++ * to the Access-Accept/Reject package of EAP-TNC. ++ */ ++static REQUEST* stop_tnc(REQUEST *request, ttls_tunnel_t *t) { ++ RDEBUG2("EAP-TNC as second inner authentication method stops now"); ++ ++ /* ++ * Copy the value-pairs of the origina Access-Accept of the first ++ * inner authentication method to the Access-Accept/Reject of the ++ * second inner authentication method (EAP-TNC). ++ */ ++ if (request->reply->code == PW_AUTHENTICATION_ACK) { ++ pairadd(&(request->reply->vps), t->auth_reply); ++ } else if (request->reply->code == PW_AUTHENTICATION_REJECT) { ++ pairadd(&(request->reply->vps), t->auth_reply); ++ } ++ ++ pairdelete(&(request->reply->vps), PW_MESSAGE_AUTHENTICATOR); ++ pairdelete(&(request->reply->vps), PW_PROXY_STATE); ++ pairdelete(&(request->reply->vps), PW_USER_NAME); ++ ++ return request; ++} ++ ++/* + * Use a reply packet to determine what to do. + */ + static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session, +@@ -1135,6 +1223,16 @@ + + } /* else fake->server == request->server */ + ++ /* ++ * If we're doing EAP-TNC as a second method, ++ * then set the server to that one. ++ * Then, rad_authenticate will run EAP-TNC, ++ * so that afterwards we have to look for the state of ++ * EAP-TNC. ++ */ ++ if (t->doing_tnc) { ++ fake->server = t->tnc_virtual_server; ++ } + + if ((debug_flag > 0) && fr_log_fp) { + RDEBUG("Sending tunneled request"); +@@ -1248,6 +1346,53 @@ + + default: + /* ++ * If the result of the first method was an acknowledgment OR ++ * if were already running EAP-TNC, ++ * we're doing additional things before processing the reply. ++ * Also the configuration for EAP-TTLS has to contain a virtual server ++ * for EAP-TNC as the second method. ++ */ ++ if (t->tnc_virtual_server) { ++ /* ++ * If the reply code of the first inner method is PW_AUTHENTICATION_ACK ++ * which means that the method was successful, ++ * and we're not doing EAP-TNC as the second method, ++ * then we want to intercept the Access-Accept and start EAP-TNC as the second inner method. ++ */ ++ if (fake->reply->code == PW_AUTHENTICATION_ACK ++ && t->doing_tnc == FALSE) { ++ RDEBUG2("Reply-Code of the first inner method was: %d (PW_AUTHENTICATION_ACK)", fake->reply->code); ++ ++ /* ++ * Save reply-value pairs and reply-code of the first method. ++ */ ++ t->auth_reply = fake->reply->vps; ++ fake->reply->vps = NULL; ++ t->auth_code = fake->reply->code; ++ ++ /* ++ * Create the start package for EAP-TNC. ++ */ ++ fake = start_tnc(handler, t); ++ ++ /* ++ * If we're doing EAP-TNC as the second inner method, ++ * and the reply->code was PW_AUTHENTICATION_ACK or PW_AUTHENTICATION_REJECT, ++ * then we stop EAP-TNC and create an combined Access-Accept or Access-Reject. ++ */ ++ } else if (t->doing_tnc == TRUE ++ && (fake->reply->code == PW_AUTHENTICATION_ACK || fake->reply->code == PW_AUTHENTICATION_REJECT)) { ++ ++ /* ++ * Create the combined Access-Accept or -Reject. ++ */ ++ RDEBUG2("Reply-Code of EAP-TNC as the second inner method was: %d (%s)", fake->reply->code, ++ fake->reply->code == PW_AUTHENTICATION_ACK ? "PW_AUTHENTICATION_ACK" : "PW_AUTHENTICATION_REJECT"); ++ fake = stop_tnc(fake, t); ++ } ++ } ++ ++ /* + * Returns RLM_MODULE_FOO, and we want to return + * PW_FOO + */ diff --git a/testing/scripts/recipes/patches/iptables-xfrm-hooks b/testing/scripts/recipes/patches/iptables-xfrm-hooks new file mode 100644 index 000000000..baa4a65c1 --- /dev/null +++ b/testing/scripts/recipes/patches/iptables-xfrm-hooks @@ -0,0 +1,61 @@ +From 4553ba0130bb9f0aa266cc1e4c3288a52f34eed6 Mon Sep 17 00:00:00 2001 +From: Martin Willi <martin@revosec.ch> +Date: Wed, 7 Apr 2010 11:40:15 +0200 +Subject: [PATCH] Added XFRM hooks to iptables headers + +--- + include/linux/netfilter.h | 2 ++ + include/linux/netfilter_ipv4.h | 6 +++++- + include/linux/netfilter_ipv6.h | 6 +++++- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h +index 2eb00b6..b692c67 100644 +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -35,6 +35,8 @@ enum nf_inet_hooks { + NF_INET_FORWARD, + NF_INET_LOCAL_OUT, + NF_INET_POST_ROUTING, ++ NF_INET_XFRM_IN, ++ NF_INET_XFRM_OUT, + NF_INET_NUMHOOKS + }; + +diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h +index 4d7ba3e..28d3ca9 100644 +--- a/include/linux/netfilter_ipv4.h ++++ b/include/linux/netfilter_ipv4.h +@@ -47,7 +47,11 @@ + #define NF_IP_LOCAL_OUT 3 + /* Packets about to hit the wire. */ + #define NF_IP_POST_ROUTING 4 +-#define NF_IP_NUMHOOKS 5 ++/* Packets going into XFRM input transformation. */ ++#define NF_IP_XFRM_IN 5 ++/* Packets going into XFRM output transformation. */ ++#define NF_IP_XFRM_OUT 6 ++#define NF_IP_NUMHOOKS 7 + + enum nf_ip_hook_priorities { + NF_IP_PRI_FIRST = INT_MIN, +diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h +index 7430b39..18590a5 100644 +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -51,7 +51,11 @@ + #define NF_IP6_LOCAL_OUT 3 + /* Packets about to hit the wire. */ + #define NF_IP6_POST_ROUTING 4 +-#define NF_IP6_NUMHOOKS 5 ++/* Packets going into XFRM input transformation. */ ++#define NF_IP6_XFRM_IN 5 ++/* Packets going into XFRM output transformation. */ ++#define NF_IP6_XFRM_OUT 6 ++#define NF_IP6_NUMHOOKS 7 + + + enum nf_ip6_hook_priorities { +-- +1.6.3.3 + diff --git a/testing/scripts/restore-defaults b/testing/scripts/restore-defaults index 64cc0262e..953548a1b 100755 --- a/testing/scripts/restore-defaults +++ b/testing/scripts/restore-defaults @@ -14,32 +14,20 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -########################################################################## -# load-testconfig requires a testname as an argument -# +DIR=$(dirname `readlink -f $0`) +. $DIR/../testing.conf +. $DIR/function.sh testname=$1 -HOSTCONFIGDIR=$BUILDDIR/hosts +HOSTCONFIGDIR=$DIR/../hosts TESTSDIR=$BUILDDIR/tests [ -d $TESTSDIR ] || die "Directory '$TESTSDIR' not found" [ -d $TESTSDIR/$testname ] || die "Test '$testname' not found" [ -f $TESTSDIR/$testname/test.conf ] || die "File 'test.conf' is missing" -source $TESTSDIR/$testname/test.conf - -########################################################################## -# copy default host config back if necessary -# +. $TESTSDIR/$testname/test.conf if [ -d $TESTSDIR/${testname}/hosts ] then @@ -47,5 +35,6 @@ then do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" scp $SSHCONF -r $HOSTCONFIGDIR/${host}/etc $HOSTLOGIN:/ > /dev/null 2>&1 + scp $SSHCONF -r $HOSTCONFIGDIR/default/etc $HOSTLOGIN:/ > /dev/null 2>&1 done fi diff --git a/testing/scripts/shutdown-umls b/testing/scripts/shutdown-umls deleted file mode 100755 index e71e46602..000000000 --- a/testing/scripts/shutdown-umls +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash -# Install strongSwan from mounted strongswan-shared tree -# -# Copyright (C) 2006 Martin Willi -# Hochschule fuer Technik Rapperswil -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -# - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -cecho "shutting down" -cecho-n " " - -for host in $STRONGSWANHOSTS -do - eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - cecho-n "$host... " - ssh $HOSTLOGIN 'shutdown now -h' > /dev/null -done - -cecho diff --git a/testing/scripts/start-bridges b/testing/scripts/start-bridges deleted file mode 100755 index 1e09d6e7d..000000000 --- a/testing/scripts/start-bridges +++ /dev/null @@ -1,64 +0,0 @@ -#!/bin/bash -# start the UML bridges in the kernel using the brctl command -# -# Copyright (C) 2009 Andreas Steffen -# HSR Hochschule fuer Technik Rapperswil -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -# create umlbr1 and its taps -# -if [ `brctl show | grep umlbr1 | wc -l` -eq 1 ] -then - cecho " * Great, umlbr1 is already running!" -else - cecho-n " * Starting umlbr1 with taps.." - umlbr_add 1 10.1.0.254 255.255.0.0 - umlbr_add_tap 1 alice - umlbr_add_tap 1 venus - umlbr_add_tap 1 moon - cgecho "done" -fi - -# create umlbr0 and its taps -# -if [ `brctl show | grep umlbr0 | wc -l` -eq 1 ] -then - cecho " * Great, umlbr0 is already running!" -else - cecho-n " * Starting umlbr0 with taps.." - umlbr_add 0 192.168.0.254 255.255.255.0 - umlbr_add_tap 0 alice - umlbr_add_tap 0 moon - umlbr_add_tap 0 carol - umlbr_add_tap 0 winnetou - umlbr_add_tap 0 dave - umlbr_add_tap 0 sun - cgecho "done" -fi - -# create umlbr2 and its taps -# -if [ `brctl show | grep umlbr2 | wc -l` -eq 1 ] -then - cecho " * Great, umlbr2 is already running!" -else - cecho-n " * Starting umlbr2 with taps.." - umlbr_add 2 10.2.0.254 255.255.0.0 - umlbr_add_tap 2 sun - umlbr_add_tap 2 bob - cgecho "done" -fi - diff --git a/testing/scripts/start-umls b/testing/scripts/start-umls deleted file mode 100755 index 878494370..000000000 --- a/testing/scripts/start-umls +++ /dev/null @@ -1,117 +0,0 @@ -#!/bin/bash -# starts the UML instances with a hidden screen -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval screen -dmS ${host} "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" - cgecho "done" - fi -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/scripts/stop-bridges b/testing/scripts/stop-bridges deleted file mode 100755 index eb92bd0eb..000000000 --- a/testing/scripts/stop-bridges +++ /dev/null @@ -1,49 +0,0 @@ -#!/bin/bash -# stop the UML bridges in the kernel using the brctl command -# -# Copyright (C) 2009 Andreas Steffen -# HSR Hochschule fuer Technik Rapperswil -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -# stop umlbr1 and its taps -# -cecho-n " * Stopping umlbr1 with taps.." -umlbr_del_tap 1 alice -umlbr_del_tap 1 venus -umlbr_del_tap 1 moon -umlbr_del 1 -cgecho "done" - -# stop umlbr0 and its taps -# -cecho-n " * Stopping umlbr0 with taps.." -umlbr_del_tap 0 alice -umlbr_del_tap 0 moon -umlbr_del_tap 0 carol -umlbr_del_tap 0 winnetou -umlbr_del_tap 0 dave -umlbr_del_tap 0 sun -umlbr_del 0 -cgecho "done" - -# stop umlbr2 and its taps -# -cecho-n " * Stopping umlbr2 with taps.." -umlbr_del_tap 2 sun -umlbr_del_tap 2 bob -umlbr_del 2 -cgecho "done" - diff --git a/testing/scripts/xstart-umls b/testing/scripts/xstart-umls deleted file mode 100755 index ed2662b6c..000000000 --- a/testing/scripts/xstart-umls +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# starts the UML instances in an xterm (requires X11R6) -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/function.sh - -[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" - -source $DIR/../testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -BOOTING_HOSTS="" -count_max=12 -count=0 - -#position of xterm window on the desktop -x0=8 -y0=8 -dx=12 -dy=24 - -for host in $HOSTS -do - up=0 - - if [ -d ~/.uml/${host} ] - then - pid=`cat ~/.uml/${host}/pid` - up=`ps up $pid | wc -l` - fi - - if [ $up -eq 2 ] - then - cecho " * Great, ${host} is already running!" - else - rm -rf ~/.uml/${host} - BOOTING_HOSTS="$BOOTING_HOSTS ${host}" - let "count_max += 12" - - UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host} - [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found" - - cecho-n " * Starting ${host}.." - eval xterm -title ${host} -geometry "+${x0}+${y0}" -rightbar -sb -sl 500 -e "$UMLKERNEL \ - umid=${host} \ - ubda=$UMLHOSTFS \ - \$SWITCH_${host} \ - mem=${MEM}M con=pty con0=fd:0,fd:1" & - cgecho "done" - sleep 15 - fi - let "x0+=dx" - let "y0+=dy" -done - -if [ -z "$BOOTING_HOSTS" ] -then - exit 0 -fi - -cecho " * Waiting for the uml instances to finish booting" - -for host in $BOOTING_HOSTS -do - cecho-n " * Checking on $host.." - - while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ] - do - cecho-n "." - sleep 5 - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - fi - - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - - while [ $count -lt $count_max ] && [ $up -eq 0 ] - do - cecho-n "." - sleep 5 - up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l` - let "count+=1" - done - - if [ $count -ge $count_max ] - then - cecho "exit" - exit 1 - else - cgecho "up" - fi - - if [ "$host" = "alice" ] - then - sleep 5 - eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh root@$ipv4_alice /etc/init.d/net.eth1 stop - fi -done - -cecho " * All uml instances are up now" diff --git a/testing/ssh_config b/testing/ssh_config index 36569c07c..831b9dc1a 100644 --- a/testing/ssh_config +++ b/testing/ssh_config @@ -1,7 +1,8 @@ Host * # debian default SendEnv LANG LC_* - HashKnownHosts yes + StrictHostKeyChecking no + UserKnownHostsFile /dev/null GSSAPIAuthentication yes # faster encryption Ciphers arcfour diff --git a/testing/start-testing b/testing/start-testing index 278500e6f..183729423 100755 --- a/testing/start-testing +++ b/testing/start-testing @@ -1,85 +1,48 @@ #!/bin/bash -# Start up the specified UML instances and wait for them to finish booting -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/scripts/function.sh - -[ -f $DIR/testing.conf ] || die "!! Configuration file 'testing.conf' not found" -[ -d $DIR/hosts ] || die "Directory hosts cannot be found." - -source $DIR/testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -##################################################### -# start the uml bridges -# -cecho "Start the uml bridges (scripts/start-bridges)" -$DIR/scripts/start-bridges - - -##################################################### -# start the uml instances -# -case $UMLSTARTMODE in - konsole) - cecho "Start the uml instances (scripts/kstart-umls)" - $DIR/scripts/kstart-umls $HOSTS - ;; - gnome-terminal) - cecho "Start the uml instances (scripts/gstart-umls)" - $DIR/scripts/gstart-umls $HOSTS - ;; - xterm) - cecho "Start the uml instances (scripts/xstart-umls)" - $DIR/scripts/xstart-umls $HOSTS - ;; - screen) - cecho "Start the uml instances (scripts/start-umls)" - $DIR/scripts/start-umls $HOSTS - ;; - *) - die "The start mode is unknown! Please set $UMLSTARTMODE properly." - ;; -esac - - -##################################################### -# do the automated testing -# -if [ $ENABLE_DO_TESTS = "yes" ] -then - cecho "Run the automated tests (do-tests)" - $DIR/do-tests -fi - - -############################################################################## -# stop all UML instances and switches -# - -if [ $ENABLE_STOP_TESTING = "yes" ] -then - cecho "Stopping all UML instances and switches (stop-testing)" - $DIR/stop-testing $HOSTS -fi +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf +. $DIR/scripts/function.sh + +NETWORKS="vnet1 vnet2 vnet3" +CONFDIR=$DIR/config/kvm +KNLSRC=$BUILDDIR/$KERNEL/arch/x86/boot/bzImage +KNLTARGET=/var/run/kvm-swan-kernel +HOSTFSTARGET=/var/run/kvm-swan-hostfs +MCASTBRS="virbr1 virbr2" + +echo "Starting test environment" + +[ `id -u` -eq 0 ] || die "You must be root to run $0" + +check_commands virsh + +log_action "Deploying kernel $KERNEL" +execute "ln -fs $KNLSRC $KNLTARGET" + +log_action "Deploying $SHAREDDIR as hostfs" +execute "chown -R $KVMUSER:$KVMGROUP $SHAREDDIR" 0 +execute "ln -Tfs $SHAREDDIR $HOSTFSTARGET" + +for net in $NETWORKS +do + log_action "Network $net" + execute "virsh net-create $CONFDIR/$net.xml" +done + +for host in $STRONGSWANHOSTS +do + ln -fs $IMGDIR/$host.$IMGEXT $VIRTIMGSTORE/$host.$IMGEXT + log_action "Guest $host" + execute "virsh create $CONFDIR/$host.xml" +done + +# Enforce reception of multicast traffic on bridges +for br in $MCASTBRS +do + cd /sys/devices/virtual/net/$br/brif + for vnet in `find . -name "vnet*"` + do + echo 2 > $vnet/multicast_router + done +done diff --git a/testing/stop-testing b/testing/stop-testing index 023a5b39e..704ae6667 100755 --- a/testing/stop-testing +++ b/testing/stop-testing @@ -1,48 +1,34 @@ #!/bin/bash -# Stop all UML instances and UML switches -# -# Copyright (C) 2004 Eric Marchionni, Patrik Rayo -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. - -DIR=`dirname $0` - -source $DIR/scripts/function.sh - -[ -f $DIR/testing.conf ] || die "No configuration file testing.conf found." - -source $DIR/testing.conf - -if [ "$#" -eq 0 ] -then - HOSTS=$STRONGSWANHOSTS -else - HOSTS=$* -fi - -##################################################### -# Shutting down the uml instances -# -cecho-n " * Halting all UML instances.." -for host in $HOSTS + +DIR=$(dirname `readlink -f $0`) +. $DIR/testing.conf +. $DIR/scripts/function.sh + +echo "Stopping test environment" + +NETWORKS="vnet1 vnet2 vnet3" +KNLTARGET=/var/run/kvm-swan-kernel +HOSTFSTARGET=/var/run/kvm-swan-hostfs + +[ `id -u` -eq 0 ] || die "You must be root to run $0" + +check_commands virsh + +for net in $NETWORKS do - uml_mconsole $host halt &> /dev/null + log_action "Network $net" + execute "virsh net-destroy $net" done -cgecho "done" -##################################################### -# Shutting down the uml bridhges -# -cecho "Stop the uml bridges (scripts/stop-bridges)" -$DIR/scripts/stop-bridges +for host in $STRONGSWANHOSTS +do + log_action "Guest $host" + execute "virsh shutdown $host" + rm -f $VIRTIMGSTORE/$host.$IMGEXT +done +log_action "Removing kernel $KERNEL" +execute "rm $KNLTARGET" +log_action "Removing link to hostfs" +execute "rm $HOSTFSTARGET" diff --git a/testing/testing.conf b/testing/testing.conf index 5f6b0d65e..960d3f63e 100755..100644 --- a/testing/testing.conf +++ b/testing/testing.conf @@ -1,5 +1,5 @@ #!/bin/bash -# Global configuration file for strongswan UML testing. +# Global configuration file for strongswan integration testing. # # Copyright (C) 2004 Eric Marchionni, Patrik Rayo # Zuercher Hochschule Winterthur @@ -15,148 +15,66 @@ # for more details. # Root directory of testing -UMLTESTDIR=~/strongswan-testing - -# Bzipped kernel sources -# (file extension .tar.bz2 required) -KERNEL=$UMLTESTDIR/linux-3.5.3.tar.bz2 - -# Extract kernel version -KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'` - -# Kernel configuration file -KERNELCONFIG=$UMLTESTDIR/.config-3.5 - - -# Bzipped uml patch for kernel -UMLPATCH=$UMLTESTDIR/ha-3.0.patch.bz2 - -# Bzipped source of strongSwan -STRONGSWAN=$UMLTESTDIR/strongswan-5.0.1.tar.bz2 - -# strongSwan compile options (use "yes" or "no") -USE_LIBCURL="yes" -USE_LDAP="yes" -USE_EAP_AKA="yes" -USE_EAP_SIM="yes" -USE_EAP_MD5="yes" -USE_EAP_MSCHAPV2="yes" -USE_EAP_IDENTITY="yes" -USE_EAP_RADIUS="yes" -USE_EAP_DYNAMIC="yes" -USE_EAP_TLS="yes" -USE_EAP_TTLS="yes" -USE_EAP_PEAP="yes" -USE_EAP_TNC="yes" -USE_TNC_PDP="yes" -USE_TNC_IMC="yes" -USE_TNC_IMV="yes" -USE_TNCCS_11="yes" -USE_TNCCS_20="yes" -USE_TNCCS_DYNAMIC="yes" -USE_IMC_TEST="yes" -USE_IMV_TEST="yes" -USE_IMC_SCANNER="yes" -USE_IMV_SCANNER="yes" -USE_IMC_OS="yes" -USE_IMV_OS="yes" -USE_IMC_ATTESTATION="yes" -USE_IMV_ATTESTATION="yes" -USE_SQL="yes" -USE_MEDIATION="yes" -USE_OPENSSL="yes" -USE_BLOWFISH="yes" -USE_KERNEL_PFKEY="yes" -USE_INTEGRITY_TEST="yes" -USE_LEAK_DETECTIVE="yes" -USE_LOAD_TESTER="yes" -USE_TEST_VECTORS="yes" -USE_GCRYPT="yes" -USE_SOCKET_DEFAULT="yes" -USE_SOCKET_DYNAMIC="yes" -USE_DHCP="yes" -USE_FARP="yes" -USE_ADDRBLOCK="yes" -USE_CTR="yes" -USE_CCM="yes" -USE_GCM="yes" -USE_CMAC="yes" -USE_HA="yes" -USE_AF_ALG="yes" -USE_WHITELIST="yes" -USE_XAUTH_GENERIC="yes" -USE_XAUTH_EAP="yes" -USE_PKCS8="yes" -USE_IFMAP="no" -USE_CISCO_QUIRKS="no" -USE_UNITY="yes" - -# Gentoo linux root filesystem -ROOTFS=$UMLTESTDIR/gentoo-fs-20111212.tar.bz2 - -# Size of the finished root filesystem in MB -ROOTFSSIZE=850 - -# Amount of Memory to use per UML [MB]. -# If "auto" is stated 1/12 of total host ram will be used. -# Examples: MEM=64, MEM="128", MEM="auto" -MEM=96 - -# Directory where the UML kernels and file system will be built -BUILDDIR=$UMLTESTDIR/umlbuild - -# Filename of the built UML Kernel -UMLKERNEL=$BUILDDIR/linux-uml-$KERNELVERSION +TESTDIR=/srv/strongswan-testing + +# Kernel configuration +KERNELVERSION=3.5.3 +KERNEL=linux-$KERNELVERSION +KERNELTARBALL=$KERNEL.tar.bz2 +KERNELCONFIG=$DIR/../config/kernel/config-3.5 +KERNELPATCH=ha-3.0.patch.bz2 + +# strongSwan version used in tests +SWANVERSION=5.0.2dr4 + +# Build directory where the guest kernel and images will be built +BUILDDIR=$TESTDIR/build +# Directory shared between host and guests +SHAREDDIR=$BUILDDIR/shared + +# Logfile +LOGFILE=$BUILDDIR/testing.log + +# Directory used for loop-mounts +LOOPDIR=$BUILDDIR/loop + +# Common image settings +IMGEXT=qcow2 +IMGDIR=$BUILDDIR/images + +# Base image settings +# The base image is a pristine OS installation created using debootstrap. +BASEIMGSIZE=1024 +BASEIMGSUITE=wheezy +BASEIMGARCH=amd64 +BASEIMG=$IMGDIR/debian-$BASEIMGSUITE-$BASEIMGARCH.$IMGEXT +BASEIMGMIRROR=http://cdn.debian.net/debian + +# Root image settings +# The root image is the origin of all guest images. It is a clone of the base +# image and contains additional test-specific software and patches. +ROOTIMG=$IMGDIR/root.$IMGEXT + +# libvirt config +NBDEV=/dev/nbd0 +NBDPARTITION=${NBDEV}p1 +VIRTIMGSTORE=/var/lib/libvirt/images +KVMUSER=libvirt-qemu +KVMGROUP=kvm # Directory where test results will be stored -TESTRESULTSDIR=$UMLTESTDIR/testresults +TESTRESULTSDIR=$TESTDIR/testresults # SSH configuration (speedup SSH) -SSHCONF="-F $UMLTESTDIR/testing/ssh_config" - -# Path to a full strongswan tree on the host system, which is -# mounted into /root/strongswan-shared. This gives us an easy -# way to apply and test changes instantly. -#SHAREDTREE=/home/martin/strongswan/trunk - -# Timezone for the UMLs, look in /usr/share/zoneinfo! -TZUML="Europe/Zurich" - -############################################################## -# Enable particular steps in the make-testing and -# start-testing scripts -# -ENABLE_BUILD_UMLKERNEL="yes" -ENABLE_BUILD_SSHKEYS="yes" -ENABLE_BUILD_HOSTCONFIG="yes" -ENABLE_BUILD_UMLROOTFS="yes" -ENABLE_BUILD_UMLHOSTFS="yes" -ENABLE_START_TESTING="yes" -ENABLE_DO_TESTS="no" -ENABLE_STOP_TESTING="no" +SSHCONF="-F $TESTDIR/testing/ssh_config" ############################################################## -# How to start the UMLs? -# -# Start the UML instance in KDE konsole (requires KDE) -# UMLSTARTMODE="konsole" -# Start the UML instance in a gnome-terminal (requires gnome) -UMLSTARTMODE="gnome-terminal" -# Start the UML instance in an xterm (requires X11R6) -# UMLSTARTMODE="xterm" -# Start the UML instance without a terminal window -# but screen -r <host> can open a window anytime -# UMLSTARTMODE="screen" - -############################################################## -# If set to "yes" only the tests stated at $SELECTEDTESTS -# will be executed. (use "yes" or "no") -# -SELECTEDTESTSONLY="no" - -# Tests to do if $SELECTEDTESTSONLY is set "yes". +# Enable particular steps in the make-testing # -SELECTEDTESTS="ikev2/rw-cert" +ENABLE_BUILD_BASEIMAGE="yes" +ENABLE_BUILD_ROOTIMAGE="yes" +ENABLE_BUILD_GUESTKERNEL="yes" +ENABLE_BUILD_GUESTIMAGES="yes" ############################################################## # hostname and corresponding IPv4 and IPv6 addresses @@ -188,35 +106,5 @@ bob,fec2::10" # VPN gateways / clients # The hosts stated here will be created. Possible values # are sun, moon, dave, carol, alice, venus, bob, winnetou. -# It's fine to make them all unless you don't have much -# resources. In this case we assume you know what you do! -# -STRONGSWANHOSTS="sun moon dave carol alice venus bob winnetou" - -############################################################## -# Needed programs, do not change! -# -PROGRAMS="uml_switch uml_mconsole ssh ssh-keygen iptables \ - chroot screen mkreiserfs" - -############################################################## -# IP parameters of the UML switches -# -IFCONFIG_0="192.168.0.254 netmask 255.255.255.0" -IFCONFIG_1="10.1.0.254 netmask 255.255.0.0" -IFCONFIG_2="10.2.0.254 netmask 255.255.0.0" - -############################################################## -# Network interfaces of the UML instances # -SWITCH_alice="eth0=tuntap,tap1_alice,fe:fd:0a:01:00:0a \ - eth1=tuntap,tap0_alice,fe:fd:c0:a8:00:32" -SWITCH_venus="eth0=tuntap,tap1_venus,fe:fd:0a:01:00:14" -SWITCH_moon="eth0=tuntap,tap0_moon,fe:fd:c0:a8:00:01 \ - eth1=tuntap,tap1_moon,fe:fd:0a:01:00:01" -SWITCH_carol="eth0=tuntap,tap0_carol,fe:fd:c0:a8:00:64" -SWITCH_winnetou="eth0=tuntap,tap0_winnetou,fe:fd:c0:a8:00:96" -SWITCH_dave="eth0=tuntap,tap0_dave,fe:fd:c0:a8:00:c8" -SWITCH_sun="eth0=tuntap,tap0_sun,fe:fd:c0:a8:00:02 \ - eth1=tuntap,tap2_sun,fe:fd:0a:02:00:01" -SWITCH_bob="eth0=tuntap,tap2_bob,fe:fd:0a:02:00:0a" +STRONGSWANHOSTS="alice bob carol dave moon sun venus winnetou" diff --git a/testing/tests/af-alg/alg-camellia/evaltest.dat b/testing/tests/af-alg/alg-camellia/evaltest.dat index 72e3c5e29..2096cb994 100644 --- a/testing/tests/af-alg/alg-camellia/evaltest.dat +++ b/testing/tests/af-alg/alg-camellia/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/af-alg/alg-camellia/posttest.dat b/testing/tests/af-alg/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/af-alg/alg-camellia/posttest.dat +++ b/testing/tests/af-alg/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/alg-camellia/pretest.dat b/testing/tests/af-alg/alg-camellia/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/af-alg/alg-camellia/pretest.dat +++ b/testing/tests/af-alg/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/af-alg/alg-camellia/test.conf b/testing/tests/af-alg/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/af-alg/alg-camellia/test.conf +++ b/testing/tests/af-alg/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/af-alg/rw-cert/evaltest.dat b/testing/tests/af-alg/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/af-alg/rw-cert/evaltest.dat +++ b/testing/tests/af-alg/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/af-alg/rw-cert/posttest.dat b/testing/tests/af-alg/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/af-alg/rw-cert/posttest.dat +++ b/testing/tests/af-alg/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/rw-cert/pretest.dat b/testing/tests/af-alg/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/af-alg/rw-cert/pretest.dat +++ b/testing/tests/af-alg/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/af-alg/rw-cert/test.conf b/testing/tests/af-alg/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/af-alg/rw-cert/test.conf +++ b/testing/tests/af-alg/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat b/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat index 81e413f98..db5a76204 100644 --- a/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat +++ b/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat @@ -4,7 +4,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES moon:: ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES carol::ip xfrm state::enc cbc(serpent)::YES diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat b/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat index 6d2eeb5f9..1b8fc3b79 100644 --- a/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat +++ b/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/test.conf b/testing/tests/gcrypt-ikev1/alg-serpent/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/gcrypt-ikev1/alg-serpent/test.conf +++ b/testing/tests/gcrypt-ikev1/alg-serpent/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat index 7003977f9..ac3b5e0b0 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat +++ b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat @@ -4,7 +4,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES moon:: ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES carol::ip xfrm state::enc cbc(twofish)::YES diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat index 6d2eeb5f9..1b8fc3b79 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat +++ b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/test.conf b/testing/tests/gcrypt-ikev1/alg-twofish/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/test.conf +++ b/testing/tests/gcrypt-ikev1/alg-twofish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat index d82b68dcb..5f0bb3cdc 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat +++ b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat @@ -4,7 +4,7 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat +++ b/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat +++ b/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/test.conf b/testing/tests/gcrypt-ikev2/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/gcrypt-ikev2/alg-camellia/test.conf +++ b/testing/tests/gcrypt-ikev2/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat b/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat +++ b/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat b/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat +++ b/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat b/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat +++ b/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/gcrypt-ikev2/rw-cert/test.conf b/testing/tests/gcrypt-ikev2/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/gcrypt-ikev2/rw-cert/test.conf +++ b/testing/tests/gcrypt-ikev2/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ha/both-active/evaltest.dat b/testing/tests/ha/both-active/evaltest.dat index 36d72ff97..89e5f4b6e 100644 --- a/testing/tests/ha/both-active/evaltest.dat +++ b/testing/tests/ha/both-active/evaltest.dat @@ -8,8 +8,8 @@ alice::cat /var/log/daemon.log::HA segment 1 activated::YES moon:: cat /var/log/daemon.log::HA segment 2 activated::YES alice::cat /var/log/daemon.log::handling HA CHILD_SA::YES moon:: cat /var/log/daemon.log::installed HA CHILD_SA::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES carol::tcpdump::IP carol.strongswan.org > mars.strongswan.org: ESP::YES carol::tcpdump::IP mars.strongswan.org > carol.strongswan.org: ESP::YES dave::tcpdump::IP dave.strongswan.org > mars.strongswan.org: ESP::YES diff --git a/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables b/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 95d3b8828..000000000 --- a/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # forward ESP-tunneled traffic - iptables -A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT - iptables -A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT - iptables -A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # clusterip rules - iptables -A INPUT -i eth1 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 2 - iptables -A INPUT -i eth0 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 2 - - # allow esp - iptables -A INPUT -p 50 -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow heartbeat - iptables -A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT - iptables -A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT - - # allow ICMP type 3 - iptables -A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT - iptables -A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT - - # allow IGMP multicasts - iptables -A INPUT -d 224.0.0.1 -p igmp -j ACCEPT - iptables -A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules b/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..cad1d202a --- /dev/null +++ b/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules @@ -0,0 +1,50 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# forward ESP-tunneled traffic +-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT +-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT +-A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# clusterip rules +-A INPUT -i eth1 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 2 +-A INPUT -i eth0 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 2 + +# allow esp +-A INPUT -p 50 -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT + +# allow IKE +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow heartbeat +-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT +-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT + +# allow ICMP type 3 +-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT +-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT + +# allow IGMP multicasts +-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT +-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT diff --git a/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables b/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 6f7a0316b..000000000 --- a/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # forward ESP-tunneled traffic - iptables -A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT - iptables -A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT - iptables -A FORWARD -m policy -o eth0 --dir out --pol ipsec --proto esp -j ACCEPT - - # clusterip rules - iptables -A INPUT -i eth0 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 1 - iptables -A INPUT -i eth1 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip \ - --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 1 - - # allow esp - iptables -A INPUT -p 50 -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT - iptables -A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow heartbeat - iptables -A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT - iptables -A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT - - # allow ICMP type 3 - iptables -A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT - iptables -A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT - - # allow IGMP multicasts - iptables -A INPUT -d 224.0.0.1 -p igmp -j ACCEPT - iptables -A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules b/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..ab7fd7fcb --- /dev/null +++ b/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules @@ -0,0 +1,50 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# forward ESP-tunneled traffic +-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT +-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT +-A FORWARD -m policy -o eth0 --dir out --pol ipsec --proto esp -j ACCEPT + +# clusterip rules +-A INPUT -i eth0 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 1 +-A INPUT -i eth1 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 1 + +# allow esp +-A INPUT -p 50 -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT +-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow heartbeat +-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT +-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT + +# allow ICMP type 3 +-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT +-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT + +# allow IGMP multicasts +-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT +-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT diff --git a/testing/tests/ha/both-active/posttest.dat b/testing/tests/ha/both-active/posttest.dat index 49bf76055..e4ffe8eef 100644 --- a/testing/tests/ha/both-active/posttest.dat +++ b/testing/tests/ha/both-active/posttest.dat @@ -2,15 +2,15 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop alice::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -alice::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +alice::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ip addr del 192.168.0.5/24 dev eth0 moon::ip addr del 10.1.0.5/16 dev eth1 alice::ip addr del 192.168.0.5/24 dev eth1 alice::ip addr del 10.1.0.5/16 dev eth0 -alice::/etc/init.d/net.eth1 stop +alice::ifdown eth1 venus::ip route del default via 10.1.0.5 dev eth0 venus::ip route add default via 10.1.0.1 dev eth0 moon::conntrack -F diff --git a/testing/tests/ha/both-active/pretest.dat b/testing/tests/ha/both-active/pretest.dat index e2e509855..af4d66cfc 100644 --- a/testing/tests/ha/both-active/pretest.dat +++ b/testing/tests/ha/both-active/pretest.dat @@ -1,14 +1,14 @@ moon::ip addr add 192.168.0.5/24 dev eth0 moon::ip addr add 10.1.0.5/16 dev eth1 -alice::/etc/init.d/net.eth1 start +alice::ifup eth1 alice::ip addr add 192.168.0.5/24 dev eth1 alice::ip addr add 10.1.0.5/16 dev eth0 venus::ip route del default via 10.1.0.1 dev eth0 venus::ip route add default via 10.1.0.5 dev eth0 -moon::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start alice::ipsec start carol::ipsec start diff --git a/testing/tests/ha/both-active/test.conf b/testing/tests/ha/both-active/test.conf index 0473013e1..8056d9ce4 100644 --- a/testing/tests/ha/both-active/test.conf +++ b/testing/tests/ha/both-active/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="venus carol dave" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon carol dave" diff --git a/testing/tests/ike/rw-cert/evaltest.dat b/testing/tests/ike/rw-cert/evaltest.dat index c8fcb2370..e431ce533 100644 --- a/testing/tests/ike/rw-cert/evaltest.dat +++ b/testing/tests/ike/rw-cert/evaltest.dat @@ -10,8 +10,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ike/rw-cert/pretest.dat b/testing/tests/ike/rw-cert/pretest.dat index 587b6aeed..e50793830 100644 --- a/testing/tests/ike/rw-cert/pretest.dat +++ b/testing/tests/ike/rw-cert/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ike/rw-cert/test.conf b/testing/tests/ike/rw-cert/test.conf index 845a6dcd7..51bf2b7f2 100644 --- a/testing/tests/ike/rw-cert/test.conf +++ b/testing/tests/ike/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ike/rw_v1-net_v2/evaltest.dat b/testing/tests/ike/rw_v1-net_v2/evaltest.dat index f12b19e3d..847a2d92d 100644 --- a/testing/tests/ike/rw_v1-net_v2/evaltest.dat +++ b/testing/tests/ike/rw_v1-net_v2/evaltest.dat @@ -2,13 +2,13 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ike/rw_v1-net_v2/pretest.dat b/testing/tests/ike/rw_v1-net_v2/pretest.dat index 03b8dc218..f61a4cb51 100644 --- a/testing/tests/ike/rw_v1-net_v2/pretest.dat +++ b/testing/tests/ike/rw_v1-net_v2/pretest.dat @@ -1,5 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward moon::ipsec start sun::ipsec start carol::ipsec start diff --git a/testing/tests/ike/rw_v1-net_v2/test.conf b/testing/tests/ike/rw_v1-net_v2/test.conf index 983881e5d..864f944d7 100644 --- a/testing/tests/ike/rw_v1-net_v2/test.conf +++ b/testing/tests/ike/rw_v1-net_v2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="carol moon sun" diff --git a/testing/tests/ikev1/alg-3des-md5/evaltest.dat b/testing/tests/ikev1/alg-3des-md5/evaltest.dat index a553ff168..abd29e97e 100644 --- a/testing/tests/ikev1/alg-3des-md5/evaltest.dat +++ b/testing/tests/ikev1/alg-3des-md5/evaltest.dat @@ -4,12 +4,12 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED::YES carol::ipsec status 2> /dev/null::home.*INSTALLED::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*3DES_CBC/HMAC_MD5_96,::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_MD5_96,::YES moon:: ip xfrm state::enc cbc(des3_ede)::YES carol::ip xfrm state::enc cbc(des3_ede)::YES -moon:: ip xfrm state::auth hmac(md5)::YES -carol::ip xfrm state::auth hmac(md5)::YES +moon:: ip xfrm state::auth-trunc hmac(md5)::YES +carol::ip xfrm state::auth-trunc hmac(md5)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES diff --git a/testing/tests/ikev1/alg-3des-md5/posttest.dat b/testing/tests/ikev1/alg-3des-md5/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-3des-md5/posttest.dat +++ b/testing/tests/ikev1/alg-3des-md5/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-3des-md5/pretest.dat b/testing/tests/ikev1/alg-3des-md5/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-3des-md5/pretest.dat +++ b/testing/tests/ikev1/alg-3des-md5/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-3des-md5/test.conf b/testing/tests/ikev1/alg-3des-md5/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-3des-md5/test.conf +++ b/testing/tests/ikev1/alg-3des-md5/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/alg-blowfish/evaltest.dat b/testing/tests/ikev1/alg-blowfish/evaltest.dat index 3787bdb68..cd83c56b4 100644 --- a/testing/tests/ikev1/alg-blowfish/evaltest.dat +++ b/testing/tests/ikev1/alg-blowfish/evaltest.dat @@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_384_192,::YES dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA2_256_128,::YES carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES diff --git a/testing/tests/ikev1/alg-blowfish/posttest.dat b/testing/tests/ikev1/alg-blowfish/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/alg-blowfish/posttest.dat +++ b/testing/tests/ikev1/alg-blowfish/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-blowfish/pretest.dat b/testing/tests/ikev1/alg-blowfish/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/alg-blowfish/pretest.dat +++ b/testing/tests/ikev1/alg-blowfish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/alg-blowfish/test.conf b/testing/tests/ikev1/alg-blowfish/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/alg-blowfish/test.conf +++ b/testing/tests/ikev1/alg-blowfish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat b/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat index c07c176b5..8230ee30c 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat +++ b/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024_160::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/alg-modp-subgroup/posttest.dat b/testing/tests/ikev1/alg-modp-subgroup/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/posttest.dat +++ b/testing/tests/ikev1/alg-modp-subgroup/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-modp-subgroup/pretest.dat b/testing/tests/ikev1/alg-modp-subgroup/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/pretest.dat +++ b/testing/tests/ikev1/alg-modp-subgroup/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/alg-modp-subgroup/test.conf b/testing/tests/ikev1/alg-modp-subgroup/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/alg-modp-subgroup/test.conf +++ b/testing/tests/ikev1/alg-modp-subgroup/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/alg-sha256/evaltest.dat b/testing/tests/ikev1/alg-sha256/evaltest.dat index 7b5640af8..eba856742 100644 --- a/testing/tests/ikev1/alg-sha256/evaltest.dat +++ b/testing/tests/ikev1/alg-sha256/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES -moon:: ip xfrm state::auth hmac(sha256)::YES -carol::ip xfrm state::auth hmac(sha256)::YES +moon:: ip xfrm state::auth-trunc hmac(sha256)::YES +carol::ip xfrm state::auth-trunc hmac(sha256)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 200::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 200::YES diff --git a/testing/tests/ikev1/alg-sha256/posttest.dat b/testing/tests/ikev1/alg-sha256/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-sha256/posttest.dat +++ b/testing/tests/ikev1/alg-sha256/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-sha256/pretest.dat b/testing/tests/ikev1/alg-sha256/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-sha256/pretest.dat +++ b/testing/tests/ikev1/alg-sha256/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-sha256/test.conf b/testing/tests/ikev1/alg-sha256/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-sha256/test.conf +++ b/testing/tests/ikev1/alg-sha256/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/alg-sha384/evaltest.dat b/testing/tests/ikev1/alg-sha384/evaltest.dat index 21b3d5a4f..3b24217c5 100644 --- a/testing/tests/ikev1/alg-sha384/evaltest.dat +++ b/testing/tests/ikev1/alg-sha384/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES -moon:: ip xfrm state::auth hmac(sha384)::YES -carol::ip xfrm state::auth hmac(sha384)::YES +moon:: ip xfrm state::auth-trunc hmac(sha384)::YES +carol::ip xfrm state::auth-trunc hmac(sha384)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/ikev1/alg-sha384/posttest.dat b/testing/tests/ikev1/alg-sha384/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-sha384/posttest.dat +++ b/testing/tests/ikev1/alg-sha384/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-sha384/pretest.dat b/testing/tests/ikev1/alg-sha384/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-sha384/pretest.dat +++ b/testing/tests/ikev1/alg-sha384/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-sha384/test.conf b/testing/tests/ikev1/alg-sha384/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-sha384/test.conf +++ b/testing/tests/ikev1/alg-sha384/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/alg-sha512/evaltest.dat b/testing/tests/ikev1/alg-sha512/evaltest.dat index 7b94d2182..6bdceeb44 100644 --- a/testing/tests/ikev1/alg-sha512/evaltest.dat +++ b/testing/tests/ikev1/alg-sha512/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES -moon:: ip xfrm state::auth hmac(sha512)::YES -carol::ip xfrm state::auth hmac(sha512)::YES +moon:: ip xfrm state::auth-trunc hmac(sha512)::YES +carol::ip xfrm state::auth-trunc hmac(sha512)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES diff --git a/testing/tests/ikev1/alg-sha512/posttest.dat b/testing/tests/ikev1/alg-sha512/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/alg-sha512/posttest.dat +++ b/testing/tests/ikev1/alg-sha512/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/alg-sha512/pretest.dat b/testing/tests/ikev1/alg-sha512/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/alg-sha512/pretest.dat +++ b/testing/tests/ikev1/alg-sha512/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/alg-sha512/test.conf b/testing/tests/ikev1/alg-sha512/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/alg-sha512/test.conf +++ b/testing/tests/ikev1/alg-sha512/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/compress/pretest.dat b/testing/tests/ikev1/compress/pretest.dat index 7d077c126..f5aa989fe 100644 --- a/testing/tests/ikev1/compress/pretest.dat +++ b/testing/tests/ikev1/compress/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev1/compress/test.conf b/testing/tests/ikev1/compress/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/ikev1/compress/test.conf +++ b/testing/tests/ikev1/compress/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/config-payload/evaltest.dat b/testing/tests/ikev1/config-payload/evaltest.dat index a429e9b32..b46dfddf6 100644 --- a/testing/tests/ikev1/config-payload/evaltest.dat +++ b/testing/tests/ikev1/config-payload/evaltest.dat @@ -5,13 +5,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::cat /etc/resolv.conf::nameserver PH_IP_WINNETOU .*from moon.strongswan.org::YES carol::cat /etc/resolv.conf::nameserver PH_IP_VENUS .*from moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES diff --git a/testing/tests/ikev1/config-payload/posttest.dat b/testing/tests/ikev1/config-payload/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/config-payload/posttest.dat +++ b/testing/tests/ikev1/config-payload/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/config-payload/pretest.dat b/testing/tests/ikev1/config-payload/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev1/config-payload/pretest.dat +++ b/testing/tests/ikev1/config-payload/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/config-payload/test.conf b/testing/tests/ikev1/config-payload/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/config-payload/test.conf +++ b/testing/tests/ikev1/config-payload/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/double-nat-net/evaltest.dat b/testing/tests/ikev1/double-nat-net/evaltest.dat index 05dc82d70..52c561964 100644 --- a/testing/tests/ikev1/double-nat-net/evaltest.dat +++ b/testing/tests/ikev1/double-nat-net/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/double-nat-net/posttest.dat b/testing/tests/ikev1/double-nat-net/posttest.dat index 484297418..63d4f98e7 100644 --- a/testing/tests/ikev1/double-nat-net/posttest.dat +++ b/testing/tests/ikev1/double-nat-net/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev1/double-nat-net/pretest.dat b/testing/tests/ikev1/double-nat-net/pretest.dat index 41b69aed6..17a4fe5eb 100644 --- a/testing/tests/ikev1/double-nat-net/pretest.dat +++ b/testing/tests/ikev1/double-nat-net/pretest.dat @@ -1,8 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -bob::echo 1 > /proc/sys/net/ipv4/ip_forward -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev1/double-nat-net/test.conf b/testing/tests/ikev1/double-nat-net/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev1/double-nat-net/test.conf +++ b/testing/tests/ikev1/double-nat-net/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev1/double-nat/evaltest.dat b/testing/tests/ikev1/double-nat/evaltest.dat index b080482f9..9ddad2de5 100644 --- a/testing/tests/ikev1/double-nat/evaltest.dat +++ b/testing/tests/ikev1/double-nat/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules b/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/double-nat/posttest.dat b/testing/tests/ikev1/double-nat/posttest.dat index 5d39e406d..aa806bfc9 100644 --- a/testing/tests/ikev1/double-nat/posttest.dat +++ b/testing/tests/ikev1/double-nat/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev1/double-nat/pretest.dat b/testing/tests/ikev1/double-nat/pretest.dat index 10ba6d735..65f18b756 100644 --- a/testing/tests/ikev1/double-nat/pretest.dat +++ b/testing/tests/ikev1/double-nat/pretest.dat @@ -1,7 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev1/double-nat/test.conf b/testing/tests/ikev1/double-nat/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev1/double-nat/test.conf +++ b/testing/tests/ikev1/double-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev1/dpd-clear/test.conf b/testing/tests/ikev1/dpd-clear/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev1/dpd-clear/test.conf +++ b/testing/tests/ikev1/dpd-clear/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/dpd-restart/test.conf b/testing/tests/ikev1/dpd-restart/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev1/dpd-restart/test.conf +++ b/testing/tests/ikev1/dpd-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/dynamic-initiator/evaltest.dat b/testing/tests/ikev1/dynamic-initiator/evaltest.dat index f22f1247f..61546f417 100644 --- a/testing/tests/ikev1/dynamic-initiator/evaltest.dat +++ b/testing/tests/ikev1/dynamic-initiator/evaltest.dat @@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES moon:: cat /var/log/daemon.log::deleting duplicate IKE_SA for.*carol@strongswan.org.*due to uniqueness policy::YES moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev1/dynamic-initiator/posttest.dat b/testing/tests/ikev1/dynamic-initiator/posttest.dat index 4dbf3d4a4..32ac12ddc 100644 --- a/testing/tests/ikev1/dynamic-initiator/posttest.dat +++ b/testing/tests/ikev1/dynamic-initiator/posttest.dat @@ -2,8 +2,6 @@ dave::ipsec stop carol::ipsec stop dave::sleep 1 moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +carol::iptables-restore < /etc/iptables.flush dave::rm /etc/ipsec.d/certs/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev1/dynamic-initiator/pretest.dat b/testing/tests/ikev1/dynamic-initiator/pretest.dat index 92681011f..9aadb2a4c 100644 --- a/testing/tests/ikev1/dynamic-initiator/pretest.dat +++ b/testing/tests/ikev1/dynamic-initiator/pretest.dat @@ -1,6 +1,4 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +carol::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start @@ -10,4 +8,4 @@ carol::sleep 1 carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT dave::ipsec up moon -dave::sleep 2 +dave::sleep 2 diff --git a/testing/tests/ikev1/dynamic-initiator/test.conf b/testing/tests/ikev1/dynamic-initiator/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/dynamic-initiator/test.conf +++ b/testing/tests/ikev1/dynamic-initiator/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/dynamic-responder/evaltest.dat b/testing/tests/ikev1/dynamic-responder/evaltest.dat index f22f1247f..61546f417 100644 --- a/testing/tests/ikev1/dynamic-responder/evaltest.dat +++ b/testing/tests/ikev1/dynamic-responder/evaltest.dat @@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES moon:: cat /var/log/daemon.log::deleting duplicate IKE_SA for.*carol@strongswan.org.*due to uniqueness policy::YES moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev1/dynamic-responder/posttest.dat b/testing/tests/ikev1/dynamic-responder/posttest.dat index 4dbf3d4a4..32ac12ddc 100644 --- a/testing/tests/ikev1/dynamic-responder/posttest.dat +++ b/testing/tests/ikev1/dynamic-responder/posttest.dat @@ -2,8 +2,6 @@ dave::ipsec stop carol::ipsec stop dave::sleep 1 moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +carol::iptables-restore < /etc/iptables.flush dave::rm /etc/ipsec.d/certs/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev1/dynamic-responder/pretest.dat b/testing/tests/ikev1/dynamic-responder/pretest.dat index c0f166ff4..8dc744f9a 100644 --- a/testing/tests/ikev1/dynamic-responder/pretest.dat +++ b/testing/tests/ikev1/dynamic-responder/pretest.dat @@ -1,6 +1,4 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +carol::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start @@ -10,4 +8,4 @@ moon::sleep 1 carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT dave::ipsec up moon -dave::sleep 2 +dave::sleep 2 diff --git a/testing/tests/ikev1/dynamic-responder/test.conf b/testing/tests/ikev1/dynamic-responder/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/dynamic-responder/test.conf +++ b/testing/tests/ikev1/dynamic-responder/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/dynamic-two-peers/evaltest.dat b/testing/tests/ikev1/dynamic-two-peers/evaltest.dat index 1d5ff68ec..82d2e7318 100644 --- a/testing/tests/ikev1/dynamic-two-peers/evaltest.dat +++ b/testing/tests/ikev1/dynamic-two-peers/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev1/dynamic-two-peers/posttest.dat b/testing/tests/ikev1/dynamic-two-peers/posttest.dat index e120b87db..7b2609846 100644 --- a/testing/tests/ikev1/dynamic-two-peers/posttest.dat +++ b/testing/tests/ikev1/dynamic-two-peers/posttest.dat @@ -3,6 +3,6 @@ dave::ipsec stop moon::sleep 1 moon::ipsec stop moon::mv /etc/hosts.ori /etc/hosts -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/dynamic-two-peers/pretest.dat b/testing/tests/ikev1/dynamic-two-peers/pretest.dat index 6596a2527..4bb2a4686 100644 --- a/testing/tests/ikev1/dynamic-two-peers/pretest.dat +++ b/testing/tests/ikev1/dynamic-two-peers/pretest.dat @@ -1,8 +1,8 @@ moon::mv /etc/hosts /etc/hosts.ori moon::mv /etc/hosts.stale /etc/hosts -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/dynamic-two-peers/test.conf b/testing/tests/ikev1/dynamic-two-peers/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/dynamic-two-peers/test.conf +++ b/testing/tests/ikev1/dynamic-two-peers/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat index 6f7c13704..648920105 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_CCM_12_128::YES carol::ipsec statusall 2> /dev/null::AES_CCM_12_128::YES carol::ip xfrm state::aead rfc4309(ccm(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/test.conf b/testing/tests/ikev1/esp-alg-aes-ccm/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-ccm/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-ccm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat index 9a8b46897..c86f58081 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_CTR_256/AES_XCBC_96::YES carol::ipsec statusall 2> /dev/null::AES_CTR_256/AES_XCBC_96::YES moon:: ip xfrm state::rfc3686(ctr(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/test.conf b/testing/tests/ikev1/esp-alg-aes-ctr/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-ctr/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-ctr/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat index 9d5fb7cc3..a7f52c72e 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_GCM_16_256::YES carol::ipsec statusall 2> /dev/null::AES_GCM_16_256::YES carol::ip xfrm state::aead rfc4106(gcm(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/test.conf b/testing/tests/ikev1/esp-alg-aes-gcm/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-gcm/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-gcm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat index 74150fb04..d5d3bc0d3 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ip xfrm state::aead rfc4543(gcm(aes))::YES diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/test.conf b/testing/tests/ikev1/esp-alg-aes-gmac/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-aes-gmac/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-gmac/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat index 6f5b89332..b466813fe 100644 --- a/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat @@ -2,10 +2,10 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::AES_CBC_256/AES_XCBC_96,::YES moon:: ipsec statusall 2> /dev/null::AES_CBC_256/AES_XCBC_96,::YES -carol::ip xfrm state::auth xcbc(aes)::YES -moon:: ip xfrm state::auth xcbc(aes)::YES +carol::ip xfrm state::auth-trunc xcbc(aes)::YES +moon:: ip xfrm state::auth-trunc xcbc(aes)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat b/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat index 7d077c126..f5aa989fe 100644 --- a/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat +++ b/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf b/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf +++ b/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/esp-alg-null/evaltest.dat b/testing/tests/ikev1/esp-alg-null/evaltest.dat index 937d85ed2..1b9c6c27e 100644 --- a/testing/tests/ikev1/esp-alg-null/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-null/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES moon:: ip xfrm state::enc ecb(cipher_null)::YES diff --git a/testing/tests/ikev1/esp-alg-null/posttest.dat b/testing/tests/ikev1/esp-alg-null/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/esp-alg-null/posttest.dat +++ b/testing/tests/ikev1/esp-alg-null/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/esp-alg-null/pretest.dat b/testing/tests/ikev1/esp-alg-null/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev1/esp-alg-null/pretest.dat +++ b/testing/tests/ikev1/esp-alg-null/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/esp-alg-null/test.conf b/testing/tests/ikev1/esp-alg-null/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/esp-alg-null/test.conf +++ b/testing/tests/ikev1/esp-alg-null/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/host2host-cert/evaltest.dat b/testing/tests/ikev1/host2host-cert/evaltest.dat index 53e5589ca..3305f4558 100644 --- a/testing/tests/ikev1/host2host-cert/evaltest.dat +++ b/testing/tests/ikev1/host2host-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/host2host-cert/posttest.dat b/testing/tests/ikev1/host2host-cert/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/host2host-cert/posttest.dat +++ b/testing/tests/ikev1/host2host-cert/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/host2host-cert/pretest.dat b/testing/tests/ikev1/host2host-cert/pretest.dat index 1fa70177c..3bce9f6e5 100644 --- a/testing/tests/ikev1/host2host-cert/pretest.dat +++ b/testing/tests/ikev1/host2host-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev1/host2host-cert/test.conf b/testing/tests/ikev1/host2host-cert/test.conf index 305a67316..55d6e9fd6 100644 --- a/testing/tests/ikev1/host2host-cert/test.conf +++ b/testing/tests/ikev1/host2host-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/host2host-transport/evaltest.dat b/testing/tests/ikev1/host2host-transport/evaltest.dat index 3021b5e04..fc49e57d8 100644 --- a/testing/tests/ikev1/host2host-transport/evaltest.dat +++ b/testing/tests/ikev1/host2host-transport/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/host2host-transport/posttest.dat b/testing/tests/ikev1/host2host-transport/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/host2host-transport/posttest.dat +++ b/testing/tests/ikev1/host2host-transport/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/host2host-transport/pretest.dat b/testing/tests/ikev1/host2host-transport/pretest.dat index e2d98f2eb..99789b90f 100644 --- a/testing/tests/ikev1/host2host-transport/pretest.dat +++ b/testing/tests/ikev1/host2host-transport/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/ikev1/host2host-transport/test.conf b/testing/tests/ikev1/host2host-transport/test.conf index cf2e704fd..5a286c84f 100644 --- a/testing/tests/ikev1/host2host-transport/test.conf +++ b/testing/tests/ikev1/host2host-transport/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/ip-pool-db/evaltest.dat b/testing/tests/ikev1/ip-pool-db/evaltest.dat index 941cb34c0..42e353084 100644 --- a/testing/tests/ikev1/ip-pool-db/evaltest.dat +++ b/testing/tests/ikev1/ip-pool-db/evaltest.dat @@ -6,7 +6,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES @@ -15,7 +15,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev1/ip-pool-db/posttest.dat b/testing/tests/ikev1/ip-pool-db/posttest.dat index 5b88b2163..c99f347e3 100644 --- a/testing/tests/ikev1/ip-pool-db/posttest.dat +++ b/testing/tests/ikev1/ip-pool-db/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ipsec pool --del bigpool 2> /dev/null moon::ipsec pool --del dns 2> /dev/null moon::ipsec pool --del nbns 2> /dev/null diff --git a/testing/tests/ikev1/ip-pool-db/pretest.dat b/testing/tests/ikev1/ip-pool-db/pretest.dat index 4a2add194..fce551c69 100644 --- a/testing/tests/ikev1/ip-pool-db/pretest.dat +++ b/testing/tests/ikev1/ip-pool-db/pretest.dat @@ -4,9 +4,9 @@ moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2> moon::ipsec pool --addattr dns --server PH_IP_WINNETOU 2> /dev/null moon::ipsec pool --addattr dns --server PH_IP_VENUS 2> /dev/null moon::ipsec pool --addattr nbns --server PH_IP_VENUS 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/ip-pool-db/test.conf b/testing/tests/ikev1/ip-pool-db/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/ip-pool-db/test.conf +++ b/testing/tests/ikev1/ip-pool-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/ip-pool/evaltest.dat b/testing/tests/ikev1/ip-pool/evaltest.dat index db46646a6..1fdc3f087 100644 --- a/testing/tests/ikev1/ip-pool/evaltest.dat +++ b/testing/tests/ikev1/ip-pool/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev1/ip-pool/posttest.dat b/testing/tests/ikev1/ip-pool/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev1/ip-pool/posttest.dat +++ b/testing/tests/ikev1/ip-pool/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/ip-pool/pretest.dat b/testing/tests/ikev1/ip-pool/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev1/ip-pool/pretest.dat +++ b/testing/tests/ikev1/ip-pool/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/ip-pool/test.conf b/testing/tests/ikev1/ip-pool/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/ip-pool/test.conf +++ b/testing/tests/ikev1/ip-pool/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat b/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat index c8e7adcb7..2eebc0f84 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/multi-level-ca-cr-init/test.conf b/testing/tests/ikev1/multi-level-ca-cr-init/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-init/test.conf +++ b/testing/tests/ikev1/multi-level-ca-cr-init/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat b/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf b/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf +++ b/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/multi-level-ca/pretest.dat b/testing/tests/ikev1/multi-level-ca/pretest.dat index 67c50c2ef..755564cbc 100644 --- a/testing/tests/ikev1/multi-level-ca/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/multi-level-ca/test.conf b/testing/tests/ikev1/multi-level-ca/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev1/multi-level-ca/test.conf +++ b/testing/tests/ikev1/multi-level-ca/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/nat-rw/evaltest.dat b/testing/tests/ikev1/nat-rw/evaltest.dat index e0b458dba..387dbae23 100644 --- a/testing/tests/ikev1/nat-rw/evaltest.dat +++ b/testing/tests/ikev1/nat-rw/evaltest.dat @@ -6,13 +6,13 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES moon:: sleep 6::no output expected::NO -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP-encap: ESP::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: isakmp-nat-keep-alive::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP-encap: ESP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP-encap: ESP::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: isakmp-nat-keep-alive::YES alice::cat /var/log/daemon.log::sending keep alive::YES venus::cat /var/log/daemon.log::sending keep alive::YES diff --git a/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/nat-rw/posttest.dat b/testing/tests/ikev1/nat-rw/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/ikev1/nat-rw/posttest.dat +++ b/testing/tests/ikev1/nat-rw/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev1/nat-rw/pretest.dat b/testing/tests/ikev1/nat-rw/pretest.dat index e365ff5c5..d701a1d61 100644 --- a/testing/tests/ikev1/nat-rw/pretest.dat +++ b/testing/tests/ikev1/nat-rw/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start diff --git a/testing/tests/ikev1/nat-rw/test.conf b/testing/tests/ikev1/nat-rw/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/ikev1/nat-rw/test.conf +++ b/testing/tests/ikev1/nat-rw/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev1/nat-virtual-ip/description.txt b/testing/tests/ikev1/nat-virtual-ip/description.txt new file mode 100644 index 000000000..31d24cda6 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/description.txt @@ -0,0 +1,6 @@ +The router <b>moon</b> sets up a connection to gateway <b>sun</b> in order +to reach the subnet hidden behind <b>sun</b>. The gateway <b>sun</b> assigns a +virtual IP address to router <b>moon</b>. A special updown script on <b>moon</b> +specified by <b>leftupdown=/etc/nat_updown</b> dynamically inserts a source NAT rule +which maps the IP address of client <b>alice</b> to the virtual IP of <b>moon</b>. +This allows <b>alice</b> to access client <b>bob</b> via the established IPsec tunnel. diff --git a/testing/tests/ikev1/nat-virtual-ip/evaltest.dat b/testing/tests/ikev1/nat-virtual-ip/evaltest.dat new file mode 100644 index 000000000..c60ffc772 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/evaltest.dat @@ -0,0 +1,8 @@ +moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES +sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES +moon:: cat /var/log/daemon.log::inserted NAT rule mapping PH_IP_ALICE to virtual IP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +bob::tcpdump::IP alice2.strongswan.org > bob.strongswan.org: ICMP::YES +bob::tcpdump::IP bob.strongswan.org > alice2.strongswan.org: ICMP::YES diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts b/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts new file mode 100644 index 000000000..ee854da09 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts @@ -0,0 +1,70 @@ +# /etc/hosts: This file describes a number of hostname-to-address +# mappings for the TCP/IP subsystem. It is mostly +# used at boot time, when no name servers are running. +# On small systems, this file can be used instead of a +# "named" name server. Just add the names, addresses +# and any aliases to this file... +# + +127.0.0.1 localhost + +192.168.0.254 uml0.strongswan.org uml0 +10.1.0.254 uml1.strongswan.org uml1 +10.2.0.254 uml1.strongswan.org uml2 + +10.1.0.10 alice.strongswan.org alice +10.1.0.20 venus.strongswan.org venus +10.1.0.1 moon1.strongswan.org moon1 +192.168.0.1 moon.strongswan.org moon +192.168.0.50 alice1.strongswan.org alice1 +192.168.0.100 carol.strongswan.org carol +10.3.0.1 carol1.strongswan.org carol1 +192.168.0.150 winnetou.strongswan.org winnetou crl.strongswan.org ocsp.strongswan.org ldap.strongswan.org +192.168.0.200 dave.strongswan.org dave +10.3.0.2 dave1.strongswan.org dave1 +192.168.0.2 sun.strongswan.org sun +10.2.0.1 sun1.strongswan.org sun1 +10.2.0.10 bob.strongswan.org bob +10.4.0.1 alice2.strongswan.org alice2 + +# IPv6 versions of localhost and co +::1 ip6-localhost ip6-loopback +fe00::0 ip6-localnet +ff00::0 ip6-mcastprefix +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters +ff02::3 ip6-allhosts + +# IPv6 solicited-node multicast addresses +ff02::1:ff00:1 ip6-mcast-1 +ff02::1:ff00:2 ip6-mcast-2 +ff02::1:ff00:10 ip6-mcast-10 +ff02::1:ff00:15 ip6-mcast-15 +ff02::1:ff00:20 ip6-mcast-20 + +# IPv6 site-local addresses +fec0::5 ip6-alice1.strongswan.org ip6-alice1 +fec1::10 ip6-alice.strongswan.org ip6-alice +fec1::20 ip6-venus.strongswan.org ip6-venus +fec1::1 ip6-moon1.strongswan.org ip6-moon1 +fec0::1 ip6-moon.strongswan.org ip6-moon +fec0::10 ip6-carol.strongswan.org ip6-carol +fec3::1 ip6-carol1.strongswan.org ip6-carol1 +fec0::15 ip6-winnetou.strongswan.org ip6-winnetou +fec0::20 ip6-dave.strongswan.org ip6-dave +fec3::2 ip6-dave1.strongswan.org ip6-dave1 +fec0::2 ip6-sun.strongswan.org ip6-sun +fec2::1 ip6-sun1.strongswan.org ip6-sun1 +fec2::10 ip6-bob.strongswan.org ip6-bob + +# IPv6 link-local HW derived addresses +fe80::fcfd:0aff:fe01:14 ip6-hw-venus.strongswan.org ip6-hw-venus +fe80::fcfd:0aff:fe01:0a ip6-hw-alice.strongswan.org ip6-hw-alice +fe80::fcfd:0aff:fe01:01 ip6-hw-moon1.strongswan.org ip6-hw-moon1 +fe80::fcfd:c0ff:fea8:01 ip6-hw-moon.strongswan.org ip6-hw-moon +fe80::fcfd:c0ff:fea8:64 ip6-hw-carol.strongswan.org ip6-hw-carol +fe80::fcfd:c0ff:fea8:96 ip6-hw-winnetou.strongswan.org ip6-hw-winnetou +fe80::fcfd:c0ff:fea8:c8 ip6-hw-dave.strongswan.org ip6-hw-dave +fe80::fcfd:c0ff:fea8:02 ip6-hw-sun.strongswan.org ip6-hw-sun +fe80::fcfd:0aff:fe02:01 ip6-hw-sun1.strongswan.org ip6-hw-sun1 +fe80::fcfd:0aff:fe02:0a ip6-hw-bob.strongswan.org ip6-hw-bob diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf new file mode 100644 index 000000000..28853ce75 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev1 + mobike=no + +conn net-net + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsourceip=%config + leftupdown=/etc/nat_updown + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown new file mode 100755 index 000000000..aab1df687 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown @@ -0,0 +1,152 @@ +#! /bin/sh +# NAT updown script +# +# Copyright (C) 2010 Andreas Steffen <andreas.steffen@strongswan.org> +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. + +# things that this script gets (from ipsec_pluto(8) man page) +# +# PLUTO_VERSION +# indicates what version of this interface is being +# used. This document describes version 1.1. This +# is upwardly compatible with version 1.0. +# +# PLUTO_VERB +# specifies the name of the operation to be performed +# (prepare-host, prepare-client, up-host, up-client, +# down-host, or down-client). If the address family +# for security gateway to security gateway communica- +# tions is IPv6, then a suffix of -v6 is added to the +# verb. +# +# PLUTO_CONNECTION +# is the name of the connection for which we are +# routing. +# +# PLUTO_NEXT_HOP +# is the next hop to which packets bound for the peer +# must be sent. +# +# PLUTO_INTERFACE +# is the name of the ipsec interface to be used. +# +# PLUTO_REQID +# is the requid of the ESP policy +# +# PLUTO_ME +# is the IP address of our host. +# +# PLUTO_MY_ID +# is the ID of our host. +# +# PLUTO_MY_CLIENT +# is the IP address / count of our client subnet. If +# the client is just the host, this will be the +# host's own IP address / max (where max is 32 for +# IPv4 and 128 for IPv6). +# +# PLUTO_MY_CLIENT_NET +# is the IP address of our client net. If the client +# is just the host, this will be the host's own IP +# address. +# +# PLUTO_MY_CLIENT_MASK +# is the mask for our client net. If the client is +# just the host, this will be 255.255.255.255. +# +# PLUTO_MY_SOURCEIP +# if non-empty, then the source address for the route will be +# set to this IP address. +# +# PLUTO_MY_PROTOCOL +# is the IP protocol that will be transported. +# +# PLUTO_MY_PORT +# is the UDP/TCP port to which the IPsec SA is +# restricted on our side. +# +# PLUTO_PEER +# is the IP address of our peer. +# +# PLUTO_PEER_ID +# is the ID of our peer. +# +# PLUTO_PEER_CA +# is the CA which issued the cert of our peer. +# +# PLUTO_PEER_CLIENT +# is the IP address / count of the peer's client sub- +# net. If the client is just the peer, this will be +# the peer's own IP address / max (where max is 32 +# for IPv4 and 128 for IPv6). +# +# PLUTO_PEER_CLIENT_NET +# is the IP address of the peer's client net. If the +# client is just the peer, this will be the peer's +# own IP address. +# +# PLUTO_PEER_CLIENT_MASK +# is the mask for the peer's client net. If the +# client is just the peer, this will be +# 255.255.255.255. +# +# PLUTO_PEER_PROTOCOL +# is the IP protocol that will be transported. +# +# PLUTO_PEER_PORT +# is the UDP/TCP port to which the IPsec SA is +# restricted on the peer side. +# + +# define a minimum PATH environment in case it is not set +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin" +export PATH + +# resolve octal escape sequences +PLUTO_MY_ID=`printf "$PLUTO_MY_ID"` +PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"` + +case "$PLUTO_VERB:$1" in +up-host:) + # connection to me coming up + # If you are doing a custom version, firewall commands go here. + ;; +down-host:) + # connection to me going down + # If you are doing a custom version, firewall commands go here. + ;; +up-client:) + # connection to my client subnet coming up + # If you are doing a custom version, firewall commands go here. + iptables -A FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j ACCEPT + iptables -A FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \ + -s $PLUTO_PEER_CLIENT -j ACCEPT + iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP + echo "inserted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2 + ;; +down-client:) + # connection to my client subnet going down + # If you are doing a custom version, firewall commands go here. + iptables -D FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j ACCEPT + iptables -D FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \ + -s $PLUTO_PEER_CLIENT -j ACCEPT + iptables -t nat -D POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \ + -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP + echo "deleted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2 + ;; +*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2 + exit 1 + ;; +esac diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..8e685c862 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf @@ -0,0 +1,6 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown + multiple_authentication = no +} diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf new file mode 100644 index 000000000..ff030b5b5 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev1 + mobike=no + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsourceip=10.4.0.0/24 + auto=add diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf new file mode 100644 index 000000000..8e685c862 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf @@ -0,0 +1,6 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown + multiple_authentication = no +} diff --git a/testing/tests/ikev1/nat-virtual-ip/posttest.dat b/testing/tests/ikev1/nat-virtual-ip/posttest.dat new file mode 100644 index 000000000..11bd19da7 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +sun::ipsec stop +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::conntrack -F +moon::rm /etc/nat_updown diff --git a/testing/tests/ikev1/nat-virtual-ip/pretest.dat b/testing/tests/ikev1/nat-virtual-ip/pretest.dat new file mode 100644 index 000000000..eb0c28c7f --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/pretest.dat @@ -0,0 +1,8 @@ +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules +moon::conntrack -F +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up net-net +moon::sleep 1 diff --git a/testing/tests/ikev1/nat-virtual-ip/test.conf b/testing/tests/ikev1/nat-virtual-ip/test.conf new file mode 100644 index 000000000..f46f137b4 --- /dev/null +++ b/testing/tests/ikev1/nat-virtual-ip/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun bob" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/net2net-cert/evaltest.dat b/testing/tests/ikev1/net2net-cert/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev1/net2net-cert/evaltest.dat +++ b/testing/tests/ikev1/net2net-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/net2net-cert/posttest.dat b/testing/tests/ikev1/net2net-cert/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev1/net2net-cert/posttest.dat +++ b/testing/tests/ikev1/net2net-cert/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/net2net-cert/pretest.dat b/testing/tests/ikev1/net2net-cert/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev1/net2net-cert/pretest.dat +++ b/testing/tests/ikev1/net2net-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev1/net2net-cert/test.conf b/testing/tests/ikev1/net2net-cert/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev1/net2net-cert/test.conf +++ b/testing/tests/ikev1/net2net-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/net2net-psk-fail/posttest.dat b/testing/tests/ikev1/net2net-psk-fail/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/net2net-psk-fail/posttest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/net2net-psk-fail/pretest.dat b/testing/tests/ikev1/net2net-psk-fail/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev1/net2net-psk-fail/pretest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev1/net2net-psk-fail/test.conf b/testing/tests/ikev1/net2net-psk-fail/test.conf index f6e064e7d..eb4822b5d 100644 --- a/testing/tests/ikev1/net2net-psk-fail/test.conf +++ b/testing/tests/ikev1/net2net-psk-fail/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/net2net-psk/evaltest.dat b/testing/tests/ikev1/net2net-psk/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev1/net2net-psk/evaltest.dat +++ b/testing/tests/ikev1/net2net-psk/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/net2net-psk/posttest.dat b/testing/tests/ikev1/net2net-psk/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev1/net2net-psk/posttest.dat +++ b/testing/tests/ikev1/net2net-psk/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/net2net-psk/pretest.dat b/testing/tests/ikev1/net2net-psk/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev1/net2net-psk/pretest.dat +++ b/testing/tests/ikev1/net2net-psk/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev1/net2net-psk/test.conf b/testing/tests/ikev1/net2net-psk/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev1/net2net-psk/test.conf +++ b/testing/tests/ikev1/net2net-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev1/protoport-dual/evaltest.dat b/testing/tests/ikev1/protoport-dual/evaltest.dat index a65460cc8..cf45f3b52 100644 --- a/testing/tests/ikev1/protoport-dual/evaltest.dat +++ b/testing/tests/ikev1/protoport-dual/evaltest.dat @@ -2,8 +2,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/protoport-dual/posttest.dat b/testing/tests/ikev1/protoport-dual/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev1/protoport-dual/posttest.dat +++ b/testing/tests/ikev1/protoport-dual/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/protoport-dual/pretest.dat b/testing/tests/ikev1/protoport-dual/pretest.dat index d3d0061c3..efb2e5712 100644 --- a/testing/tests/ikev1/protoport-dual/pretest.dat +++ b/testing/tests/ikev1/protoport-dual/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev1/protoport-dual/test.conf b/testing/tests/ikev1/protoport-dual/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev1/protoport-dual/test.conf +++ b/testing/tests/ikev1/protoport-dual/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat b/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat +++ b/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-cert-aggressive/posttest.dat b/testing/tests/ikev1/rw-cert-aggressive/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/posttest.dat +++ b/testing/tests/ikev1/rw-cert-aggressive/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-cert-aggressive/pretest.dat b/testing/tests/ikev1/rw-cert-aggressive/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/pretest.dat +++ b/testing/tests/ikev1/rw-cert-aggressive/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/rw-cert-aggressive/test.conf b/testing/tests/ikev1/rw-cert-aggressive/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-cert-aggressive/test.conf +++ b/testing/tests/ikev1/rw-cert-aggressive/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-cert-unity/evaltest.dat b/testing/tests/ikev1/rw-cert-unity/evaltest.dat index b6a860b86..c183f48e9 100644 --- a/testing/tests/ikev1/rw-cert-unity/evaltest.dat +++ b/testing/tests/ikev1/rw-cert-unity/evaltest.dat @@ -3,6 +3,6 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::10.2.1.1/32 === 192.168.0.0/24 PASS::YES carol::ipsec status 2> /dev/null::home.*10.2.1.1/32 === 10.1.0.0/16 10.2.1.0/24::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 10.2.1.0/24 === 10.2.1.1/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-cert-unity/test.conf b/testing/tests/ikev1/rw-cert-unity/test.conf index 25cff970f..09e6f6cdb 100644 --- a/testing/tests/ikev1/rw-cert-unity/test.conf +++ b/testing/tests/ikev1/rw-cert-unity/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev1/rw-cert/evaltest.dat b/testing/tests/ikev1/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/ikev1/rw-cert/evaltest.dat +++ b/testing/tests/ikev1/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-cert/posttest.dat b/testing/tests/ikev1/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-cert/posttest.dat +++ b/testing/tests/ikev1/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-cert/pretest.dat b/testing/tests/ikev1/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev1/rw-cert/pretest.dat +++ b/testing/tests/ikev1/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/rw-cert/test.conf b/testing/tests/ikev1/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-cert/test.conf +++ b/testing/tests/ikev1/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat b/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-psk-aggressive/posttest.dat b/testing/tests/ikev1/rw-psk-aggressive/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/posttest.dat +++ b/testing/tests/ikev1/rw-psk-aggressive/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-psk-aggressive/pretest.dat b/testing/tests/ikev1/rw-psk-aggressive/pretest.dat index 761abe274..44f41f995 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/pretest.dat +++ b/testing/tests/ikev1/rw-psk-aggressive/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/rw-psk-aggressive/test.conf b/testing/tests/ikev1/rw-psk-aggressive/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-psk-aggressive/test.conf +++ b/testing/tests/ikev1/rw-psk-aggressive/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat index ef964a234..77f548848 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-psk-fqdn/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat index 761abe274..44f41f995 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/pretest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/rw-psk-fqdn/test.conf b/testing/tests/ikev1/rw-psk-fqdn/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-psk-fqdn/test.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat index d56c5220f..df37719e9 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/rw-psk-ipv4/pretest.dat b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat index 761abe274..44f41f995 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/pretest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/rw-psk-ipv4/test.conf b/testing/tests/ikev1/rw-psk-ipv4/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/rw-psk-ipv4/test.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/virtual-ip/evaltest.dat b/testing/tests/ikev1/virtual-ip/evaltest.dat index dd3143ae7..0f5df71d7 100644 --- a/testing/tests/ikev1/virtual-ip/evaltest.dat +++ b/testing/tests/ikev1/virtual-ip/evaltest.dat @@ -14,12 +14,12 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::src PH_IP_CAROL1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::src PH_IP_DAVE1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/virtual-ip/posttest.dat b/testing/tests/ikev1/virtual-ip/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/virtual-ip/posttest.dat +++ b/testing/tests/ikev1/virtual-ip/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/virtual-ip/pretest.dat b/testing/tests/ikev1/virtual-ip/pretest.dat index 5ec37aae1..1765a83cd 100644 --- a/testing/tests/ikev1/virtual-ip/pretest.dat +++ b/testing/tests/ikev1/virtual-ip/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev1/virtual-ip/test.conf b/testing/tests/ikev1/virtual-ip/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev1/virtual-ip/test.conf +++ b/testing/tests/ikev1/virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat b/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat index 02ed911ba..cd4ebd8ec 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer.*carol::YE moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.2 to peer.*dave::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-psk-config/posttest.dat b/testing/tests/ikev1/xauth-id-psk-config/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/posttest.dat +++ b/testing/tests/ikev1/xauth-id-psk-config/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-psk-config/pretest.dat b/testing/tests/ikev1/xauth-id-psk-config/pretest.dat index 95a6be131..88a91ae86 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/pretest.dat +++ b/testing/tests/ikev1/xauth-id-psk-config/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/xauth-id-psk-config/test.conf b/testing/tests/ikev1/xauth-id-psk-config/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/ikev1/xauth-id-psk-config/test.conf +++ b/testing/tests/ikev1/xauth-id-psk-config/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat index 5b021a09a..34c124c95 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf b/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf +++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat index 198dd3782..7604a1527 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer.*carol::YE moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.2 to peer.*dave::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-id-rsa-config/test.conf b/testing/tests/ikev1/xauth-id-rsa-config/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-id-rsa-config/test.conf +++ b/testing/tests/ikev1/xauth-id-rsa-config/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat index 5b021a09a..34c124c95 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf b/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf +++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-psk/evaltest.dat b/testing/tests/ikev1/xauth-psk/evaltest.dat index 988a6c541..c6637cbfe 100644 --- a/testing/tests/ikev1/xauth-psk/evaltest.dat +++ b/testing/tests/ikev1/xauth-psk/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol@strongswan.org.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave@strongswan.org.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-psk/posttest.dat b/testing/tests/ikev1/xauth-psk/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-psk/posttest.dat +++ b/testing/tests/ikev1/xauth-psk/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-psk/pretest.dat b/testing/tests/ikev1/xauth-psk/pretest.dat index 95a6be131..88a91ae86 100644 --- a/testing/tests/ikev1/xauth-psk/pretest.dat +++ b/testing/tests/ikev1/xauth-psk/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev1/xauth-psk/test.conf b/testing/tests/ikev1/xauth-psk/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-psk/test.conf +++ b/testing/tests/ikev1/xauth-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat index 0591e22b6..d568273d1 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat @@ -5,6 +5,6 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/users index 4fb07b912..4fb07b912 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf +++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev1/xauth-rsa/evaltest.dat b/testing/tests/ikev1/xauth-rsa/evaltest.dat index 988a6c541..c6637cbfe 100644 --- a/testing/tests/ikev1/xauth-rsa/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*carol@strongswan.org.*successful::YES moon:: cat /var/log/daemon.log::XAuth authentication of.*dave@strongswan.org.*successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/xauth-rsa/posttest.dat b/testing/tests/ikev1/xauth-rsa/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev1/xauth-rsa/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev1/xauth-rsa/pretest.dat b/testing/tests/ikev1/xauth-rsa/pretest.dat index 78e2d57f8..e5a06d44c 100644 --- a/testing/tests/ikev1/xauth-rsa/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev1/xauth-rsa/test.conf b/testing/tests/ikev1/xauth-rsa/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev1/xauth-rsa/test.conf +++ b/testing/tests/ikev1/xauth-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/after-2038-certs/evaltest.dat b/testing/tests/ikev2/after-2038-certs/evaltest.dat index 3efaa5a98..427aa74da 100644 --- a/testing/tests/ikev2/after-2038-certs/evaltest.dat +++ b/testing/tests/ikev2/after-2038-certs/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/after-2038-certs/posttest.dat b/testing/tests/ikev2/after-2038-certs/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/after-2038-certs/posttest.dat +++ b/testing/tests/ikev2/after-2038-certs/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/after-2038-certs/pretest.dat b/testing/tests/ikev2/after-2038-certs/pretest.dat index 4921d5097..baacc1605 100644 --- a/testing/tests/ikev2/after-2038-certs/pretest.dat +++ b/testing/tests/ikev2/after-2038-certs/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/after-2038-certs/test.conf b/testing/tests/ikev2/after-2038-certs/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/after-2038-certs/test.conf +++ b/testing/tests/ikev2/after-2038-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-3des-md5/evaltest.dat b/testing/tests/ikev2/alg-3des-md5/evaltest.dat index a553ff168..abd29e97e 100644 --- a/testing/tests/ikev2/alg-3des-md5/evaltest.dat +++ b/testing/tests/ikev2/alg-3des-md5/evaltest.dat @@ -4,12 +4,12 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED::YES carol::ipsec status 2> /dev/null::home.*INSTALLED::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*3DES_CBC/HMAC_MD5_96,::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_MD5_96,::YES moon:: ip xfrm state::enc cbc(des3_ede)::YES carol::ip xfrm state::enc cbc(des3_ede)::YES -moon:: ip xfrm state::auth hmac(md5)::YES -carol::ip xfrm state::auth hmac(md5)::YES +moon:: ip xfrm state::auth-trunc hmac(md5)::YES +carol::ip xfrm state::auth-trunc hmac(md5)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES diff --git a/testing/tests/ikev2/alg-3des-md5/posttest.dat b/testing/tests/ikev2/alg-3des-md5/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-3des-md5/posttest.dat +++ b/testing/tests/ikev2/alg-3des-md5/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-3des-md5/pretest.dat b/testing/tests/ikev2/alg-3des-md5/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-3des-md5/pretest.dat +++ b/testing/tests/ikev2/alg-3des-md5/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-3des-md5/test.conf b/testing/tests/ikev2/alg-3des-md5/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-3des-md5/test.conf +++ b/testing/tests/ikev2/alg-3des-md5/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-ccm/evaltest.dat b/testing/tests/ikev2/alg-aes-ccm/evaltest.dat index e2cf773ea..5a14b98d6 100644 --- a/testing/tests/ikev2/alg-aes-ccm/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-ccm/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES moon:: ipsec statusall 2> /dev/null::AES_CCM_12_128,::YES diff --git a/testing/tests/ikev2/alg-aes-ccm/posttest.dat b/testing/tests/ikev2/alg-aes-ccm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-ccm/posttest.dat +++ b/testing/tests/ikev2/alg-aes-ccm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-ccm/pretest.dat b/testing/tests/ikev2/alg-aes-ccm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-ccm/pretest.dat +++ b/testing/tests/ikev2/alg-aes-ccm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-ccm/test.conf b/testing/tests/ikev2/alg-aes-ccm/test.conf index acb73b06f..11423f723 100644 --- a/testing/tests/ikev2/alg-aes-ccm/test.conf +++ b/testing/tests/ikev2/alg-aes-ccm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-ctr/evaltest.dat b/testing/tests/ikev2/alg-aes-ctr/evaltest.dat index 177e0ea62..6a5203a2d 100644 --- a/testing/tests/ikev2/alg-aes-ctr/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-ctr/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES moon:: ipsec statusall 2> /dev/null::AES_CTR_128/AES_XCBC_96,::YES diff --git a/testing/tests/ikev2/alg-aes-ctr/posttest.dat b/testing/tests/ikev2/alg-aes-ctr/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-ctr/posttest.dat +++ b/testing/tests/ikev2/alg-aes-ctr/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-ctr/pretest.dat b/testing/tests/ikev2/alg-aes-ctr/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-ctr/pretest.dat +++ b/testing/tests/ikev2/alg-aes-ctr/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-ctr/test.conf b/testing/tests/ikev2/alg-aes-ctr/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-aes-ctr/test.conf +++ b/testing/tests/ikev2/alg-aes-ctr/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-gcm/evaltest.dat b/testing/tests/ikev2/alg-aes-gcm/evaltest.dat index 39f8b1cc4..ce27fcc05 100644 --- a/testing/tests/ikev2/alg-aes-gcm/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-gcm/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES carol::ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES moon:: ipsec statusall 2> /dev/null::AES_GCM_16_256,::YES diff --git a/testing/tests/ikev2/alg-aes-gcm/posttest.dat b/testing/tests/ikev2/alg-aes-gcm/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-gcm/posttest.dat +++ b/testing/tests/ikev2/alg-aes-gcm/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-gcm/pretest.dat b/testing/tests/ikev2/alg-aes-gcm/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-gcm/pretest.dat +++ b/testing/tests/ikev2/alg-aes-gcm/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-gcm/test.conf b/testing/tests/ikev2/alg-aes-gcm/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-aes-gcm/test.conf +++ b/testing/tests/ikev2/alg-aes-gcm/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat index 7a9874528..f11018347 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat +++ b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat @@ -4,11 +4,11 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES -moon:: ip xfrm state::auth xcbc(aes)::YES -carol::ip xfrm state::auth xcbc(aes)::YES +moon:: ip xfrm state::auth-trunc xcbc(aes)::YES +carol::ip xfrm state::auth-trunc xcbc(aes)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/ikev2/alg-aes-xcbc/posttest.dat b/testing/tests/ikev2/alg-aes-xcbc/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/posttest.dat +++ b/testing/tests/ikev2/alg-aes-xcbc/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-aes-xcbc/pretest.dat b/testing/tests/ikev2/alg-aes-xcbc/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/pretest.dat +++ b/testing/tests/ikev2/alg-aes-xcbc/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-aes-xcbc/test.conf b/testing/tests/ikev2/alg-aes-xcbc/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-aes-xcbc/test.conf +++ b/testing/tests/ikev2/alg-aes-xcbc/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-blowfish/evaltest.dat b/testing/tests/ikev2/alg-blowfish/evaltest.dat index a458f0241..f76522c5c 100644 --- a/testing/tests/ikev2/alg-blowfish/evaltest.dat +++ b/testing/tests/ikev2/alg-blowfish/evaltest.dat @@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_256_128,::YES dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA1_96,::YES carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES diff --git a/testing/tests/ikev2/alg-blowfish/posttest.dat b/testing/tests/ikev2/alg-blowfish/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/alg-blowfish/posttest.dat +++ b/testing/tests/ikev2/alg-blowfish/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-blowfish/pretest.dat b/testing/tests/ikev2/alg-blowfish/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/alg-blowfish/pretest.dat +++ b/testing/tests/ikev2/alg-blowfish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/alg-blowfish/test.conf b/testing/tests/ikev2/alg-blowfish/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/alg-blowfish/test.conf +++ b/testing/tests/ikev2/alg-blowfish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat b/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat index 0acd6d2ce..5e4ab98b3 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat +++ b/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat @@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::DH group MODP_2048_224.*MODP_1024_160::YES dave:: cat /var/log/daemon.log::DH group MODP_2048_224.*MODP_2048_256::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024_160::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/alg-modp-subgroup/posttest.dat b/testing/tests/ikev2/alg-modp-subgroup/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/posttest.dat +++ b/testing/tests/ikev2/alg-modp-subgroup/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-modp-subgroup/pretest.dat b/testing/tests/ikev2/alg-modp-subgroup/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/pretest.dat +++ b/testing/tests/ikev2/alg-modp-subgroup/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/alg-modp-subgroup/test.conf b/testing/tests/ikev2/alg-modp-subgroup/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/alg-modp-subgroup/test.conf +++ b/testing/tests/ikev2/alg-modp-subgroup/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/alg-sha256-96/evaltest.dat b/testing/tests/ikev2/alg-sha256-96/evaltest.dat index 4bbc82d9b..6c4e23710 100644 --- a/testing/tests/ikev2/alg-sha256-96/evaltest.dat +++ b/testing/tests/ikev2/alg-sha256-96/evaltest.dat @@ -6,10 +6,10 @@ moon:: cat /var/log/daemon.log::received strongSwan vendor ID::YES carol::cat /var/log/daemon.log::received strongSwan vendor ID::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_96,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_96,::YES -moon:: ip xfrm state::auth hmac(sha256)::YES -carol::ip xfrm state::auth hmac(sha256)::YES +moon:: ip xfrm state::auth-trunc hmac(sha256)::YES +carol::ip xfrm state::auth-trunc hmac(sha256)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/ikev2/alg-sha256-96/posttest.dat b/testing/tests/ikev2/alg-sha256-96/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha256-96/posttest.dat +++ b/testing/tests/ikev2/alg-sha256-96/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha256-96/pretest.dat b/testing/tests/ikev2/alg-sha256-96/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha256-96/pretest.dat +++ b/testing/tests/ikev2/alg-sha256-96/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha256-96/test.conf b/testing/tests/ikev2/alg-sha256-96/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha256-96/test.conf +++ b/testing/tests/ikev2/alg-sha256-96/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-sha256/evaltest.dat b/testing/tests/ikev2/alg-sha256/evaltest.dat index 7b5640af8..eba856742 100644 --- a/testing/tests/ikev2/alg-sha256/evaltest.dat +++ b/testing/tests/ikev2/alg-sha256/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES -moon:: ip xfrm state::auth hmac(sha256)::YES -carol::ip xfrm state::auth hmac(sha256)::YES +moon:: ip xfrm state::auth-trunc hmac(sha256)::YES +carol::ip xfrm state::auth-trunc hmac(sha256)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 200::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 200::YES diff --git a/testing/tests/ikev2/alg-sha256/posttest.dat b/testing/tests/ikev2/alg-sha256/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha256/posttest.dat +++ b/testing/tests/ikev2/alg-sha256/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha256/pretest.dat b/testing/tests/ikev2/alg-sha256/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha256/pretest.dat +++ b/testing/tests/ikev2/alg-sha256/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha256/test.conf b/testing/tests/ikev2/alg-sha256/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha256/test.conf +++ b/testing/tests/ikev2/alg-sha256/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-sha384/evaltest.dat b/testing/tests/ikev2/alg-sha384/evaltest.dat index 21b3d5a4f..3b24217c5 100644 --- a/testing/tests/ikev2/alg-sha384/evaltest.dat +++ b/testing/tests/ikev2/alg-sha384/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES -moon:: ip xfrm state::auth hmac(sha384)::YES -carol::ip xfrm state::auth hmac(sha384)::YES +moon:: ip xfrm state::auth-trunc hmac(sha384)::YES +carol::ip xfrm state::auth-trunc hmac(sha384)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/ikev2/alg-sha384/posttest.dat b/testing/tests/ikev2/alg-sha384/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha384/posttest.dat +++ b/testing/tests/ikev2/alg-sha384/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha384/pretest.dat b/testing/tests/ikev2/alg-sha384/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha384/pretest.dat +++ b/testing/tests/ikev2/alg-sha384/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha384/test.conf b/testing/tests/ikev2/alg-sha384/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha384/test.conf +++ b/testing/tests/ikev2/alg-sha384/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/alg-sha512/evaltest.dat b/testing/tests/ikev2/alg-sha512/evaltest.dat index 7b94d2182..6bdceeb44 100644 --- a/testing/tests/ikev2/alg-sha512/evaltest.dat +++ b/testing/tests/ikev2/alg-sha512/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES -moon:: ip xfrm state::auth hmac(sha512)::YES -carol::ip xfrm state::auth hmac(sha512)::YES +moon:: ip xfrm state::auth-trunc hmac(sha512)::YES +carol::ip xfrm state::auth-trunc hmac(sha512)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES diff --git a/testing/tests/ikev2/alg-sha512/posttest.dat b/testing/tests/ikev2/alg-sha512/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/alg-sha512/posttest.dat +++ b/testing/tests/ikev2/alg-sha512/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/alg-sha512/pretest.dat b/testing/tests/ikev2/alg-sha512/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/alg-sha512/pretest.dat +++ b/testing/tests/ikev2/alg-sha512/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/alg-sha512/test.conf b/testing/tests/ikev2/alg-sha512/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/alg-sha512/test.conf +++ b/testing/tests/ikev2/alg-sha512/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/any-interface/pretest.dat b/testing/tests/ikev2/any-interface/pretest.dat index b8e91194e..0a6ce8be4 100644 --- a/testing/tests/ikev2/any-interface/pretest.dat +++ b/testing/tests/ikev2/any-interface/pretest.dat @@ -1,5 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON winnetou::ip route add 10.2.0.0/16 via PH_IP_SUN alice::ipsec start diff --git a/testing/tests/ikev2/any-interface/test.conf b/testing/tests/ikev2/any-interface/test.conf index 25e5cd872..cc04d45e6 100644 --- a/testing/tests/ikev2/any-interface/test.conf +++ b/testing/tests/ikev2/any-interface/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice sun bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon sun bob" diff --git a/testing/tests/ikev2/compress/pretest.dat b/testing/tests/ikev2/compress/pretest.dat index 7d077c126..f5aa989fe 100644 --- a/testing/tests/ikev2/compress/pretest.dat +++ b/testing/tests/ikev2/compress/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/compress/test.conf b/testing/tests/ikev2/compress/test.conf index 6abbb89a9..d7b71426c 100644 --- a/testing/tests/ikev2/compress/test.conf +++ b/testing/tests/ikev2/compress/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/config-payload-swapped/evaltest.dat b/testing/tests/ikev2/config-payload-swapped/evaltest.dat index 3c41a596c..b6a1c96a6 100644 --- a/testing/tests/ikev2/config-payload-swapped/evaltest.dat +++ b/testing/tests/ikev2/config-payload-swapped/evaltest.dat @@ -3,13 +3,13 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES diff --git a/testing/tests/ikev2/config-payload-swapped/posttest.dat b/testing/tests/ikev2/config-payload-swapped/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/config-payload-swapped/posttest.dat +++ b/testing/tests/ikev2/config-payload-swapped/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/config-payload-swapped/pretest.dat b/testing/tests/ikev2/config-payload-swapped/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev2/config-payload-swapped/pretest.dat +++ b/testing/tests/ikev2/config-payload-swapped/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/config-payload-swapped/test.conf b/testing/tests/ikev2/config-payload-swapped/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/config-payload-swapped/test.conf +++ b/testing/tests/ikev2/config-payload-swapped/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/config-payload/evaltest.dat b/testing/tests/ikev2/config-payload/evaltest.dat index a429e9b32..b46dfddf6 100644 --- a/testing/tests/ikev2/config-payload/evaltest.dat +++ b/testing/tests/ikev2/config-payload/evaltest.dat @@ -5,13 +5,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::cat /etc/resolv.conf::nameserver PH_IP_WINNETOU .*from moon.strongswan.org::YES carol::cat /etc/resolv.conf::nameserver PH_IP_VENUS .*from moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES diff --git a/testing/tests/ikev2/config-payload/posttest.dat b/testing/tests/ikev2/config-payload/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/config-payload/posttest.dat +++ b/testing/tests/ikev2/config-payload/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/config-payload/pretest.dat b/testing/tests/ikev2/config-payload/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev2/config-payload/pretest.dat +++ b/testing/tests/ikev2/config-payload/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/config-payload/test.conf b/testing/tests/ikev2/config-payload/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/config-payload/test.conf +++ b/testing/tests/ikev2/config-payload/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/critical-extension/posttest.dat b/testing/tests/ikev2/critical-extension/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/critical-extension/posttest.dat +++ b/testing/tests/ikev2/critical-extension/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/critical-extension/pretest.dat b/testing/tests/ikev2/critical-extension/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/critical-extension/pretest.dat +++ b/testing/tests/ikev2/critical-extension/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/critical-extension/test.conf b/testing/tests/ikev2/critical-extension/test.conf index 41ee3037e..b286ef6eb 100644 --- a/testing/tests/ikev2/critical-extension/test.conf +++ b/testing/tests/ikev2/critical-extension/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/crl-from-cache/test.conf b/testing/tests/ikev2/crl-from-cache/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-from-cache/test.conf +++ b/testing/tests/ikev2/crl-from-cache/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 999d0d183..000000000 --- a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ldap crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..debcc2181 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow ldap crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 4f4f3228b..000000000 --- a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ldap crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..debcc2181 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow ldap crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/crl-ldap/posttest.dat b/testing/tests/ikev2/crl-ldap/posttest.dat index bddd87424..8474bd3aa 100644 --- a/testing/tests/ikev2/crl-ldap/posttest.dat +++ b/testing/tests/ikev2/crl-ldap/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop winnetou::/etc/init.d/slapd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/crls/* carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ikev2/crl-ldap/pretest.dat b/testing/tests/ikev2/crl-ldap/pretest.dat index 64fa8116b..8ffa9d3ed 100644 --- a/testing/tests/ikev2/crl-ldap/pretest.dat +++ b/testing/tests/ikev2/crl-ldap/pretest.dat @@ -1,6 +1,6 @@ winnetou::/etc/init.d/slapd start -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/crl-ldap/test.conf b/testing/tests/ikev2/crl-ldap/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-ldap/test.conf +++ b/testing/tests/ikev2/crl-ldap/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-revoked/test.conf b/testing/tests/ikev2/crl-revoked/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-revoked/test.conf +++ b/testing/tests/ikev2/crl-revoked/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-to-cache/test.conf b/testing/tests/ikev2/crl-to-cache/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/crl-to-cache/test.conf +++ b/testing/tests/ikev2/crl-to-cache/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/default-keys/description.txt b/testing/tests/ikev2/default-keys/description.txt index 639e909da..889f8297a 100644 --- a/testing/tests/ikev2/default-keys/description.txt +++ b/testing/tests/ikev2/default-keys/description.txt @@ -1,8 +1,8 @@ Because of the missing <b>/etc/ipsec.secrets</b> file, roadwarrior <b>carol</b> and gateway <b>moon</b> each automatically generate a PKCS#1 RSA private key -and a self-signed X.509 certificate. Because the UML testing environment does -not offer enough entropy, the non-blocking /dev/urandom device is used in place -of /dev/random for generating the random primes. +and a self-signed X.509 certificate. Because the virtual testing environment +does not offer enough entropy, the non-blocking /dev/urandom device is used in +place of /dev/random for generating the random primes. <p> The self-signed certificates are then distributed to the peers via scp and are used to set up a road warrior connection initiated by <b>carol</b> diff --git a/testing/tests/ikev2/default-keys/evaltest.dat b/testing/tests/ikev2/default-keys/evaltest.dat index 1c206fff0..4df2d1e11 100644 --- a/testing/tests/ikev2/default-keys/evaltest.dat +++ b/testing/tests/ikev2/default-keys/evaltest.dat @@ -4,6 +4,6 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*CN=carol.*CN=moon::YES moon:: ipsec status 2> /dev/null::carol.*ESTABLISHED.*CN=moon.*CN=carol::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 5a262c084..000000000 --- a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,82 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A INPUT -p tcp --sport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..72a1c17c3 --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules @@ -0,0 +1,30 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --sport 22 -j ACCEPT +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT +-A OUTPUT -p tcp --dport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/default-keys/posttest.dat b/testing/tests/ikev2/default-keys/posttest.dat index 8cada5e7e..25f737ecc 100644 --- a/testing/tests/ikev2/default-keys/posttest.dat +++ b/testing/tests/ikev2/default-keys/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/default-keys/pretest.dat b/testing/tests/ikev2/default-keys/pretest.dat index 88f9a2ca9..ef5f67097 100644 --- a/testing/tests/ikev2/default-keys/pretest.dat +++ b/testing/tests/ikev2/default-keys/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules carol::rm /etc/ipsec.secrets carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* @@ -10,9 +10,10 @@ moon::rm /etc/ipsec.d/private/* moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/cacerts/* moon::ipsec start -moon::sleep 5 +moon::sleep 5 moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der -moon::ipsec reload -carol::ipsec reload +moon::ipsec reload +carol::ipsec reload +carol::sleep 1 carol::ipsec up home diff --git a/testing/tests/ikev2/default-keys/test.conf b/testing/tests/ikev2/default-keys/test.conf index 0baa48d90..ce84ce41a 100644 --- a/testing/tests/ikev2/default-keys/test.conf +++ b/testing/tests/ikev2/default-keys/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol" +VIRTHOSTS="alice moon carol" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dhcp-dynamic/evaltest.dat b/testing/tests/ikev2/dhcp-dynamic/evaltest.dat index 4b0ddace7..9e536870e 100644 --- a/testing/tests/ikev2/dhcp-dynamic/evaltest.dat +++ b/testing/tests/ikev2/dhcp-dynamic/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.50/32::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol3.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol3.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave3.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave3.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave3.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 058bebb2d..000000000 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow bootpc and bootps - iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT - iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT - - # allow broadcasts from eth1 - iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - iptables -A INPUT -j LOG --log-prefix " IN: " - iptables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..2d9a466b0 --- /dev/null +++ b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow bootpc and bootps +-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT +-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT + +# allow broadcasts from eth1 +-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf index 2176af702..7a178505f 100644 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf +++ b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf @@ -4,11 +4,11 @@ ddns-update-style none; subnet 10.1.0.0 netmask 255.255.0.0 { option domain-name "strongswan.org"; - option domain-name-servers 10.1.0.20; - option netbios-name-servers 10.1.0.10; - option routers 10.1.0.1; + option domain-name-servers PH_IP_VENUS; + option netbios-name-servers PH_IP_ALICE; + option routers PH_IP_MOON1; option broadcast-address 10.1.255.255; - next-server 10.1.0.20; + next-server PH_IP_VENUS; range 10.1.0.50 10.1.0.60; } diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf index 2d35dfd64..ec8c945a7 100644 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf +++ b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf @@ -1,7 +1,7 @@ interface=eth0 dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255 -dhcp-option=option:router,10.1.0.1 -dhcp-option=option:dns-server,10.1.0.20 -dhcp-option=option:netbios-ns,10.1.0.10 +dhcp-option=option:router,PH_IP_MOON1 +dhcp-option=option:dns-server,PH_IP_VENUS +dhcp-option=option:netbios-ns,PH_IP_ALICE dhcp-option=option:domain-name,strongswan.org log-dhcp diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd deleted file mode 100755 index 4044dcc35..000000000 --- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd +++ /dev/null @@ -1,24 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop" - -depend() { - need net - need logger -} - -start() { - ebegin "Starting DHCP server" - start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd - eend $? -} - -stop() { - ebegin "Stopping DHCP server" - start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid - rm -f /var/state/dhcp/dhcpd.leases - touch /var/state/dhcp/dhcpd.leases - eend $? -} diff --git a/testing/tests/ikev2/dhcp-dynamic/posttest.dat b/testing/tests/ikev2/dhcp-dynamic/posttest.dat index 1f5487596..f783127bf 100644 --- a/testing/tests/ikev2/dhcp-dynamic/posttest.dat +++ b/testing/tests/ikev2/dhcp-dynamic/posttest.dat @@ -2,9 +2,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop venus::cat /var/state/dhcp/dhcpd.leases -venus::/etc/init.d/dhcpd stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush alice::arp -d 10.1.0.50 alice::arp -d 10.1.0.51 diff --git a/testing/tests/ikev2/dhcp-dynamic/pretest.dat b/testing/tests/ikev2/dhcp-dynamic/pretest.dat index bd36b4fe3..5670a2e89 100644 --- a/testing/tests/ikev2/dhcp-dynamic/pretest.dat +++ b/testing/tests/ikev2/dhcp-dynamic/pretest.dat @@ -1,12 +1,12 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -venus::cat /etc/dhcpd.conf -venus::/etc/init.d/dhcpd start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +venus::cat /etc/dhcp/dhcpd.conf +venus::/etc/init.d/isc-dhcp-server start 2> /dev/null carol::ipsec start dave::ipsec start moon::ipsec start -carol::sleep 2 +carol::sleep 2 carol::ipsec up home dave::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/dhcp-dynamic/test.conf b/testing/tests/ikev2/dhcp-dynamic/test.conf index a2ad7b25f..fd8a59c90 100644 --- a/testing/tests/ikev2/dhcp-dynamic/test.conf +++ b/testing/tests/ikev2/dhcp-dynamic/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat b/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat index 830094c7a..c95b69a11 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat +++ b/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 058bebb2d..000000000 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow bootpc and bootps - iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT - iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT - - # allow broadcasts from eth1 - iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - iptables -A INPUT -j LOG --log-prefix " IN: " - iptables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..2d9a466b0 --- /dev/null +++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow bootpc and bootps +-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT +-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT + +# allow broadcasts from eth1 +-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcp/dhcpd.conf index 44ee681b6..334ea30e2 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf +++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcp/dhcpd.conf @@ -4,11 +4,11 @@ ddns-update-style none; subnet 10.1.0.0 netmask 255.255.0.0 { option domain-name "strongswan.org"; - option domain-name-servers 10.1.0.20; - option netbios-name-servers 10.1.0.10; - option routers 10.1.0.1; + option domain-name-servers PH_IP_VENUS; + option netbios-name-servers PH_IP_ALICE; + option routers PH_IP_MOON1; option broadcast-address 10.1.255.255; - next-server 10.1.0.20; + next-server PH_IP_VENUS; range 10.1.0.50 10.1.0.60; } @@ -22,4 +22,3 @@ host dave { option dhcp-client-identifier "dave@strongswan.org"; fixed-address 10.1.0.40; } - diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf index 5672236a0..aca225955 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf +++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf @@ -2,8 +2,8 @@ interface=eth0 dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255 dhcp-host=id:carol@strongswan.org,10.1.0.30 dhcp-host=id:dave@strongswan.org,10.1.0.40 -dhcp-option=option:router,10.1.0.1 -dhcp-option=option:dns-server,10.1.0.20 -dhcp-option=option:netbios-ns,10.1.0.10 +dhcp-option=option:router,PH_IP_MOON1 +dhcp-option=option:dns-server,PH_IP_VENUS +dhcp-option=option:netbios-ns,PH_IP_ALICE dhcp-option=option:domain-name,strongswan.org log-dhcp diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd deleted file mode 100755 index 4044dcc35..000000000 --- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd +++ /dev/null @@ -1,24 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop" - -depend() { - need net - need logger -} - -start() { - ebegin "Starting DHCP server" - start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd - eend $? -} - -stop() { - ebegin "Stopping DHCP server" - start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid - rm -f /var/state/dhcp/dhcpd.leases - touch /var/state/dhcp/dhcpd.leases - eend $? -} diff --git a/testing/tests/ikev2/dhcp-static-client-id/posttest.dat b/testing/tests/ikev2/dhcp-static-client-id/posttest.dat index e1aadc618..7fff9981b 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/posttest.dat +++ b/testing/tests/ikev2/dhcp-static-client-id/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -venus::/etc/init.d/dhcpd stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush alice::arp -d 10.1.0.30 alice::arp -d 10.1.0.40 diff --git a/testing/tests/ikev2/dhcp-static-client-id/pretest.dat b/testing/tests/ikev2/dhcp-static-client-id/pretest.dat index bd36b4fe3..5670a2e89 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/pretest.dat +++ b/testing/tests/ikev2/dhcp-static-client-id/pretest.dat @@ -1,12 +1,12 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -venus::cat /etc/dhcpd.conf -venus::/etc/init.d/dhcpd start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +venus::cat /etc/dhcp/dhcpd.conf +venus::/etc/init.d/isc-dhcp-server start 2> /dev/null carol::ipsec start dave::ipsec start moon::ipsec start -carol::sleep 2 +carol::sleep 2 carol::ipsec up home dave::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/dhcp-static-client-id/test.conf b/testing/tests/ikev2/dhcp-static-client-id/test.conf index a2ad7b25f..fd8a59c90 100644 --- a/testing/tests/ikev2/dhcp-static-client-id/test.conf +++ b/testing/tests/ikev2/dhcp-static-client-id/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/dhcp-static-mac/evaltest.dat b/testing/tests/ikev2/dhcp-static-mac/evaltest.dat index 830094c7a..c95b69a11 100644 --- a/testing/tests/ikev2/dhcp-static-mac/evaltest.dat +++ b/testing/tests/ikev2/dhcp-static-mac/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 058bebb2d..000000000 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow bootpc and bootps - iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT - iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT - - # allow broadcasts from eth1 - iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - iptables -A INPUT -j LOG --log-prefix " IN: " - iptables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..2d9a466b0 --- /dev/null +++ b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules @@ -0,0 +1,39 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow bootpc and bootps +-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT +-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT + +# allow broadcasts from eth1 +-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcp/dhcpd.conf index 20666f701..cdade2f2e 100644 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcpd.conf +++ b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcp/dhcpd.conf @@ -4,11 +4,11 @@ ddns-update-style none; subnet 10.1.0.0 netmask 255.255.0.0 { option domain-name "strongswan.org"; - option domain-name-servers 10.1.0.20; - option netbios-name-servers 10.1.0.10; - option routers 10.1.0.1; + option domain-name-servers PH_IP_VENUS; + option netbios-name-servers PH_IP_ALICE; + option routers PH_IP_MOON1; option broadcast-address 10.1.255.255; - next-server 10.1.0.20; + next-server PH_IP_VENUS; range 10.1.0.50 10.1.0.60; } @@ -22,4 +22,3 @@ host dave { hardware ethernet 7a:a7:35:78:bc:85; fixed-address 10.1.0.40; } - diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf index e3729081f..61d31a0ba 100644 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf +++ b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf @@ -2,8 +2,8 @@ interface=eth0 dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255 dhcp-host=7a:a7:8f:fc:db:3b,10.1.0.30 dhcp-host=7a:a7:35:78:bc:85,10.1.0.40 -dhcp-option=option:router,10.1.0.1 -dhcp-option=option:dns-server,10.1.0.20 -dhcp-option=option:netbios-ns,10.1.0.10 +dhcp-option=option:router,PH_IP_MOON1 +dhcp-option=option:dns-server,PH_IP_VENUS +dhcp-option=option:netbios-ns,PH_IP_ALICE dhcp-option=option:domain-name,strongswan.org log-dhcp diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd deleted file mode 100755 index 4044dcc35..000000000 --- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd +++ /dev/null @@ -1,24 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop" - -depend() { - need net - need logger -} - -start() { - ebegin "Starting DHCP server" - start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd - eend $? -} - -stop() { - ebegin "Stopping DHCP server" - start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid - rm -f /var/state/dhcp/dhcpd.leases - touch /var/state/dhcp/dhcpd.leases - eend $? -} diff --git a/testing/tests/ikev2/dhcp-static-mac/posttest.dat b/testing/tests/ikev2/dhcp-static-mac/posttest.dat index e1aadc618..7fff9981b 100644 --- a/testing/tests/ikev2/dhcp-static-mac/posttest.dat +++ b/testing/tests/ikev2/dhcp-static-mac/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -venus::/etc/init.d/dhcpd stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush alice::arp -d 10.1.0.30 alice::arp -d 10.1.0.40 diff --git a/testing/tests/ikev2/dhcp-static-mac/pretest.dat b/testing/tests/ikev2/dhcp-static-mac/pretest.dat index bd36b4fe3..5670a2e89 100644 --- a/testing/tests/ikev2/dhcp-static-mac/pretest.dat +++ b/testing/tests/ikev2/dhcp-static-mac/pretest.dat @@ -1,12 +1,12 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -venus::cat /etc/dhcpd.conf -venus::/etc/init.d/dhcpd start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +venus::cat /etc/dhcp/dhcpd.conf +venus::/etc/init.d/isc-dhcp-server start 2> /dev/null carol::ipsec start dave::ipsec start moon::ipsec start -carol::sleep 2 +carol::sleep 2 carol::ipsec up home dave::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/dhcp-static-mac/test.conf b/testing/tests/ikev2/dhcp-static-mac/test.conf index a2ad7b25f..fd8a59c90 100644 --- a/testing/tests/ikev2/dhcp-static-mac/test.conf +++ b/testing/tests/ikev2/dhcp-static-mac/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/double-nat-net/evaltest.dat b/testing/tests/ikev2/double-nat-net/evaltest.dat index 05dc82d70..52c561964 100644 --- a/testing/tests/ikev2/double-nat-net/evaltest.dat +++ b/testing/tests/ikev2/double-nat-net/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/double-nat-net/posttest.dat b/testing/tests/ikev2/double-nat-net/posttest.dat index 484297418..63d4f98e7 100644 --- a/testing/tests/ikev2/double-nat-net/posttest.dat +++ b/testing/tests/ikev2/double-nat-net/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/double-nat-net/pretest.dat b/testing/tests/ikev2/double-nat-net/pretest.dat index 41b69aed6..17a4fe5eb 100644 --- a/testing/tests/ikev2/double-nat-net/pretest.dat +++ b/testing/tests/ikev2/double-nat-net/pretest.dat @@ -1,8 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -bob::echo 1 > /proc/sys/net/ipv4/ip_forward -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev2/double-nat-net/test.conf b/testing/tests/ikev2/double-nat-net/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev2/double-nat-net/test.conf +++ b/testing/tests/ikev2/double-nat-net/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/double-nat/evaltest.dat b/testing/tests/ikev2/double-nat/evaltest.dat index b080482f9..9ddad2de5 100644 --- a/testing/tests/ikev2/double-nat/evaltest.dat +++ b/testing/tests/ikev2/double-nat/evaltest.dat @@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@ bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules b/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/double-nat/posttest.dat b/testing/tests/ikev2/double-nat/posttest.dat index 5d39e406d..aa806bfc9 100644 --- a/testing/tests/ikev2/double-nat/posttest.dat +++ b/testing/tests/ikev2/double-nat/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/double-nat/pretest.dat b/testing/tests/ikev2/double-nat/pretest.dat index 10ba6d735..65f18b756 100644 --- a/testing/tests/ikev2/double-nat/pretest.dat +++ b/testing/tests/ikev2/double-nat/pretest.dat @@ -1,7 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward -sun::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 diff --git a/testing/tests/ikev2/double-nat/test.conf b/testing/tests/ikev2/double-nat/test.conf index 1ca2ffe5a..d2e31d257 100644 --- a/testing/tests/ikev2/double-nat/test.conf +++ b/testing/tests/ikev2/double-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/dpd-clear/test.conf b/testing/tests/ikev2/dpd-clear/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/dpd-clear/test.conf +++ b/testing/tests/ikev2/dpd-clear/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-hold/test.conf b/testing/tests/ikev2/dpd-hold/test.conf index 5442565f8..f8b62b953 100644 --- a/testing/tests/ikev2/dpd-hold/test.conf +++ b/testing/tests/ikev2/dpd-hold/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-restart/test.conf b/testing/tests/ikev2/dpd-restart/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/dpd-restart/test.conf +++ b/testing/tests/ikev2/dpd-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dynamic-initiator/evaltest.dat b/testing/tests/ikev2/dynamic-initiator/evaltest.dat index 9d050ecde..3db70be71 100644 --- a/testing/tests/ikev2/dynamic-initiator/evaltest.dat +++ b/testing/tests/ikev2/dynamic-initiator/evaltest.dat @@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES moon:: cat /var/log/daemon.log::destroying duplicate IKE_SA for.*carol@strongswan.org.*received INITIAL_CONTACT::YES moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/dynamic-initiator/posttest.dat b/testing/tests/ikev2/dynamic-initiator/posttest.dat index 4dbf3d4a4..83063a23f 100644 --- a/testing/tests/ikev2/dynamic-initiator/posttest.dat +++ b/testing/tests/ikev2/dynamic-initiator/posttest.dat @@ -2,8 +2,8 @@ dave::ipsec stop carol::ipsec stop dave::sleep 1 moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush dave::rm /etc/ipsec.d/certs/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/dynamic-initiator/pretest.dat b/testing/tests/ikev2/dynamic-initiator/pretest.dat index 92681011f..3e1cfce77 100644 --- a/testing/tests/ikev2/dynamic-initiator/pretest.dat +++ b/testing/tests/ikev2/dynamic-initiator/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/dynamic-initiator/test.conf b/testing/tests/ikev2/dynamic-initiator/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/dynamic-initiator/test.conf +++ b/testing/tests/ikev2/dynamic-initiator/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/dynamic-two-peers/evaltest.dat b/testing/tests/ikev2/dynamic-two-peers/evaltest.dat index 1d5ff68ec..82d2e7318 100644 --- a/testing/tests/ikev2/dynamic-two-peers/evaltest.dat +++ b/testing/tests/ikev2/dynamic-two-peers/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::dave.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/dynamic-two-peers/posttest.dat b/testing/tests/ikev2/dynamic-two-peers/posttest.dat index e120b87db..7b2609846 100644 --- a/testing/tests/ikev2/dynamic-two-peers/posttest.dat +++ b/testing/tests/ikev2/dynamic-two-peers/posttest.dat @@ -3,6 +3,6 @@ dave::ipsec stop moon::sleep 1 moon::ipsec stop moon::mv /etc/hosts.ori /etc/hosts -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/dynamic-two-peers/pretest.dat b/testing/tests/ikev2/dynamic-two-peers/pretest.dat index 6596a2527..4bb2a4686 100644 --- a/testing/tests/ikev2/dynamic-two-peers/pretest.dat +++ b/testing/tests/ikev2/dynamic-two-peers/pretest.dat @@ -1,8 +1,8 @@ moon::mv /etc/hosts /etc/hosts.ori moon::mv /etc/hosts.stale /etc/hosts -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/dynamic-two-peers/test.conf b/testing/tests/ikev2/dynamic-two-peers/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/dynamic-two-peers/test.conf +++ b/testing/tests/ikev2/dynamic-two-peers/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat index 74150fb04..d5d3bc0d3 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES carol::ip xfrm state::aead rfc4543(gcm(aes))::YES diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat +++ b/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat +++ b/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/test.conf b/testing/tests/ikev2/esp-alg-aes-gmac/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-aes-gmac/test.conf +++ b/testing/tests/ikev2/esp-alg-aes-gmac/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat b/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat index a66edc5fe..366539936 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat @@ -2,10 +2,10 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::3DES_CBC/HMAC_MD5_128::YES carol::ipsec statusall 2> /dev/null::3DES_CBC/HMAC_MD5_128::YES -moon:: ip xfrm state::auth hmac(md5)::YES -carol::ip xfrm state::auth hmac(md5)::YES +moon:: ip xfrm state::auth-trunc hmac(md5)::YES +carol::ip xfrm state::auth-trunc hmac(md5)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 184::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 184::YES diff --git a/testing/tests/ikev2/esp-alg-md5-128/posttest.dat b/testing/tests/ikev2/esp-alg-md5-128/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/posttest.dat +++ b/testing/tests/ikev2/esp-alg-md5-128/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-md5-128/pretest.dat b/testing/tests/ikev2/esp-alg-md5-128/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/pretest.dat +++ b/testing/tests/ikev2/esp-alg-md5-128/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-md5-128/test.conf b/testing/tests/ikev2/esp-alg-md5-128/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-md5-128/test.conf +++ b/testing/tests/ikev2/esp-alg-md5-128/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/esp-alg-null/evaltest.dat b/testing/tests/ikev2/esp-alg-null/evaltest.dat index 937d85ed2..1b9c6c27e 100644 --- a/testing/tests/ikev2/esp-alg-null/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-null/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES moon:: ip xfrm state::enc ecb(cipher_null)::YES diff --git a/testing/tests/ikev2/esp-alg-null/posttest.dat b/testing/tests/ikev2/esp-alg-null/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-null/posttest.dat +++ b/testing/tests/ikev2/esp-alg-null/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-null/pretest.dat b/testing/tests/ikev2/esp-alg-null/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev2/esp-alg-null/pretest.dat +++ b/testing/tests/ikev2/esp-alg-null/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-null/test.conf b/testing/tests/ikev2/esp-alg-null/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-null/test.conf +++ b/testing/tests/ikev2/esp-alg-null/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat b/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat index 52c27cba5..00c353686 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat +++ b/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat @@ -2,10 +2,10 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_160::YES carol::ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_160::YES -moon:: ip xfrm state::auth hmac(sha1)::YES -carol::ip xfrm state::auth hmac(sha1)::YES +moon:: ip xfrm state::auth-trunc hmac(sha1)::YES +carol::ip xfrm state::auth-trunc hmac(sha1)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 204::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 204::YES diff --git a/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat b/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat +++ b/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat b/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat +++ b/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/esp-alg-sha1-160/test.conf b/testing/tests/ikev2/esp-alg-sha1-160/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/esp-alg-sha1-160/test.conf +++ b/testing/tests/ikev2/esp-alg-sha1-160/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/farp/evaltest.dat b/testing/tests/ikev2/farp/evaltest.dat index 21b10d170..891ec20d5 100644 --- a/testing/tests/ikev2/farp/evaltest.dat +++ b/testing/tests/ikev2/farp/evaltest.dat @@ -1,11 +1,11 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES @@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES -alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES -alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES +alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/farp/posttest.dat b/testing/tests/ikev2/farp/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/farp/posttest.dat +++ b/testing/tests/ikev2/farp/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/farp/pretest.dat b/testing/tests/ikev2/farp/pretest.dat index 709931e1b..f0254da6c 100644 --- a/testing/tests/ikev2/farp/pretest.dat +++ b/testing/tests/ikev2/farp/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules alice::arp -d 10.1.0.30 alice::arp -d 10.1.0.40 carol::ipsec start diff --git a/testing/tests/ikev2/farp/test.conf b/testing/tests/ikev2/farp/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/farp/test.conf +++ b/testing/tests/ikev2/farp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/force-udp-encaps/evaltest.dat b/testing/tests/ikev2/force-udp-encaps/evaltest.dat index d7fe707ab..36af646d2 100644 --- a/testing/tests/ikev2/force-udp-encaps/evaltest.dat +++ b/testing/tests/ikev2/force-udp-encaps/evaltest.dat @@ -3,6 +3,6 @@ sun:: ipsec status 2> /dev/null::nat.t.*ESTABLISHED.*sun.strongswan.org.*alice@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES alice::cat /var/log/daemon.log::faking NAT situation to enforce UDP encapsulation::YES -alice:: ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP alice.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > alice.strongswan.org.*: UDP::YES +alice:: ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP alice.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > alice.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 5bb63f5ac..000000000 --- a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,76 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/force-udp-encaps/posttest.dat b/testing/tests/ikev2/force-udp-encaps/posttest.dat index 979f2fcd0..03edb42cb 100644 --- a/testing/tests/ikev2/force-udp-encaps/posttest.dat +++ b/testing/tests/ikev2/force-udp-encaps/posttest.dat @@ -1,6 +1,6 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON winnetou::ip route del 10.1.0.0/16 via PH_IP_MOON diff --git a/testing/tests/ikev2/force-udp-encaps/pretest.dat b/testing/tests/ikev2/force-udp-encaps/pretest.dat index 6f00cd387..7be66867a 100644 --- a/testing/tests/ikev2/force-udp-encaps/pretest.dat +++ b/testing/tests/ikev2/force-udp-encaps/pretest.dat @@ -1,8 +1,7 @@ -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ip route add 10.1.0.0/16 via PH_IP_MOON winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON -moon::echo 1 > /proc/sys/net/ipv4/ip_forward alice::ipsec start sun::ipsec start alice::sleep 4 diff --git a/testing/tests/ikev2/force-udp-encaps/test.conf b/testing/tests/ikev2/force-udp-encaps/test.conf index d84149aaf..42fa97190 100644 --- a/testing/tests/ikev2/force-udp-encaps/test.conf +++ b/testing/tests/ikev2/force-udp-encaps/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/host2host-cert/evaltest.dat b/testing/tests/ikev2/host2host-cert/evaltest.dat index 53e5589ca..3305f4558 100644 --- a/testing/tests/ikev2/host2host-cert/evaltest.dat +++ b/testing/tests/ikev2/host2host-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-cert/posttest.dat b/testing/tests/ikev2/host2host-cert/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/host2host-cert/posttest.dat +++ b/testing/tests/ikev2/host2host-cert/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/host2host-cert/pretest.dat b/testing/tests/ikev2/host2host-cert/pretest.dat index 1fa70177c..3bce9f6e5 100644 --- a/testing/tests/ikev2/host2host-cert/pretest.dat +++ b/testing/tests/ikev2/host2host-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/host2host-cert/test.conf b/testing/tests/ikev2/host2host-cert/test.conf index 305a67316..55d6e9fd6 100644 --- a/testing/tests/ikev2/host2host-cert/test.conf +++ b/testing/tests/ikev2/host2host-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-swapped/evaltest.dat b/testing/tests/ikev2/host2host-swapped/evaltest.dat index 53e5589ca..3305f4558 100644 --- a/testing/tests/ikev2/host2host-swapped/evaltest.dat +++ b/testing/tests/ikev2/host2host-swapped/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-swapped/posttest.dat b/testing/tests/ikev2/host2host-swapped/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/host2host-swapped/posttest.dat +++ b/testing/tests/ikev2/host2host-swapped/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/host2host-swapped/pretest.dat b/testing/tests/ikev2/host2host-swapped/pretest.dat index 1fa70177c..3bce9f6e5 100644 --- a/testing/tests/ikev2/host2host-swapped/pretest.dat +++ b/testing/tests/ikev2/host2host-swapped/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/host2host-swapped/test.conf b/testing/tests/ikev2/host2host-swapped/test.conf index 305a67316..55d6e9fd6 100644 --- a/testing/tests/ikev2/host2host-swapped/test.conf +++ b/testing/tests/ikev2/host2host-swapped/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-transport/evaltest.dat b/testing/tests/ikev2/host2host-transport/evaltest.dat index 3021b5e04..fc49e57d8 100644 --- a/testing/tests/ikev2/host2host-transport/evaltest.dat +++ b/testing/tests/ikev2/host2host-transport/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-transport/posttest.dat b/testing/tests/ikev2/host2host-transport/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/host2host-transport/posttest.dat +++ b/testing/tests/ikev2/host2host-transport/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/host2host-transport/pretest.dat b/testing/tests/ikev2/host2host-transport/pretest.dat index e2d98f2eb..99789b90f 100644 --- a/testing/tests/ikev2/host2host-transport/pretest.dat +++ b/testing/tests/ikev2/host2host-transport/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/ikev2/host2host-transport/test.conf b/testing/tests/ikev2/host2host-transport/test.conf index cf2e704fd..5a286c84f 100644 --- a/testing/tests/ikev2/host2host-transport/test.conf +++ b/testing/tests/ikev2/host2host-transport/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/inactivity-timeout/evaltest.dat b/testing/tests/ikev2/inactivity-timeout/evaltest.dat index dceceaef6..221c59318 100644 --- a/testing/tests/ikev2/inactivity-timeout/evaltest.dat +++ b/testing/tests/ikev2/inactivity-timeout/evaltest.dat @@ -1,8 +1,8 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::sleep 15::NO carol::cat /var/log/daemon.log::deleting CHILD_SA after 10 seconds of inactivity::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED::NO carol::ipsec status 2> /dev/null::home.*INSTALLED::NO -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::NO +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/inactivity-timeout/posttest.dat b/testing/tests/ikev2/inactivity-timeout/posttest.dat index 94a400606..6ca9c5b35 100644 --- a/testing/tests/ikev2/inactivity-timeout/posttest.dat +++ b/testing/tests/ikev2/inactivity-timeout/posttest.dat @@ -1,4 +1,3 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/inactivity-timeout/pretest.dat b/testing/tests/ikev2/inactivity-timeout/pretest.dat index 3c3df0196..b949aaeaf 100644 --- a/testing/tests/ikev2/inactivity-timeout/pretest.dat +++ b/testing/tests/ikev2/inactivity-timeout/pretest.dat @@ -1,7 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start -carol::sleep 1 +carol::sleep 1 carol::ipsec up home carol::sleep 1 diff --git a/testing/tests/ikev2/inactivity-timeout/test.conf b/testing/tests/ikev2/inactivity-timeout/test.conf index acb73b06f..11423f723 100644 --- a/testing/tests/ikev2/inactivity-timeout/test.conf +++ b/testing/tests/ikev2/inactivity-timeout/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ip-pool-db/evaltest.dat b/testing/tests/ikev2/ip-pool-db/evaltest.dat index 941cb34c0..42e353084 100644 --- a/testing/tests/ikev2/ip-pool-db/evaltest.dat +++ b/testing/tests/ikev2/ip-pool-db/evaltest.dat @@ -6,7 +6,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES @@ -15,7 +15,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev2/ip-pool-db/posttest.dat b/testing/tests/ikev2/ip-pool-db/posttest.dat index 5b88b2163..c99f347e3 100644 --- a/testing/tests/ikev2/ip-pool-db/posttest.dat +++ b/testing/tests/ikev2/ip-pool-db/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ipsec pool --del bigpool 2> /dev/null moon::ipsec pool --del dns 2> /dev/null moon::ipsec pool --del nbns 2> /dev/null diff --git a/testing/tests/ikev2/ip-pool-db/pretest.dat b/testing/tests/ikev2/ip-pool-db/pretest.dat index 4a2add194..fce551c69 100644 --- a/testing/tests/ikev2/ip-pool-db/pretest.dat +++ b/testing/tests/ikev2/ip-pool-db/pretest.dat @@ -4,9 +4,9 @@ moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2> moon::ipsec pool --addattr dns --server PH_IP_WINNETOU 2> /dev/null moon::ipsec pool --addattr dns --server PH_IP_VENUS 2> /dev/null moon::ipsec pool --addattr nbns --server PH_IP_VENUS 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ip-pool-db/test.conf b/testing/tests/ikev2/ip-pool-db/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-pool-db/test.conf +++ b/testing/tests/ikev2/ip-pool-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-pool-wish/evaltest.dat b/testing/tests/ikev2/ip-pool-wish/evaltest.dat index fd15d5209..44310cd16 100644 --- a/testing/tests/ikev2/ip-pool-wish/evaltest.dat +++ b/testing/tests/ikev2/ip-pool-wish/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org.::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES moon:: cat /var/log/daemon.log::peer requested virtual IP PH_IP_CAROL1::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/ikev2/ip-pool-wish/posttest.dat b/testing/tests/ikev2/ip-pool-wish/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/ip-pool-wish/posttest.dat +++ b/testing/tests/ikev2/ip-pool-wish/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/ip-pool-wish/pretest.dat b/testing/tests/ikev2/ip-pool-wish/pretest.dat index 1f4ff286a..1466fd2f2 100644 --- a/testing/tests/ikev2/ip-pool-wish/pretest.dat +++ b/testing/tests/ikev2/ip-pool-wish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ip-pool-wish/test.conf b/testing/tests/ikev2/ip-pool-wish/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-pool-wish/test.conf +++ b/testing/tests/ikev2/ip-pool-wish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-pool/evaltest.dat b/testing/tests/ikev2/ip-pool/evaltest.dat index db46646a6..8ea7960b5 100644 --- a/testing/tests/ikev2/ip-pool/evaltest.dat +++ b/testing/tests/ikev2/ip-pool/evaltest.dat @@ -3,19 +3,19 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES moon:: ipsec leases 10.3.0.0/28 2> /dev/null::2/14, 2 online::YES -moon:: ipsec leases 10.3.0.0/28 10.3.0.1 2> /dev/null::carol@strongswan.org::YES -moon:: ipsec leases 10.3.0.0/28 10.3.0.2 2> /dev/null::dave@strongswan.org::YES +moon:: ipsec leases 10.3.0.0/28 PH_IP_CAROL1 2> /dev/null::carol@strongswan.org::YES +moon:: ipsec leases 10.3.0.0/28 PH_IP_DAVE1 2> /dev/null::dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::ESP diff --git a/testing/tests/ikev2/ip-pool/posttest.dat b/testing/tests/ikev2/ip-pool/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/ip-pool/posttest.dat +++ b/testing/tests/ikev2/ip-pool/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/ip-pool/pretest.dat b/testing/tests/ikev2/ip-pool/pretest.dat index 014e80517..3864bdac3 100644 --- a/testing/tests/ikev2/ip-pool/pretest.dat +++ b/testing/tests/ikev2/ip-pool/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ip-pool/test.conf b/testing/tests/ikev2/ip-pool/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-pool/test.conf +++ b/testing/tests/ikev2/ip-pool/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-split-pools-db/test.conf b/testing/tests/ikev2/ip-split-pools-db/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/ip-split-pools-db/test.conf +++ b/testing/tests/ikev2/ip-split-pools-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat index fd0413d11..fdc3d4d3f 100644 --- a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat @@ -28,10 +28,10 @@ carol::cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU to /etc/res dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU to /etc/resolv.conf::YES alice::cat /var/log/daemon.log::installing DNS server PH_IP_ALICE to /etc/resolv.conf::YES venus::cat /var/log/daemon.log::installing DNS server PH_IP_VENUS to /etc/resolv.conf::YES -alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES -dave:: ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES +alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +dave:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_req=1::YES +dave:: ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_req=1::YES alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES alice::tcpdump::IP moon1.strongswan.org > alice.strongswan.org: ESP::YES dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables deleted file mode 100755 index bb9d03acd..000000000 --- a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # masquerade crl fetches to winnetou - iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..a0ed9f0e6 --- /dev/null +++ b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules @@ -0,0 +1,43 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT + +*nat + +# masquerade crl fetches to winnetou +-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE + +COMMIT diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-db/posttest.dat b/testing/tests/ikev2/ip-two-pools-db/posttest.dat index 7b0393ebd..9c0bb5cae 100644 --- a/testing/tests/ikev2/ip-two-pools-db/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/posttest.dat @@ -3,11 +3,11 @@ venus::ipsec stop carol::ipsec stop dave::ipsec stop moon::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::ip route del 10.3.0.0/16 via PH_IP_MOON moon::ip route del 10.4.0.0/16 via PH_IP_MOON1 moon::conntrack -F diff --git a/testing/tests/ikev2/ip-two-pools-db/pretest.dat b/testing/tests/ikev2/ip-two-pools-db/pretest.dat index e4eb8b0b9..3aba87994 100644 --- a/testing/tests/ikev2/ip-two-pools-db/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/pretest.dat @@ -8,11 +8,11 @@ moon::ipsec pool --addattr dns --server PH_IP_WINNETOU --pool extpool 2> /dev/nu moon::ipsec pool --statusattr 2> /dev/null moon::ip route add 10.3.0.0/16 via PH_IP_MOON moon::ip route add 10.4.0.0/16 via PH_IP_MOON1 -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules alice::ipsec start venus::ipsec start carol::ipsec start diff --git a/testing/tests/ikev2/ip-two-pools-db/test.conf b/testing/tests/ikev2/ip-two-pools-db/test.conf index ea1307b16..c88e11d28 100644 --- a/testing/tests/ikev2/ip-two-pools-db/test.conf +++ b/testing/tests/ikev2/ip-two-pools-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice venus carol dave" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus moon carol dave" diff --git a/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat b/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat index 3b09b32bd..0d7a36452 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat @@ -13,8 +13,8 @@ moon:: ipsec pool --status 2> /dev/null::intpool.*10.4.0.1.*10.4.1.244.*static.* moon:: ipsec pool --leases --filter pool=intpool,addr=10.4.0.1,id=alice@strongswan.org 2> /dev/null::online::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES -carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables deleted file mode 100755 index bb9d03acd..000000000 --- a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # masquerade crl fetches to winnetou - iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..a0ed9f0e6 --- /dev/null +++ b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules @@ -0,0 +1,43 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT + +*nat + +# masquerade crl fetches to winnetou +-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE + +COMMIT diff --git a/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat b/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat index db5e6237f..a3924b2f6 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop alice::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -alice::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +alice::iptables-restore < /etc/iptables.flush moon::conntrack -F moon::ipsec pool --del intpool 2> /dev/null moon::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat b/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat index b579464f2..b74c1e07a 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat @@ -1,9 +1,9 @@ moon::cat /etc/ipsec.d/tables.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db moon::ipsec pool --add intpool --start 10.4.0.1 --end 10.4.1.244 --timeout 0 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules carol::ipsec start moon::ipsec start alice::ipsec start diff --git a/testing/tests/ikev2/ip-two-pools-mixed/test.conf b/testing/tests/ikev2/ip-two-pools-mixed/test.conf index 329774c0a..1ed3473ab 100644 --- a/testing/tests/ikev2/ip-two-pools-mixed/test.conf +++ b/testing/tests/ikev2/ip-two-pools-mixed/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice carol" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon carol" diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat index 7a0c1ed6f..0bf3500b5 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat @@ -5,5 +5,5 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES carol::cat /var/log/daemon.log::installing new virtual IP fec3:\:1::YES carol::cat /var/log/daemon.log::TS 10.3.0.1/32 fec3:\:1/128 === 10.1.0.0/16 fec1:\:/16::YES -carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat index fafe030c1..bb20cae05 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat @@ -1,5 +1,4 @@ alice::ip -6 route del default via fec1:\:1 carol::ipsec stop -moon::echo 0 > /proc/sys/net/ipv6/conf/all/forwarding moon::ipsec stop moon::conntrack -F diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat index f97ff54b5..04139badf 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat @@ -1,5 +1,4 @@ alice::ip -6 route add default via fec1:\:1 -moon::echo 1 > /proc/sys/net/ipv6/conf/all/forwarding moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/test.conf b/testing/tests/ikev2/ip-two-pools-v4v6/test.conf index c86dd1d66..cd03759f0 100644 --- a/testing/tests/ikev2/ip-two-pools-v4v6/test.conf +++ b/testing/tests/ikev2/ip-two-pools-v4v6/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="carol" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ip-two-pools/evaltest.dat b/testing/tests/ikev2/ip-two-pools/evaltest.dat index 5de62e447..fad3781d7 100644 --- a/testing/tests/ikev2/ip-two-pools/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools/evaltest.dat @@ -10,12 +10,12 @@ moon:: cat /var/log/daemon.log::adding virtual IP address pool.*10.4.0.0/28::YES moon:: cat /var/log/daemon.log::adding virtual IP address pool.*10.3.0.0/28::YES moon:: ipsec leases 10.3.0.0/28 2> /dev/null::1/14, 1 online::YES moon:: ipsec leases 10.4.0.0/28 2> /dev/null::1/14, 1 online::YES -moon:: ipsec leases 10.3.0.0/28 10.3.0.1 2> /dev/null::carol@strongswan.org::YES +moon:: ipsec leases 10.3.0.0/28 PH_IP_CAROL1 2> /dev/null::carol@strongswan.org::YES moon:: ipsec leases 10.4.0.0/28 10.4.0.1 2> /dev/null::alice@strongswan.org::YES -carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES +carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES -carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 97b773645..000000000 --- a/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables deleted file mode 100755 index bb9d03acd..000000000 --- a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,91 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # masquerade crl fetches to winnetou - iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..a0ed9f0e6 --- /dev/null +++ b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules @@ -0,0 +1,43 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT + +*nat + +# masquerade crl fetches to winnetou +-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE + +COMMIT diff --git a/testing/tests/ikev2/ip-two-pools/posttest.dat b/testing/tests/ikev2/ip-two-pools/posttest.dat index f41bb0fbc..2fbc2c3a0 100644 --- a/testing/tests/ikev2/ip-two-pools/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools/posttest.dat @@ -1,8 +1,8 @@ alice::ipsec stop carol::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -alice::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +alice::iptables-restore < /etc/iptables.flush moon::conntrack -F moon::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/ikev2/ip-two-pools/pretest.dat b/testing/tests/ikev2/ip-two-pools/pretest.dat index db422a105..4e8b639f4 100644 --- a/testing/tests/ikev2/ip-two-pools/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules carol::ipsec start moon::ipsec start alice::ipsec start diff --git a/testing/tests/ikev2/ip-two-pools/test.conf b/testing/tests/ikev2/ip-two-pools/test.conf index 329774c0a..1ed3473ab 100644 --- a/testing/tests/ikev2/ip-two-pools/test.conf +++ b/testing/tests/ikev2/ip-two-pools/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice carol" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice moon carol" diff --git a/testing/tests/ikev2/mobike-nat/evaltest.dat b/testing/tests/ikev2/mobike-nat/evaltest.dat index aded7a040..c71e3f7c1 100644 --- a/testing/tests/ikev2/mobike-nat/evaltest.dat +++ b/testing/tests/ikev2/mobike-nat/evaltest.dat @@ -2,14 +2,14 @@ alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN:: sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::/etc/init.d/net.eth1 stop::No output expected::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ifdown eth1::No output expected::NO alice::sleep 1::No output expected::NO alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_MOON::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES moon::tcpdump::moon.strongswan.org.*sun.strongswan.org.*: UDP-encap: ESP.*seq=0x2::YES diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables deleted file mode 100755 index cf0d65c58..000000000 --- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,87 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf index efbce1fb2..ffb7f563a 100644 --- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf @@ -10,7 +10,7 @@ conn %default keyexchange=ikev2 conn mobike - left=PH_IP_ALICE1 + left=192.168.0.50 leftsourceip=%config leftcert=aliceCert.pem leftid=alice@strongswan.org diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..6dd261f20 --- /dev/null +++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules @@ -0,0 +1,38 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 642c414d5..000000000 --- a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..0a7d1fa40 --- /dev/null +++ b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-nat/posttest.dat b/testing/tests/ikev2/mobike-nat/posttest.dat index cd0d4df25..f4e5316c9 100644 --- a/testing/tests/ikev2/mobike-nat/posttest.dat +++ b/testing/tests/ikev2/mobike-nat/posttest.dat @@ -1,6 +1,6 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/mobike-nat/pretest.dat b/testing/tests/ikev2/mobike-nat/pretest.dat index 08c2be95c..86ac6e7e0 100644 --- a/testing/tests/ikev2/mobike-nat/pretest.dat +++ b/testing/tests/ikev2/mobike-nat/pretest.dat @@ -1,12 +1,11 @@ -alice::/etc/init.d/net.eth1 start -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +alice::ifup eth1 +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::conntrack -F -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start sun::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up mobike alice::sleep 1 diff --git a/testing/tests/ikev2/mobike-nat/test.conf b/testing/tests/ikev2/mobike-nat/test.conf index 24a0cf3a4..70c64c503 100644 --- a/testing/tests/ikev2/mobike-nat/test.conf +++ b/testing/tests/ikev2/mobike-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="bob moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat b/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat index c4c7b0b6f..17593ef82 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat +++ b/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat @@ -1,15 +1,15 @@ -alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::YES -sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES +alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES +sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::/etc/init.d/net.eth1 stop::No output expected::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ifdown eth1::No output expected::NO alice::sleep 1::No output expected::NO alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES moon::tcpdump::alice.strongswan.org.*sun.strongswan.org.*: ESP.*seq=0x2::YES diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables deleted file mode 100755 index cf0d65c58..000000000 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,87 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf index efbce1fb2..ffb7f563a 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf @@ -10,7 +10,7 @@ conn %default keyexchange=ikev2 conn mobike - left=PH_IP_ALICE1 + left=192.168.0.50 leftsourceip=%config leftcert=aliceCert.pem leftid=alice@strongswan.org diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..a238c8d19 --- /dev/null +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules @@ -0,0 +1,38 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 642c414d5..000000000 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf index eeee6ffb0..2b0c8aebd 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf @@ -14,7 +14,7 @@ conn mobike leftcert=sunCert.pem leftid=@sun.strongswan.org leftsubnet=10.2.0.0/16 - right=PH_IP_ALICE1 + right=192.168.0.50 rightsourceip=10.3.0.3 rightid=alice@strongswan.org auto=add diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..d86a461ac --- /dev/null +++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike-virtual-ip/posttest.dat b/testing/tests/ikev2/mobike-virtual-ip/posttest.dat index 32fdf0053..95c963091 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/posttest.dat +++ b/testing/tests/ikev2/mobike-virtual-ip/posttest.dat @@ -1,5 +1,5 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON diff --git a/testing/tests/ikev2/mobike-virtual-ip/pretest.dat b/testing/tests/ikev2/mobike-virtual-ip/pretest.dat index 6666e7794..067c1a1ec 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/pretest.dat +++ b/testing/tests/ikev2/mobike-virtual-ip/pretest.dat @@ -1,10 +1,9 @@ -alice::/etc/init.d/net.eth1 start -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::ifup eth1 +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ip route add 10.1.0.0/16 via PH_IP_MOON alice::ipsec start sun::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up mobike alice::sleep 1 diff --git a/testing/tests/ikev2/mobike-virtual-ip/test.conf b/testing/tests/ikev2/mobike-virtual-ip/test.conf index 24a0cf3a4..70c64c503 100644 --- a/testing/tests/ikev2/mobike-virtual-ip/test.conf +++ b/testing/tests/ikev2/mobike-virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="bob moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/mobike/evaltest.dat b/testing/tests/ikev2/mobike/evaltest.dat index ebf5ad4cf..e3464040e 100644 --- a/testing/tests/ikev2/mobike/evaltest.dat +++ b/testing/tests/ikev2/mobike/evaltest.dat @@ -1,15 +1,15 @@ -alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::YES -sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES -alice::ipsec statusall 2> /dev/null::PH_IP_ALICE1/32 === 10.2.0.0/16::YES -sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === PH_IP_ALICE1/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::/etc/init.d/net.eth1 stop::No output expected::NO +alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES +sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES +alice::ipsec statusall 2> /dev/null::192.168.0.50/32 === 10.2.0.0/16::YES +sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 192.168.0.50/32::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ifdown eth1::No output expected::NO alice::sleep 1::No output expected::NO alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES alice::ipsec statusall 2> /dev/null::PH_IP_ALICE/32 === 10.2.0.0/16::YES sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === PH_IP_ALICE/32::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES moon::tcpdump::alice.strongswan.org.*sun.strongswan.org: ESP.*seq=0x2::YES diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables deleted file mode 100755 index cf0d65c58..000000000 --- a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,87 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf index 66cbce781..95683fdc3 100644 --- a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf @@ -10,7 +10,7 @@ conn %default keyexchange=ikev2 conn mobike - left=PH_IP_ALICE1 + left=192.168.0.50 leftcert=aliceCert.pem leftid=alice@strongswan.org right=PH_IP_SUN diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..a238c8d19 --- /dev/null +++ b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules @@ -0,0 +1,38 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 6934b1948..000000000 --- a/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,90 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IPsec tunnel traffic - iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT - iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A INPUT -i eth1 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf index f3fa9209c..f7693106f 100644 --- a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf @@ -14,6 +14,6 @@ conn mobike leftcert=sunCert.pem leftid=@sun.strongswan.org leftsubnet=10.2.0.0/16 - right=PH_IP_ALICE1 + right=192.168.0.50 rightid=alice@strongswan.org auto=add diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..d86a461ac --- /dev/null +++ b/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IPsec tunnel traffic +-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT +-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT + +# allow ESP +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mobike/posttest.dat b/testing/tests/ikev2/mobike/posttest.dat index 32fdf0053..95c963091 100644 --- a/testing/tests/ikev2/mobike/posttest.dat +++ b/testing/tests/ikev2/mobike/posttest.dat @@ -1,5 +1,5 @@ alice::ipsec stop sun::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON diff --git a/testing/tests/ikev2/mobike/pretest.dat b/testing/tests/ikev2/mobike/pretest.dat index 6666e7794..067c1a1ec 100644 --- a/testing/tests/ikev2/mobike/pretest.dat +++ b/testing/tests/ikev2/mobike/pretest.dat @@ -1,10 +1,9 @@ -alice::/etc/init.d/net.eth1 start -alice::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::ifup eth1 +alice::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ip route add 10.1.0.0/16 via PH_IP_MOON alice::ipsec start sun::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up mobike alice::sleep 1 diff --git a/testing/tests/ikev2/mobike/test.conf b/testing/tests/ikev2/mobike/test.conf index 24a0cf3a4..70c64c503 100644 --- a/testing/tests/ikev2/mobike/test.conf +++ b/testing/tests/ikev2/mobike/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="bob moon sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat index 4a72b4392..65a003d23 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat @@ -6,7 +6,7 @@ moon:: cat /var/log/daemon.log::received EAP identity .*228060123456001::YES moon:: cat /var/log/daemon.log::authentication of .*228060123456001@strongswan.org.* with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-mult.*ESTABLISHED.*228060123456001@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*228060123456001@strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::cat /var/log/daemon.log::authentication of .*dave@strongswan.org.* with RSA signature successful::YES @@ -18,4 +18,4 @@ moon::cat /var/log/daemon.log::EAP method EAP_SIM failed for peer 22806012345600 moon::ipsec status 2> /dev/null::rw-mult.*ESTABLISHED.*228060123456002@strongswan.org::NO dave::cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES dave::ipsec status 2> /dev/null::home.*ESTABLISHED::NO -dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files new file mode 100644 index 000000000..10c26aa15 --- /dev/null +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files @@ -0,0 +1,3 @@ +sim_files { + simtriplets = "/etc/freeradius/triplets.dat" +} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/sites-available/default index dfceb037d..91425f812 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/sites-available/default @@ -59,4 +59,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/triplets.dat index 002ee94d1..aaabab89e 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/triplets.dat @@ -4,4 +4,3 @@ 228060123456002,33000000000000000000000000000000,33112233,335566778899AABB 228060123456002,34000000000000000000000000000000,34112233,345566778899AABB 228060123456002,35000000000000000000000000000000,35112233,355566778899AABB - diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/users b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat index dbe56013a..6a4da6631 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat @@ -1,7 +1,4 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat index b3fd4cbf1..2d54c6027 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat @@ -1,11 +1,8 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::cat /etc/raddb/clients.conf -alice::cat /etc/raddb/eap.conf -alice::cat /etc/raddb/proxy.conf -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +alice::cat /etc/freeradius/clients.conf +alice::cat /etc/freeradius/eap.conf +alice::cat /etc/freeradius/proxy.conf +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf index 70416826e..42d23a50b 100644 --- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf +++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf @@ -1,21 +1,25 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" + +# Guest instances on which FreeRadius is started +# +RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat b/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat index c8e7adcb7..2eebc0f84 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-cr-init/test.conf b/testing/tests/ikev2/multi-level-ca-cr-init/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-init/test.conf +++ b/testing/tests/ikev2/multi-level-ca-cr-init/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat b/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf b/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf +++ b/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 4f4f3228b..000000000 --- a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,80 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ldap crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..debcc2181 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow ldap crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat b/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat index ec4ba6e10..6f0ec4b97 100644 --- a/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat +++ b/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat @@ -3,5 +3,5 @@ carol::ipsec stop dave::ipsec stop moon::rm /etc/ipsec.d/cacerts/* winnetou::/etc/init.d/slapd stop -moon::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat b/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat index 322f42102..41319ae4d 100644 --- a/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat @@ -1,5 +1,5 @@ winnetou::/etc/init.d/slapd start -moon::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-ldap/test.conf b/testing/tests/ikev2/multi-level-ca-ldap/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-ldap/test.conf +++ b/testing/tests/ikev2/multi-level-ca-ldap/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca-loop/pretest.dat b/testing/tests/ikev2/multi-level-ca-loop/pretest.dat index 0a0ec22bf..bb538c160 100644 --- a/testing/tests/ikev2/multi-level-ca-loop/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-loop/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::rm /etc/ipsec.d/cacerts/strongswanCert.pem carol::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-loop/test.conf b/testing/tests/ikev2/multi-level-ca-loop/test.conf index 3189fdfc7..a24ec4f1d 100644 --- a/testing/tests/ikev2/multi-level-ca-loop/test.conf +++ b/testing/tests/ikev2/multi-level-ca-loop/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat b/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat index 9f0232a7b..e209e60ff 100644 --- a/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/multi-level-ca-pathlen/test.conf b/testing/tests/ikev2/multi-level-ca-pathlen/test.conf index b118cb7dc..587964390 100644 --- a/testing/tests/ikev2/multi-level-ca-pathlen/test.conf +++ b/testing/tests/ikev2/multi-level-ca-pathlen/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou" +VIRTHOSTS="alice venus moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/multi-level-ca-revoked/test.conf b/testing/tests/ikev2/multi-level-ca-revoked/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/multi-level-ca-revoked/test.conf +++ b/testing/tests/ikev2/multi-level-ca-revoked/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/multi-level-ca-strict/pretest.dat b/testing/tests/ikev2/multi-level-ca-strict/pretest.dat index 67c50c2ef..755564cbc 100644 --- a/testing/tests/ikev2/multi-level-ca-strict/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca-strict/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca-strict/test.conf b/testing/tests/ikev2/multi-level-ca-strict/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca-strict/test.conf +++ b/testing/tests/ikev2/multi-level-ca-strict/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/multi-level-ca/pretest.dat b/testing/tests/ikev2/multi-level-ca/pretest.dat index 67c50c2ef..755564cbc 100644 --- a/testing/tests/ikev2/multi-level-ca/pretest.dat +++ b/testing/tests/ikev2/multi-level-ca/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/multi-level-ca/test.conf b/testing/tests/ikev2/multi-level-ca/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/multi-level-ca/test.conf +++ b/testing/tests/ikev2/multi-level-ca/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/nat-rw-mark/description.txt b/testing/tests/ikev2/nat-rw-mark/description.txt index 2a93d11d8..b8074e665 100644 --- a/testing/tests/ikev2/nat-rw-mark/description.txt +++ b/testing/tests/ikev2/nat-rw-mark/description.txt @@ -1,7 +1,7 @@ The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT -after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respectively. +after ESP decryption to map these subnets to PH_IP_CAROL10 and PH_IP_DAVE10, respectively. <p/> In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively, <b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using diff --git a/testing/tests/ikev2/nat-rw-mark/evaltest.dat b/testing/tests/ikev2/nat-rw-mark/evaltest.dat index db9e969d2..bb8e856cc 100644 --- a/testing/tests/ikev2/nat-rw-mark/evaltest.dat +++ b/testing/tests/ikev2/nat-rw-mark/evaltest.dat @@ -6,13 +6,13 @@ sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*alice@ sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4510.*: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4520.*: UDP::YES -bob::tcpdump::10.3.0.10 > bob.strongswan.org: ICMP echo request::YES -bob::tcpdump::10.3.0.20 > bob.strongswan.org: ICMP echo request::YES -bob::tcpdump::bob.strongswan.org > 10.3.0.10: ICMP echo reply::YES -bob::tcpdump::bob.strongswan.org > 10.3.0.20: ICMP echo reply::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4510.*: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4520.*: UDP::YES +bob::tcpdump::PH_IP_CAROL10 > bob.strongswan.org: ICMP echo request::YES +bob::tcpdump::PH_IP_DAVE10 > bob.strongswan.org: ICMP echo request::YES +bob::tcpdump::bob.strongswan.org > PH_IP_CAROL10: ICMP echo reply::YES +bob::tcpdump::bob.strongswan.org > PH_IP_DAVE10: ICMP echo reply::YES diff --git a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown index 0d22e684d..421335ffb 100755 --- a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown +++ b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown @@ -73,8 +73,12 @@ # just the host, this will be 255.255.255.255. # # PLUTO_MY_SOURCEIP -# if non-empty, then the source address for the route will be -# set to this IP address. +# PLUTO_MY_SOURCEIP4_$i +# PLUTO_MY_SOURCEIP6_$i +# contains IPv4/IPv6 virtual IP received from a responder, +# $i enumerates from 1 to the number of IP per address family. +# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first +# virtual IP, IPv4 or IPv6. # # PLUTO_MY_PROTOCOL # is the IP protocol that will be transported. @@ -128,9 +132,15 @@ # contains the remote UDP port in the case of ESP_IN_UDP # encapsulation # +# PLUTO_DNS4_$i +# PLUTO_DNS6_$i +# contains IPv4/IPv6 DNS server attribute received from a +# responder, $i enumerates from 1 to the number of servers per +# address family. +# # define a minimum PATH environment in case it is not set -PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin" export PATH # uncomment to log VPN connections diff --git a/testing/tests/ikev2/nat-rw-mark/posttest.dat b/testing/tests/ikev2/nat-rw-mark/posttest.dat index 89d5f534b..72dff4e10 100644 --- a/testing/tests/ikev2/nat-rw-mark/posttest.dat +++ b/testing/tests/ikev2/nat-rw-mark/posttest.dat @@ -2,10 +2,11 @@ sun::iptables -t mangle -v -n -L PREROUTING sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null -moon::iptables -t nat -F +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush moon::conntrack -F +sun::iptables-restore < /etc/iptables.flush sun::conntrack -F sun::rm /etc/mark_updown diff --git a/testing/tests/ikev2/nat-rw-mark/pretest.dat b/testing/tests/ikev2/nat-rw-mark/pretest.dat index 3ed13d5fa..6cddfd4fe 100644 --- a/testing/tests/ikev2/nat-rw-mark/pretest.dat +++ b/testing/tests/ikev2/nat-rw-mark/pretest.dat @@ -1,21 +1,20 @@ -sun::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::iptables-restore < /etc/iptables.rules +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 500 -j SNAT --to PH_IP_MOON:510 moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 500 -j SNAT --to PH_IP_MOON:520 moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4510 moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4520 -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to 10.3.0.10 -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to 10.3.0.20 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.10 -j MARK --set-mark 10 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.20 -j MARK --set-mark 20 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10 +sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 10 +sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 20 sun::ipsec start alice::ipsec start venus::ipsec start -alice::sleep 2 +alice::sleep 2 alice::ipsec up nat-t -venus::sleep 2 +venus::sleep 2 venus::ipsec up nat-t venus::sleep 2 diff --git a/testing/tests/ikev2/nat-rw-mark/test.conf b/testing/tests/ikev2/nat-rw-mark/test.conf index ae3c190b8..105472cbe 100644 --- a/testing/tests/ikev2/nat-rw-mark/test.conf +++ b/testing/tests/ikev2/nat-rw-mark/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-rw-psk/evaltest.dat b/testing/tests/ikev2/nat-rw-psk/evaltest.dat index 051db978a..6ec29c779 100644 --- a/testing/tests/ikev2/nat-rw-psk/evaltest.dat +++ b/testing/tests/ikev2/nat-rw-psk/evaltest.dat @@ -3,7 +3,7 @@ venus::ipsec status 2> /dev/null::nat-t.*INSTALLED. TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_ALICE\]::YES sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_VENUS\]::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/nat-rw-psk/posttest.dat b/testing/tests/ikev2/nat-rw-psk/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/ikev2/nat-rw-psk/posttest.dat +++ b/testing/tests/ikev2/nat-rw-psk/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/nat-rw-psk/pretest.dat b/testing/tests/ikev2/nat-rw-psk/pretest.dat index 6a542ec8f..c5d091f32 100644 --- a/testing/tests/ikev2/nat-rw-psk/pretest.dat +++ b/testing/tests/ikev2/nat-rw-psk/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/nat-rw-psk/test.conf b/testing/tests/ikev2/nat-rw-psk/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/ikev2/nat-rw-psk/test.conf +++ b/testing/tests/ikev2/nat-rw-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-rw/evaltest.dat b/testing/tests/ikev2/nat-rw/evaltest.dat index e0b458dba..387dbae23 100644 --- a/testing/tests/ikev2/nat-rw/evaltest.dat +++ b/testing/tests/ikev2/nat-rw/evaltest.dat @@ -6,13 +6,13 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL, ESP in UDP::YES sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL, ESP in UDP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES moon:: sleep 6::no output expected::NO -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP-encap: ESP::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: isakmp-nat-keep-alive::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP-encap: ESP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP-encap: ESP::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: isakmp-nat-keep-alive::YES alice::cat /var/log/daemon.log::sending keep alive::YES venus::cat /var/log/daemon.log::sending keep alive::YES diff --git a/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/nat-rw/posttest.dat b/testing/tests/ikev2/nat-rw/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/ikev2/nat-rw/posttest.dat +++ b/testing/tests/ikev2/nat-rw/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/nat-rw/pretest.dat b/testing/tests/ikev2/nat-rw/pretest.dat index e365ff5c5..d701a1d61 100644 --- a/testing/tests/ikev2/nat-rw/pretest.dat +++ b/testing/tests/ikev2/nat-rw/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start diff --git a/testing/tests/ikev2/nat-rw/test.conf b/testing/tests/ikev2/nat-rw/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/ikev2/nat-rw/test.conf +++ b/testing/tests/ikev2/nat-rw/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-virtual-ip/evaltest.dat b/testing/tests/ikev2/nat-virtual-ip/evaltest.dat index 9c98e312a..c60ffc772 100644 --- a/testing/tests/ikev2/nat-virtual-ip/evaltest.dat +++ b/testing/tests/ikev2/nat-virtual-ip/evaltest.dat @@ -1,7 +1,7 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: cat /var/log/daemon.log::inserted NAT rule mapping PH_IP_ALICE to virtual IP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES bob::tcpdump::IP alice2.strongswan.org > bob.strongswan.org: ICMP::YES diff --git a/testing/tests/ikev2/nat-virtual-ip/posttest.dat b/testing/tests/ikev2/nat-virtual-ip/posttest.dat index ee30e2c59..11bd19da7 100644 --- a/testing/tests/ikev2/nat-virtual-ip/posttest.dat +++ b/testing/tests/ikev2/nat-virtual-ip/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::conntrack -F moon::rm /etc/nat_updown diff --git a/testing/tests/ikev2/nat-virtual-ip/pretest.dat b/testing/tests/ikev2/nat-virtual-ip/pretest.dat index abbca90d7..eb0c28c7f 100644 --- a/testing/tests/ikev2/nat-virtual-ip/pretest.dat +++ b/testing/tests/ikev2/nat-virtual-ip/pretest.dat @@ -1,7 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::conntrack -F -moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/nat-virtual-ip/test.conf b/testing/tests/ikev2/nat-virtual-ip/test.conf index 1971a33ab..f46f137b4 100644 --- a/testing/tests/ikev2/nat-virtual-ip/test.conf +++ b/testing/tests/ikev2/nat-virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-cert/evaltest.dat b/testing/tests/ikev2/net2net-cert/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev2/net2net-cert/evaltest.dat +++ b/testing/tests/ikev2/net2net-cert/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-cert/posttest.dat b/testing/tests/ikev2/net2net-cert/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/net2net-cert/posttest.dat +++ b/testing/tests/ikev2/net2net-cert/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-cert/pretest.dat b/testing/tests/ikev2/net2net-cert/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/net2net-cert/pretest.dat +++ b/testing/tests/ikev2/net2net-cert/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-cert/test.conf b/testing/tests/ikev2/net2net-cert/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-cert/test.conf +++ b/testing/tests/ikev2/net2net-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-esn/posttest.dat b/testing/tests/ikev2/net2net-esn/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/net2net-esn/posttest.dat +++ b/testing/tests/ikev2/net2net-esn/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-esn/pretest.dat b/testing/tests/ikev2/net2net-esn/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/net2net-esn/pretest.dat +++ b/testing/tests/ikev2/net2net-esn/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-esn/test.conf b/testing/tests/ikev2/net2net-esn/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-esn/test.conf +++ b/testing/tests/ikev2/net2net-esn/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat b/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat index 97dd63c5a..460c659d9 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat +++ b/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*71:27:04:32:cd:76:3a:18: sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun <sun.strongswan.org>.*71:27:04:32:cd:76:3a:18:02:0a:c9:88:c0:e7:5a:ed::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-pgp-v3/posttest.dat b/testing/tests/ikev2/net2net-pgp-v3/posttest.dat index fafcde975..9a9513dc3 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/posttest.dat +++ b/testing/tests/ikev2/net2net-pgp-v3/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* sun::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/net2net-pgp-v3/pretest.dat b/testing/tests/ikev2/net2net-pgp-v3/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/pretest.dat +++ b/testing/tests/ikev2/net2net-pgp-v3/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-pgp-v3/test.conf b/testing/tests/ikev2/net2net-pgp-v3/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-pgp-v3/test.conf +++ b/testing/tests/ikev2/net2net-pgp-v3/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat b/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat index 4615c3ed8..f74eb6a19 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat +++ b/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*b4: sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*b4:2f:31:fe:c8:0a:e3:26:4a:10:1c:85:97:7a:04:ac:8d:16:38:d3.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-pgp-v4/posttest.dat b/testing/tests/ikev2/net2net-pgp-v4/posttest.dat index fafcde975..9a9513dc3 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/posttest.dat +++ b/testing/tests/ikev2/net2net-pgp-v4/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* sun::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/net2net-pgp-v4/pretest.dat b/testing/tests/ikev2/net2net-pgp-v4/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/pretest.dat +++ b/testing/tests/ikev2/net2net-pgp-v4/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-pgp-v4/test.conf b/testing/tests/ikev2/net2net-pgp-v4/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-pgp-v4/test.conf +++ b/testing/tests/ikev2/net2net-pgp-v4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat b/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat index 1556143cf..113c3d9c0 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat +++ b/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::dscp-be.*ESTABLISHED.*moon-be.*sun-be::YES moon:: ipsec status 2> /dev/null::dscp-ef.*ESTABLISHED.*moon-ef.*sun-ef::YES sun:: ipsec status 2> /dev/null::dscp-be.*ESTABLISHED.*sun-be.*moon-be::YES sun:: ipsec status 2> /dev/null::dscp-ef.*ESTABLISHED.*sun-ef.*moon-ef::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-psk-dscp/posttest.dat b/testing/tests/ikev2/net2net-psk-dscp/posttest.dat index d070c1443..21a22bfb8 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/posttest.dat +++ b/testing/tests/ikev2/net2net-psk-dscp/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush alice::iptables -t mangle -F OUTPUT venus::iptables -t mangle -F OUTPUT bob::iptables -t mangle -F OUTPUT diff --git a/testing/tests/ikev2/net2net-psk-dscp/pretest.dat b/testing/tests/ikev2/net2net-psk-dscp/pretest.dat index 058c24f8f..0495890dd 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/pretest.dat +++ b/testing/tests/ikev2/net2net-psk-dscp/pretest.dat @@ -1,7 +1,7 @@ moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules alice::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class BE venus::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class EF moon::iptables -t mangle -A PREROUTING -m dscp --dscp-class BE -j MARK --set-mark 10 diff --git a/testing/tests/ikev2/net2net-psk-dscp/test.conf b/testing/tests/ikev2/net2net-psk-dscp/test.conf index 13a8a2a48..10c582c9b 100644 --- a/testing/tests/ikev2/net2net-psk-dscp/test.conf +++ b/testing/tests/ikev2/net2net-psk-dscp/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk-fail/posttest.dat b/testing/tests/ikev2/net2net-psk-fail/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-psk-fail/posttest.dat +++ b/testing/tests/ikev2/net2net-psk-fail/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-psk-fail/pretest.dat b/testing/tests/ikev2/net2net-psk-fail/pretest.dat index 976a196db..cb9282595 100644 --- a/testing/tests/ikev2/net2net-psk-fail/pretest.dat +++ b/testing/tests/ikev2/net2net-psk-fail/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-psk-fail/test.conf b/testing/tests/ikev2/net2net-psk-fail/test.conf index f6e064e7d..eb4822b5d 100644 --- a/testing/tests/ikev2/net2net-psk-fail/test.conf +++ b/testing/tests/ikev2/net2net-psk-fail/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk/evaltest.dat b/testing/tests/ikev2/net2net-psk/evaltest.dat index c98f5d78d..2b37cad99 100644 --- a/testing/tests/ikev2/net2net-psk/evaltest.dat +++ b/testing/tests/ikev2/net2net-psk/evaltest.dat @@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun. sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets index cbdddfb18..ba909a234 100644 --- a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets @@ -8,5 +8,5 @@ : PSK 'My "home" is my "castle"!' -192.168.0.1 : PSK "Andi's home" +PH_IP_MOON : PSK "Andi's home" diff --git a/testing/tests/ikev2/net2net-psk/posttest.dat b/testing/tests/ikev2/net2net-psk/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-psk/posttest.dat +++ b/testing/tests/ikev2/net2net-psk/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-psk/pretest.dat b/testing/tests/ikev2/net2net-psk/pretest.dat index 976a196db..cb9282595 100644 --- a/testing/tests/ikev2/net2net-psk/pretest.dat +++ b/testing/tests/ikev2/net2net-psk/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-psk/test.conf b/testing/tests/ikev2/net2net-psk/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-psk/test.conf +++ b/testing/tests/ikev2/net2net-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-pubkey/evaltest.dat b/testing/tests/ikev2/net2net-pubkey/evaltest.dat index e47e709e2..bc03a39fb 100644 --- a/testing/tests/ikev2/net2net-pubkey/evaltest.dat +++ b/testing/tests/ikev2/net2net-pubkey/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-pubkey/posttest.dat b/testing/tests/ikev2/net2net-pubkey/posttest.dat index 65b18b7ca..675b02976 100644 --- a/testing/tests/ikev2/net2net-pubkey/posttest.dat +++ b/testing/tests/ikev2/net2net-pubkey/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/private/moonKey.der sun::rm /etc/ipsec.d/private/sunKey.der moon::rm /etc/ipsec.d/certs/*.der diff --git a/testing/tests/ikev2/net2net-pubkey/pretest.dat b/testing/tests/ikev2/net2net-pubkey/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-pubkey/pretest.dat +++ b/testing/tests/ikev2/net2net-pubkey/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-pubkey/test.conf b/testing/tests/ikev2/net2net-pubkey/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-pubkey/test.conf +++ b/testing/tests/ikev2/net2net-pubkey/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-rfc3779/evaltest.dat b/testing/tests/ikev2/net2net-rfc3779/evaltest.dat index 59d0372dc..e8e1a46e4 100644 --- a/testing/tests/ikev2/net2net-rfc3779/evaltest.dat +++ b/testing/tests/ikev2/net2net-rfc3779/evaltest.dat @@ -1,15 +1,15 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: cat /var/log/daemon.log::subject address block 10.2.0.0/16 is contained in issuer address block 10.1.0.0..10.2.255.255::YES -moon:: cat /var/log/daemon.log::subject address block 192.168.0.2/32 is contained in issuer address block 192.168.0.0/24::YES +moon:: cat /var/log/daemon.log::subject address block PH_IP_SUN/32 is contained in issuer address block 192.168.0.0/24::YES moon:: cat /var/log/daemon.log::subject address block fec0:\:2/128 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES moon:: cat /var/log/daemon.log::subject address block fec2:\:/16 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES sun:: cat /var/log/daemon.log::subject address block 10.1.0.0/16 is contained in issuer address block 10.1.0.0..10.2.255.255::YES -sun:: cat /var/log/daemon.log::subject address block 192.168.0.1/32 is contained in issuer address block 192.168.0.0/24::YES +sun:: cat /var/log/daemon.log::subject address block PH_IP_MOON/32 is contained in issuer address block 192.168.0.0/24::YES sun:: cat /var/log/daemon.log::subject address block fec0:\:1/128 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES sun:: cat /var/log/daemon.log::subject address block fec1:\:/16 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES moon:: cat /var/log/daemon.log::TS 10.2.0.0/16 is contained in address block constraint 10.2.0.0/16::YES sun:: cat /var/log/daemon.log::TS 10.1.0.0/16 is contained in address block constraint 10.1.0.0/16::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-rfc3779/posttest.dat b/testing/tests/ikev2/net2net-rfc3779/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/net2net-rfc3779/posttest.dat +++ b/testing/tests/ikev2/net2net-rfc3779/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-rfc3779/pretest.dat b/testing/tests/ikev2/net2net-rfc3779/pretest.dat index 545a3690e..9fe2860b9 100644 --- a/testing/tests/ikev2/net2net-rfc3779/pretest.dat +++ b/testing/tests/ikev2/net2net-rfc3779/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-rfc3779/test.conf b/testing/tests/ikev2/net2net-rfc3779/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-rfc3779/test.conf +++ b/testing/tests/ikev2/net2net-rfc3779/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-route/evaltest.dat b/testing/tests/ikev2/net2net-route/evaltest.dat index 63d1cde24..77ab6e7c6 100644 --- a/testing/tests/ikev2/net2net-route/evaltest.dat +++ b/testing/tests/ikev2/net2net-route/evaltest.dat @@ -3,6 +3,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-route/posttest.dat b/testing/tests/ikev2/net2net-route/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-route/posttest.dat +++ b/testing/tests/ikev2/net2net-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-route/pretest.dat b/testing/tests/ikev2/net2net-route/pretest.dat index 2eef7de19..e4ee3fac2 100644 --- a/testing/tests/ikev2/net2net-route/pretest.dat +++ b/testing/tests/ikev2/net2net-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/ikev2/net2net-route/test.conf b/testing/tests/ikev2/net2net-route/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-route/test.conf +++ b/testing/tests/ikev2/net2net-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-rsa/evaltest.dat b/testing/tests/ikev2/net2net-rsa/evaltest.dat index e47e709e2..bc03a39fb 100644 --- a/testing/tests/ikev2/net2net-rsa/evaltest.dat +++ b/testing/tests/ikev2/net2net-rsa/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-rsa/posttest.dat b/testing/tests/ikev2/net2net-rsa/posttest.dat index a199946aa..f7fe7dc48 100644 --- a/testing/tests/ikev2/net2net-rsa/posttest.dat +++ b/testing/tests/ikev2/net2net-rsa/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/private/moonKey.der sun::rm /etc/ipsec.d/private/sunKey.der diff --git a/testing/tests/ikev2/net2net-rsa/pretest.dat b/testing/tests/ikev2/net2net-rsa/pretest.dat index 9e40684ab..0f4ae0f4f 100644 --- a/testing/tests/ikev2/net2net-rsa/pretest.dat +++ b/testing/tests/ikev2/net2net-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* sun::rm /etc/ipsec.d/cacerts/* moon::ipsec start diff --git a/testing/tests/ikev2/net2net-rsa/test.conf b/testing/tests/ikev2/net2net-rsa/test.conf index f74d0f7d6..afa2accbe 100644 --- a/testing/tests/ikev2/net2net-rsa/test.conf +++ b/testing/tests/ikev2/net2net-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-same-nets/evaltest.dat b/testing/tests/ikev2/net2net-same-nets/evaltest.dat index 1ca7e2d60..3b479cefa 100644 --- a/testing/tests/ikev2/net2net-same-nets/evaltest.dat +++ b/testing/tests/ikev2/net2net-same-nets/evaltest.dat @@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 10.6.0.10::64 bytes from 10.6.0.10: icmp_seq=1::YES -bob:: ping -c 1 10.9.0.10::64 bytes from 10.9.0.10: icmp_seq=1::YES +alice::ping -c 1 10.6.0.10::64 bytes from 10.6.0.10: icmp_req=1::YES +bob:: ping -c 1 10.9.0.10::64 bytes from 10.9.0.10: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES bob::tcpdump::IP 10.9.0.10 > bob.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown b/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown index c64158a2f..bdba3fb05 100755 --- a/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown +++ b/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown @@ -73,8 +73,12 @@ # just the host, this will be 255.255.255.255. # # PLUTO_MY_SOURCEIP -# if non-empty, then the source address for the route will be -# set to this IP address. +# PLUTO_MY_SOURCEIP4_$i +# PLUTO_MY_SOURCEIP6_$i +# contains IPv4/IPv6 virtual IP received from a responder, +# $i enumerates from 1 to the number of IP per address family. +# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first +# virtual IP, IPv4 or IPv6. # # PLUTO_MY_PROTOCOL # is the IP protocol that will be transported. @@ -128,9 +132,15 @@ # contains the remote UDP port in the case of ESP_IN_UDP # encapsulation # +# PLUTO_DNS4_$i +# PLUTO_DNS6_$i +# contains IPv4/IPv6 DNS server attribute received from a +# responder, $i enumerates from 1 to the number of servers per +# address family. +# # define a minimum PATH environment in case it is not set -PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin" export PATH # check parameter(s) @@ -196,8 +206,8 @@ up-client:) iptables -t nat -A PREROUTING -i $INT_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ -d $OUT_NET -j NETMAP --to $SAME_NET iptables -I FORWARD 1 -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT -j ACCEPT - iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ - -s $SAME_NET -j NETMAP --to $IN_NET + iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ + -s $SAME_NET -j NETMAP --to $IN_NET fi ;; down-client:) @@ -215,7 +225,11 @@ down-client:) if [ -n "$PLUTO_MARK_OUT" ] then iptables -t mangle -D PREROUTING $SET_MARK_OUT + iptables -t nat -D PREROUTING -i $INT_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ + -d $OUT_NET -j NETMAP --to $SAME_NET iptables -D FORWARD -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT -j ACCEPT + iptables -t nat -D POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \ + -s $SAME_NET -j NETMAP --to $IN_NET fi ;; *) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2 diff --git a/testing/tests/ikev2/net2net-same-nets/posttest.dat b/testing/tests/ikev2/net2net-same-nets/posttest.dat index e75e66650..b0225c37e 100644 --- a/testing/tests/ikev2/net2net-same-nets/posttest.dat +++ b/testing/tests/ikev2/net2net-same-nets/posttest.dat @@ -2,6 +2,6 @@ sun::iptables -t mangle -n -v -L PREROUTING sun::iptables -t nat -n -v -L moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::conntrack -F diff --git a/testing/tests/ikev2/net2net-same-nets/pretest.dat b/testing/tests/ikev2/net2net-same-nets/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/net2net-same-nets/pretest.dat +++ b/testing/tests/ikev2/net2net-same-nets/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/net2net-same-nets/test.conf b/testing/tests/ikev2/net2net-same-nets/test.conf index 1971a33ab..f46f137b4 100644 --- a/testing/tests/ikev2/net2net-same-nets/test.conf +++ b/testing/tests/ikev2/net2net-same-nets/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-start/evaltest.dat b/testing/tests/ikev2/net2net-start/evaltest.dat index dbd06104f..f003f822f 100644 --- a/testing/tests/ikev2/net2net-start/evaltest.dat +++ b/testing/tests/ikev2/net2net-start/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-start/posttest.dat b/testing/tests/ikev2/net2net-start/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/ikev2/net2net-start/posttest.dat +++ b/testing/tests/ikev2/net2net-start/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/net2net-start/pretest.dat b/testing/tests/ikev2/net2net-start/pretest.dat index 8f3d17207..9d23c553e 100644 --- a/testing/tests/ikev2/net2net-start/pretest.dat +++ b/testing/tests/ikev2/net2net-start/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ipsec start sun::sleep 2 moon::ipsec start diff --git a/testing/tests/ikev2/net2net-start/test.conf b/testing/tests/ikev2/net2net-start/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/ikev2/net2net-start/test.conf +++ b/testing/tests/ikev2/net2net-start/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index dda793f44..4e2cc2860 100755 --- a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ - -resp_no_certs -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-local-cert/test.conf b/testing/tests/ikev2/ocsp-local-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-local-cert/test.conf +++ b/testing/tests/ikev2/ocsp-local-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-multi-level/pretest.dat b/testing/tests/ikev2/ocsp-multi-level/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev2/ocsp-multi-level/pretest.dat +++ b/testing/tests/ikev2/ocsp-multi-level/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ocsp-multi-level/test.conf b/testing/tests/ikev2/ocsp-multi-level/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/ocsp-multi-level/test.conf +++ b/testing/tests/ikev2/ocsp-multi-level/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index 74d22b90d..429061376 100755 --- a/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey winnetouKey.pem -rsigner winnetouCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey winnetouKey.pem -rsigner winnetouCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-no-signer-cert/test.conf b/testing/tests/ikev2/ocsp-no-signer-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-no-signer-cert/test.conf +++ b/testing/tests/ikev2/ocsp-no-signer-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-revoked/test.conf b/testing/tests/ikev2/ocsp-revoked/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-revoked/test.conf +++ b/testing/tests/ikev2/ocsp-revoked/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index e998b6ad0..59c356302 100755 --- a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey strongswanKey.pem -rsigner strongswanCert.pem \ - -resp_no_certs -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey strongswanKey.pem -rsigner strongswanCert.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-root-cert/test.conf b/testing/tests/ikev2/ocsp-root-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-root-cert/test.conf +++ b/testing/tests/ikev2/ocsp-root-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-signer-cert/test.conf b/testing/tests/ikev2/ocsp-signer-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-signer-cert/test.conf +++ b/testing/tests/ikev2/ocsp-signer-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat b/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat index f15265e32..86dd31e83 100644 --- a/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat +++ b/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/ocsp-strict-ifuri/test.conf b/testing/tests/ikev2/ocsp-strict-ifuri/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/ocsp-strict-ifuri/test.conf +++ b/testing/tests/ikev2/ocsp-strict-ifuri/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index 92aa920aa..aa70321d5 100755 --- a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -6,9 +6,9 @@ echo "Content-type: application/ocsp-response" echo "" # simulate a delayed response -sleep 5 +sleep 5 -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey.pem -rsigner ocspCert.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-timeouts-good/test.conf b/testing/tests/ikev2/ocsp-timeouts-good/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-timeouts-good/test.conf +++ b/testing/tests/ikev2/ocsp-timeouts-good/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi index 20c4b2a22..72aa7a6c4 100755 --- a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -5,7 +5,7 @@ cd /etc/openssl echo "Content-type: application/ocsp-response" echo "" -/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ - -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ - -nmin 5 \ - -reqin /dev/stdin -respout /dev/stdout +cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout | cat diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf index 2b240d895..892f51cd9 100644 --- a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf +++ b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon carol winnetou" +VIRTHOSTS="moon carol winnetou" # Corresponding block diagram # DIAGRAM="m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-dual/evaltest.dat b/testing/tests/ikev2/protoport-dual/evaltest.dat index a65460cc8..cf45f3b52 100644 --- a/testing/tests/ikev2/protoport-dual/evaltest.dat +++ b/testing/tests/ikev2/protoport-dual/evaltest.dat @@ -2,8 +2,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/protoport-dual/posttest.dat b/testing/tests/ikev2/protoport-dual/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/protoport-dual/posttest.dat +++ b/testing/tests/ikev2/protoport-dual/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/protoport-dual/pretest.dat b/testing/tests/ikev2/protoport-dual/pretest.dat index d3d0061c3..efb2e5712 100644 --- a/testing/tests/ikev2/protoport-dual/pretest.dat +++ b/testing/tests/ikev2/protoport-dual/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/protoport-dual/test.conf b/testing/tests/ikev2/protoport-dual/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/protoport-dual/test.conf +++ b/testing/tests/ikev2/protoport-dual/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-route/evaltest.dat b/testing/tests/ikev2/protoport-route/evaltest.dat index 83a5e1bde..75c547995 100644 --- a/testing/tests/ikev2/protoport-route/evaltest.dat +++ b/testing/tests/ikev2/protoport-route/evaltest.dat @@ -1,5 +1,5 @@ -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req::YES carol::ssh PH_IP_ALICE hostname::alice::YES carol::cat /var/log/daemon.log::creating acquire job::YES carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED::YES diff --git a/testing/tests/ikev2/protoport-route/posttest.dat b/testing/tests/ikev2/protoport-route/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/protoport-route/posttest.dat +++ b/testing/tests/ikev2/protoport-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/protoport-route/pretest.dat b/testing/tests/ikev2/protoport-route/pretest.dat index 0aded0f4d..5a15574d6 100644 --- a/testing/tests/ikev2/protoport-route/pretest.dat +++ b/testing/tests/ikev2/protoport-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/protoport-route/test.conf b/testing/tests/ikev2/protoport-route/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/protoport-route/test.conf +++ b/testing/tests/ikev2/protoport-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/reauth-early/evaltest.dat b/testing/tests/ikev2/reauth-early/evaltest.dat index 1d3a35916..dbc6f8d97 100644 --- a/testing/tests/ikev2/reauth-early/evaltest.dat +++ b/testing/tests/ikev2/reauth-early/evaltest.dat @@ -1,6 +1,6 @@ moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home\[2]: ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::cat /var/log/daemon.log::received AUTH_LIFETIME of 30s, scheduling reauthentication in 25s::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/reauth-early/posttest.dat b/testing/tests/ikev2/reauth-early/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/reauth-early/posttest.dat +++ b/testing/tests/ikev2/reauth-early/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/reauth-early/pretest.dat b/testing/tests/ikev2/reauth-early/pretest.dat index 7ed2423be..153ea7c43 100644 --- a/testing/tests/ikev2/reauth-early/pretest.dat +++ b/testing/tests/ikev2/reauth-early/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/reauth-early/test.conf b/testing/tests/ikev2/reauth-early/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/reauth-early/test.conf +++ b/testing/tests/ikev2/reauth-early/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/reauth-late/evaltest.dat b/testing/tests/ikev2/reauth-late/evaltest.dat index d86758f9a..205a4d9e7 100644 --- a/testing/tests/ikev2/reauth-late/evaltest.dat +++ b/testing/tests/ikev2/reauth-late/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home\[2]: ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::cat /var/log/daemon.log::scheduling reauthentication in 2[0-5]s::YES carol::cat /var/log/daemon.log::received AUTH_LIFETIME of 360[01]s, reauthentication already scheduled in 2[0-5]s::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/reauth-late/posttest.dat b/testing/tests/ikev2/reauth-late/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/reauth-late/posttest.dat +++ b/testing/tests/ikev2/reauth-late/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/reauth-late/pretest.dat b/testing/tests/ikev2/reauth-late/pretest.dat index 7ed2423be..153ea7c43 100644 --- a/testing/tests/ikev2/reauth-late/pretest.dat +++ b/testing/tests/ikev2/reauth-late/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/reauth-late/test.conf b/testing/tests/ikev2/reauth-late/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/reauth-late/test.conf +++ b/testing/tests/ikev2/reauth-late/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-cert/evaltest.dat b/testing/tests/ikev2/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/ikev2/rw-cert/evaltest.dat +++ b/testing/tests/ikev2/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-cert/posttest.dat b/testing/tests/ikev2/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-cert/posttest.dat +++ b/testing/tests/ikev2/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-cert/pretest.dat b/testing/tests/ikev2/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-cert/pretest.dat +++ b/testing/tests/ikev2/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-cert/test.conf b/testing/tests/ikev2/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-cert/test.conf +++ b/testing/tests/ikev2/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat index a39bf3afe..d59eef513 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat @@ -7,7 +7,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf b/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat index 2abfdd19b..0ea4e21ab 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat @@ -6,7 +6,7 @@ moon:: ipsec status 2> /dev/null::rw-eap-aka.*ESTABLISHED.*moon.strongswan.org.* carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap-aka.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/test.conf b/testing/tests/ikev2/rw-eap-aka-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-aka-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-aka-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat b/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat index 9c6ae73e9..6a20b8e8c 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat @@ -15,8 +15,8 @@ moon:: ipsec status 2> /dev/null::rw-eap[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-eap[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-dynamic/posttest.dat b/testing/tests/ikev2/rw-eap-dynamic/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/posttest.dat +++ b/testing/tests/ikev2/rw-eap-dynamic/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-dynamic/pretest.dat b/testing/tests/ikev2/rw-eap-dynamic/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/pretest.dat +++ b/testing/tests/ikev2/rw-eap-dynamic/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-dynamic/test.conf b/testing/tests/ikev2/rw-eap-dynamic/test.conf index a71d09e9d..a5525e6aa 100644 --- a/testing/tests/ikev2/rw-eap-dynamic/test.conf +++ b/testing/tests/ikev2/rw-eap-dynamic/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/.pretest.dat.swp b/testing/tests/ikev2/rw-eap-md5-class-radius/.pretest.dat.swp Binary files differdeleted file mode 100644 index 16a289d4c..000000000 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/.pretest.dat.swp +++ /dev/null diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat index 705d9ba6e..aa6d4291b 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat @@ -18,8 +18,9 @@ dave ::ipsec status 2> /dev/null::alice.*ESTABLISHED.*PH_IP_DAVE.*moon.strongswa moon ::ipsec status 2> /dev/null::accounting.*INSTALLED, TUNNEL::YES dave ::ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::NO dave ::ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES -moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org::ESP::YES -moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org::ESP:YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/proxy.conf index 783587b55..783587b55 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/sites-available/default index 2de32a6f2..a67a5dcb4 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/sites-available/default @@ -40,4 +40,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users index 62d459115..62d459115 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat index 6d6ad38ba..a2704e833 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start @@ -9,5 +9,5 @@ carol::sleep 1 carol::ipsec up alice carol::ipsec up venus dave::ipsec up alice -dave::ipsec up venus +dave::ipsec up venus dave::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf index 61dbc09d7..5dfb41723 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou moon" +VIRTHOSTS="alice venus moon carol winnetou moon" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat index a239b56e7..42d2c319e 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat @@ -2,13 +2,13 @@ carol::cat /var/log/daemon.log::configured EAP-Identity carol::YES carol::cat /var/log/daemon.log::added EAP secret for carol moon.strongswan.org::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES -moon:: cat /var/log/daemon.log::authentication of '192.168.0.100' with EAP successful::YES +moon:: cat /var/log/daemon.log::authentication of 'PH_IP_CAROL' with EAP successful::YES moon:: cat /var/log/daemon.log::received EAP identity.*carol::YES -moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[192.168.0.100]::YES -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*moon.strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[PH_IP_CAROL]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat index 9c301f484..180537f5f 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf b/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat index 73f606be3..8f813395a 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat @@ -7,7 +7,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/proxy.conf index 783587b55..783587b55 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/sites-available/default index 2de32a6f2..a67a5dcb4 100644 --- a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/sites-available/default @@ -40,4 +40,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat index 525d987af..a8019b3e7 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat @@ -6,6 +6,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-md5-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat index dd67704eb..84f41fd93 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat @@ -5,7 +5,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/test.conf b/testing/tests/ikev2/rw-eap-md5-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-md5-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-md5-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat index eafd09b80..010f48315 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat @@ -3,11 +3,11 @@ carol::cat /var/log/daemon.log::server requested EAP_MSCHAPV2 authentication::YE carol::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with EAP successful::YES moon:: cat /var/log/daemon.log::received EAP identity.*carol::YES moon:: cat /var/log/daemon.log::authentication of .*PH_IP_CAROL.* with EAP successful::YES -moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[192.168.0.100]::YES -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*moon.strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[PH_IP_CAROL]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat index 871d3b931..4ed5257b1 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat @@ -18,6 +18,6 @@ moon:: ipsec status 2> /dev/null::rw-eap[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-eap[{]2}.*INSTALLED::NO carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat b/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat +++ b/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat b/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat +++ b/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-peap-md5/test.conf b/testing/tests/ikev2/rw-eap-peap-md5/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-peap-md5/test.conf +++ b/testing/tests/ikev2/rw-eap-peap-md5/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat index 643b2c39d..fc75e1c9a 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@stronswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf b/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf +++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat index 81244bd85..95c29b7f5 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/eap.conf index df50901d5..11d3e2acd 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/eap.conf @@ -1,7 +1,7 @@ eap { md5 { } - default_eap_type = peap + default_eap_type = peap tls { private_key_file = /etc/raddb/certs/aaaKey.pem certificate_file = /etc/raddb/certs/aaaCert.pem diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat b/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat b/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat index cbe1ae229..3e7fc0bb1 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-peap-radius/test.conf b/testing/tests/ikev2/rw-eap-peap-radius/test.conf index e6a786a94..20d586309 100644 --- a/testing/tests/ikev2/rw-eap-peap-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-peap-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol winnetou dave moon" +VIRTHOSTS="alice carol winnetou dave moon" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat index 7f1def4a5..f1a68bc19 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat @@ -7,6 +7,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files new file mode 100644 index 000000000..10c26aa15 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files @@ -0,0 +1,3 @@ +sim_files { + simtriplets = "/etc/freeradius/triplets.dat" +} diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/proxy.conf index 783587b55..783587b55 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/sites-available/default index 92896b11e..893529324 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/sites-available/default @@ -40,4 +40,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/triplets.dat index c167ba940..c167ba940 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/triplets.dat diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat index 0da980c07..b9117af36 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat index f2654766a..f434ddfc6 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat @@ -4,7 +4,7 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES @@ -12,4 +12,4 @@ moon:: cat /var/log/daemon.log::EAP method EAP_SIM failed for peer dave@strongsw moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files new file mode 100644 index 000000000..10c26aa15 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files @@ -0,0 +1,3 @@ +sim_files { + simtriplets = "/etc/freeradius/triplets.dat" +} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/sites-available/default index 126d61d05..fbdf75f4c 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/triplets.dat index fd0eb19b9..3e9a644eb 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/triplets.dat @@ -4,4 +4,3 @@ carol@strongswan.org,32000000000000000000000000000000,32112233,325566778899AABB dave@strongswan.org,33000000000000000000000000000000,33112233,335566778899AABB dave@strongswan.org,34000000000000000000000000000000,34112233,345566778899AABB dave@strongswan.org,35000000000000000000000000000000,35112233,355566778899AABB - diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat index 5a51733dc..0b3e901c2 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat @@ -1,11 +1,11 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf index bb6b68687..29bfaa78c 100644 --- a/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat index 8e12c29d0..21cfe429a 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat @@ -4,7 +4,7 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES @@ -12,4 +12,4 @@ moon:: cat /var/log/daemon.log::EAP method EAP_SIM failed for peer dave@strongsw moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf new file mode 100644 index 000000000..7d8023951 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf @@ -0,0 +1,5 @@ +eap { + default_eap_type = sim + sim { + } +} diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/sites-available/default index dfceb037d..91425f812 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/sites-available/default @@ -59,4 +59,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/triplets.dat index fd0eb19b9..3e9a644eb 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/triplets.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/triplets.dat @@ -4,4 +4,3 @@ carol@strongswan.org,32000000000000000000000000000000,32112233,325566778899AABB dave@strongswan.org,33000000000000000000000000000000,33112233,335566778899AABB dave@strongswan.org,34000000000000000000000000000000,34112233,345566778899AABB dave@strongswan.org,35000000000000000000000000000000,35112233,355566778899AABB - diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/users index e69de29bb..e69de29bb 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf deleted file mode 100644 index a2020424e..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf +++ /dev/null @@ -1,5 +0,0 @@ -eap { - default_eap_type = sim - sim { - } -} diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index d77b818fe..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,123 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf - sim_files { - simtriplets = "/etc/raddb/triplets.dat" - } -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat index b3fd4cbf1..c17bec0f7 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat @@ -1,11 +1,11 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::cat /etc/raddb/clients.conf -alice::cat /etc/raddb/eap.conf -alice::cat /etc/raddb/proxy.conf -alice::cat /etc/raddb/triplets.dat -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::cat /etc/freeradius/clients.conf +alice::cat /etc/freeradius/eap.conf +alice::cat /etc/freeradius/proxy.conf +alice::cat /etc/freeradius/triplets.dat +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-sim-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-radius/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-radius/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat index ade9306cf..ab27b4510 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat @@ -5,6 +5,6 @@ moon:: ipsec status 2> /dev/null::rw-eap-sim.*ESTABLISHED.*moon.strongswan.org.* carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap-sim.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat +++ b/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat index 23c7a62b2..ae464b51c 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat +++ b/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::cat /etc/ipsec.d/triplets.dat carol::cat /etc/ipsec.d/triplets.dat moon::ipsec start diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/test.conf b/testing/tests/ikev2/rw-eap-sim-rsa/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-sim-rsa/test.conf +++ b/testing/tests/ikev2/rw-eap-sim-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat index 4db0a30b4..314769b3e 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat @@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, C moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=carol@d.strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat index 085b19509..e8156ea70 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat +++ b/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/cacerts/* moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat index 35d35dc86..3d680ab78 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat +++ b/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat @@ -1,7 +1,7 @@ moon::rm /etc/ipsec.d/cacerts/strongswanCert.pem carol::rm /etc/ipsec.d/cacerts/strongswanCert.pem -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/test.conf b/testing/tests/ikev2/rw-eap-tls-fragments/test.conf index 2bd21499b..e093d43d8 100644 --- a/testing/tests/ikev2/rw-eap-tls-fragments/test.conf +++ b/testing/tests/ikev2/rw-eap-tls-fragments/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat index 96417face..a436131bf 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat @@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN= moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, CN=carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat +++ b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat +++ b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-tls-only/test.conf b/testing/tests/ikev2/rw-eap-tls-only/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/ikev2/rw-eap-tls-only/test.conf +++ b/testing/tests/ikev2/rw-eap-tls-only/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat index 21190669e..7584e14dc 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat @@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN= moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, CN=carol@strongswan.org' with EAP successful::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/eap.conf index 92f96ad66..92f96ad66 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/sites-available/default index 990184919..18ebf9e9d 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/sites-available/default @@ -39,4 +39,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat b/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat index 920d6a20d..181949fb5 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop carol::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat b/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat index 280d62e3c..9adc43d3e 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-tls-radius/test.conf b/testing/tests/ikev2/rw-eap-tls-radius/test.conf index e0d77b583..eb1e15dd2 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-tls-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol moon" +VIRTHOSTS="alice carol moon" # Corresponding block diagram # DIAGRAM="a-m-c.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat index 941bb2985..d22dd18db 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@stronswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat index 369596177..589d478e7 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat @@ -1,10 +1,10 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +carol::sleep 2 carol::ipsec up home dave::ipsec up home -dave::sleep 1 +dave::sleep 2 diff --git a/testing/tests/ikev2/rw-eap-ttls-only/test.conf b/testing/tests/ikev2/rw-eap-ttls-only/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/test.conf +++ b/testing/tests/ikev2/rw-eap-ttls-only/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat index 941bb2985..d22dd18db 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat @@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@stronswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat index 369596177..17f1b5f2b 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat index ff08ae792..a471a2cfa 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat @@ -14,7 +14,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@strongswan.org::NO carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/eap.conf index c91cd40fb..c91cd40fb 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/default index 802fcfd8d..dd0825858 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/default @@ -41,4 +41,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat index dbe56013a..670d2e72f 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -alice::/etc/init.d/radiusd stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::killall radiusd +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat index cbe1ae229..3e7fc0bb1 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat +++ b/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::radiusd moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/test.conf b/testing/tests/ikev2/rw-eap-ttls-radius/test.conf index e6a786a94..20d586309 100644 --- a/testing/tests/ikev2/rw-eap-ttls-radius/test.conf +++ b/testing/tests/ikev2/rw-eap-ttls-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice carol winnetou dave moon" +VIRTHOSTS="alice carol winnetou dave moon" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-hash-and-url/evaltest.dat b/testing/tests/ikev2/rw-hash-and-url/evaltest.dat index c52036028..7a9a70939 100644 --- a/testing/tests/ikev2/rw-hash-and-url/evaltest.dat +++ b/testing/tests/ikev2/rw-hash-and-url/evaltest.dat @@ -10,8 +10,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-hash-and-url/posttest.dat b/testing/tests/ikev2/rw-hash-and-url/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-hash-and-url/posttest.dat +++ b/testing/tests/ikev2/rw-hash-and-url/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-hash-and-url/pretest.dat b/testing/tests/ikev2/rw-hash-and-url/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-hash-and-url/pretest.dat +++ b/testing/tests/ikev2/rw-hash-and-url/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-hash-and-url/test.conf b/testing/tests/ikev2/rw-hash-and-url/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-hash-and-url/test.conf +++ b/testing/tests/ikev2/rw-hash-and-url/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-mark-in-out/description.txt b/testing/tests/ikev2/rw-mark-in-out/description.txt index 4c35081b1..3012fc656 100644 --- a/testing/tests/ikev2/rw-mark-in-out/description.txt +++ b/testing/tests/ikev2/rw-mark-in-out/description.txt @@ -1,7 +1,7 @@ The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the router <b>moon</b> set up tunnels to gateway <b>sun</b>. Since both roadwarriors possess the same 10.1.0.0/25 subnet, -gateway <b>sun</b> uses Source NAT after ESP decryption to map these subnets to 10.3.0.10 -and 10.3.0.20, respectively. +gateway <b>sun</b> uses Source NAT after ESP decryption to map these subnets to PH_IP_CAROL10 +and PH_IP_DAVE10, respectively. <p/> In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively, <b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using diff --git a/testing/tests/ikev2/rw-mark-in-out/evaltest.dat b/testing/tests/ikev2/rw-mark-in-out/evaltest.dat index 4a93dc921..26b26204c 100644 --- a/testing/tests/ikev2/rw-mark-in-out/evaltest.dat +++ b/testing/tests/ikev2/rw-mark-in-out/evaltest.dat @@ -3,9 +3,9 @@ venus::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*alice@strongswan.org::YES sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES -sun:: ipsec statusall 2>::venus.*10.2.0.0/16 === 10.1.0.0/25::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES moon::tcpdump::IP alice.strongswan.org > sun.strongswan.org: ESP::YES moon::tcpdump::IP venus.strongswan.org > sun.strongswan.org: ESP::YES moon::tcpdump::IP sun.strongswan.org > alice.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 5594bbf52..000000000 --- a/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown b/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown index 0d22e684d..421335ffb 100755 --- a/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown +++ b/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown @@ -73,8 +73,12 @@ # just the host, this will be 255.255.255.255. # # PLUTO_MY_SOURCEIP -# if non-empty, then the source address for the route will be -# set to this IP address. +# PLUTO_MY_SOURCEIP4_$i +# PLUTO_MY_SOURCEIP6_$i +# contains IPv4/IPv6 virtual IP received from a responder, +# $i enumerates from 1 to the number of IP per address family. +# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first +# virtual IP, IPv4 or IPv6. # # PLUTO_MY_PROTOCOL # is the IP protocol that will be transported. @@ -128,9 +132,15 @@ # contains the remote UDP port in the case of ESP_IN_UDP # encapsulation # +# PLUTO_DNS4_$i +# PLUTO_DNS6_$i +# contains IPv4/IPv6 DNS server attribute received from a +# responder, $i enumerates from 1 to the number of servers per +# address family. +# # define a minimum PATH environment in case it is not set -PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" +PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin" export PATH # uncomment to log VPN connections diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables b/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 5594bbf52..000000000 --- a/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MOBIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-mark-in-out/posttest.dat b/testing/tests/ikev2/rw-mark-in-out/posttest.dat index fae79271b..283099acb 100644 --- a/testing/tests/ikev2/rw-mark-in-out/posttest.dat +++ b/testing/tests/ikev2/rw-mark-in-out/posttest.dat @@ -2,9 +2,9 @@ sun::iptables -t mangle -v -n -L PREROUTING sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush sun::ip route del 10.1.0.0/16 via PH_IP_MOON sun::conntrack -F sun::rm /etc/mark_updown diff --git a/testing/tests/ikev2/rw-mark-in-out/pretest.dat b/testing/tests/ikev2/rw-mark-in-out/pretest.dat index 3d9a5f340..8e9dd2f51 100644 --- a/testing/tests/ikev2/rw-mark-in-out/pretest.dat +++ b/testing/tests/ikev2/rw-mark-in-out/pretest.dat @@ -1,13 +1,12 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON sun::ip route add 10.1.0.0/16 via PH_IP_MOON -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to 10.3.0.10 -sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to 10.3.0.20 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.10 -j MARK --set-mark 11 -sun::iptables -t mangle -A PREROUTING -d 10.3.0.20 -j MARK --set-mark 21 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10 +sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10 +sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 11 +sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 21 alice::ipsec start venus::ipsec start sun::ipsec start diff --git a/testing/tests/ikev2/rw-mark-in-out/test.conf b/testing/tests/ikev2/rw-mark-in-out/test.conf index ae3c190b8..105472cbe 100644 --- a/testing/tests/ikev2/rw-mark-in-out/test.conf +++ b/testing/tests/ikev2/rw-mark-in-out/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon bob" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/rw-pkcs8/evaltest.dat b/testing/tests/ikev2/rw-pkcs8/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev2/rw-pkcs8/evaltest.dat +++ b/testing/tests/ikev2/rw-pkcs8/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-pkcs8/posttest.dat b/testing/tests/ikev2/rw-pkcs8/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-pkcs8/posttest.dat +++ b/testing/tests/ikev2/rw-pkcs8/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-pkcs8/pretest.dat b/testing/tests/ikev2/rw-pkcs8/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-pkcs8/pretest.dat +++ b/testing/tests/ikev2/rw-pkcs8/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-pkcs8/test.conf b/testing/tests/ikev2/rw-pkcs8/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-pkcs8/test.conf +++ b/testing/tests/ikev2/rw-pkcs8/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat index 683173c30..2fbcc474f 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat @@ -7,8 +7,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat +++ b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat index 282b2aec0..64ce593fb 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat +++ b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/rw-psk-fqdn/test.conf b/testing/tests/ikev2/rw-psk-fqdn/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-fqdn/test.conf +++ b/testing/tests/ikev2/rw-psk-fqdn/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat index 1ad36fcaf..2bd97b76c 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat @@ -1,13 +1,13 @@ -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*\[192.168.0.1]::YES -dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.200].*\[192.168.0.1]::YES -moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*\[192.168.0.1].*\[192.168.0.100]::YES -moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*\[192.168.0.1].*\[192.168.0.200]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*\[PH_IP_MOON]::YES +dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_DAVE].*\[PH_IP_MOON]::YES +moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*\[PH_IP_MOON].*\[PH_IP_CAROL]::YES +moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*\[PH_IP_MOON].*\[PH_IP_DAVE]::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets index 18a074472..57ce85d61 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets @@ -1,3 +1,3 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file -192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx +PH_IP_CAROL : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets index e989540e9..111de272b 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets @@ -1,3 +1,3 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file -192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN +PH_IP_DAVE : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets index ab3fb129b..6706534eb 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets @@ -1,5 +1,5 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file -192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx +PH_IP_CAROL : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx -192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN +PH_IP_DAVE : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat +++ b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat index 282b2aec0..64ce593fb 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat +++ b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/rw-psk-ipv4/test.conf b/testing/tests/ikev2/rw-psk-ipv4/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-ipv4/test.conf +++ b/testing/tests/ikev2/rw-psk-ipv4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat +++ b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat index 282b2aec0..64ce593fb 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat +++ b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::rm /etc/ipsec.d/cacerts/* carol::rm /etc/ipsec.d/cacerts/* dave::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/rw-psk-no-idr/test.conf b/testing/tests/ikev2/rw-psk-no-idr/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-no-idr/test.conf +++ b/testing/tests/ikev2/rw-psk-no-idr/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat index 51e868760..ab398a3bb 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat @@ -1,13 +1,13 @@ moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES moon:: cat /var/log/daemon.log::authentication of 'PH_IP_MOON' (myself) with pre-shared key::YES moon:: ipsec status 2> /dev/null::rw-psk.*INSTALLED, TUNNEL::YES -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*\[192.168.0.1]::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*\[PH_IP_MOON]::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES moon:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' (myself) with RSA signature successful::YES moon:: ipsec status 2> /dev/null::rw-rsasig.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat index e48d11e42..446f81426 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::rm /etc/ipsec.d/cacerts/* moon::ipsec start carol::ipsec start diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat index 9a1ab3f8f..1648c9557 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat @@ -9,8 +9,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat +++ b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/rw-psk-rsa-split/test.conf b/testing/tests/ikev2/rw-psk-rsa-split/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/rw-psk-rsa-split/test.conf +++ b/testing/tests/ikev2/rw-psk-rsa-split/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-radius-accounting/evaltest.dat b/testing/tests/ikev2/rw-radius-accounting/evaltest.dat index 5c453f8b4..ccbc769e2 100644 --- a/testing/tests/ikev2/rw-radius-accounting/evaltest.dat +++ b/testing/tests/ikev2/rw-radius-accounting/evaltest.dat @@ -9,6 +9,6 @@ carol::ping -c 5 -s 1392 PH_IP_ALICE::1400 bytes from PH_IP_ALICE::YES carol::ipsec down home 2> /dev/null::no output expected::NO moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES -alice::cat /var/log/radius/radacct/10.1.0.1/*::User-Name =.*carol::YES -alice::cat /var/log/radius/radacct/10.1.0.1/*::Acct-Output-Octets = 7100::YES -alice::cat /var/log/radius/radacct/10.1.0.1/*::Acct-Input-Octets = 7100::YES +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::User-Name =.*carol::YES +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::Acct-Output-Octets = 7100::YES +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::Acct-Input-Octets = 7100::YES diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf index 623f42904..623f42904 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf index 783587b55..783587b55 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default index 2de32a6f2..a67a5dcb4 100644 --- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/sites-available/default +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default @@ -40,4 +40,3 @@ pre-proxy { post-proxy { eap } - diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/users index 247b918e3..247b918e3 100644 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/users +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/users diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 962a418d9..000000000 --- a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,88 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow RADIUS accounting protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1813 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1813 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..b9560a38e --- /dev/null +++ b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules @@ -0,0 +1,36 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +# allow RADIUS accounting protocol with alice +-A INPUT -i eth1 -p udp --sport 1813 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1813 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/rw-radius-accounting/posttest.dat b/testing/tests/ikev2/rw-radius-accounting/posttest.dat index b1f971402..98f7a6954 100644 --- a/testing/tests/ikev2/rw-radius-accounting/posttest.dat +++ b/testing/tests/ikev2/rw-radius-accounting/posttest.dat @@ -1,7 +1,6 @@ carol::ipsec stop moon::ipsec stop -alice::/etc/init.d/radiusd stop -alice::cat /var/log/radius/radacct/10.1.0.1/* -carol::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null - +alice::killall radiusd +alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/* +carol::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-radius-accounting/pretest.dat b/testing/tests/ikev2/rw-radius-accounting/pretest.dat index 30c8bd573..9f437fe85 100644 --- a/testing/tests/ikev2/rw-radius-accounting/pretest.dat +++ b/testing/tests/ikev2/rw-radius-accounting/pretest.dat @@ -1,7 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -alice::rm /var/log/radius/radacct/10.1.0.1/* -alice::/etc/init.d/radiusd start +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +alice::rm /var/log/freeradius/radacct/PH_IP_MOON1/* +alice::radiusd moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/rw-radius-accounting/test.conf b/testing/tests/ikev2/rw-radius-accounting/test.conf index f2d20e984..6dbb1c7fd 100644 --- a/testing/tests/ikev2/rw-radius-accounting/test.conf +++ b/testing/tests/ikev2/rw-radius-accounting/test.conf @@ -1,25 +1,25 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/ikev2/rw-whitelist/evaltest.dat b/testing/tests/ikev2/rw-whitelist/evaltest.dat index d6f71d7c0..9418d6ee1 100644 --- a/testing/tests/ikev2/rw-whitelist/evaltest.dat +++ b/testing/tests/ikev2/rw-whitelist/evaltest.dat @@ -3,10 +3,10 @@ moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with RS moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES moon:: cat /var/log/daemon.log::peer identity 'dave@strongswan.org' not whitelisted::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log:: received AUTHENTICATION_FAILED notify error::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-whitelist/posttest.dat b/testing/tests/ikev2/rw-whitelist/posttest.dat index 1777f439f..b757d8b15 100644 --- a/testing/tests/ikev2/rw-whitelist/posttest.dat +++ b/testing/tests/ikev2/rw-whitelist/posttest.dat @@ -1,6 +1,6 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/rw-whitelist/pretest.dat b/testing/tests/ikev2/rw-whitelist/pretest.dat index c4ac77d77..87760775a 100644 --- a/testing/tests/ikev2/rw-whitelist/pretest.dat +++ b/testing/tests/ikev2/rw-whitelist/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/rw-whitelist/test.conf b/testing/tests/ikev2/rw-whitelist/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/rw-whitelist/test.conf +++ b/testing/tests/ikev2/rw-whitelist/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/shunt-policies/evaltest.dat b/testing/tests/ikev2/shunt-policies/evaltest.dat index f40437e3e..a6e40a817 100644 --- a/testing/tests/ikev2/shunt-policies/evaltest.dat +++ b/testing/tests/ikev2/shunt-policies/evaltest.dat @@ -1,15 +1,15 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO +venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES venus::ssh PH_IP_BOB hostname::bob::YES diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 2b90a14c7..000000000 --- a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow icmp in local net - iptables -A INPUT -i eth1 -p icmp -j ACCEPT - iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf index 90a5d61b1..46ca4cdc3 100644 --- a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf @@ -18,7 +18,7 @@ conn local-net auto=route conn venus-icmp - leftsubnet=10.1.0.20/32 + leftsubnet=PH_IP_VENUS/32 rightsubnet=0.0.0.0/0 leftprotoport=icmp rightprotoport=icmp diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..af0f25209 --- /dev/null +++ b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow icmp in local net +-A INPUT -i eth1 -p icmp -j ACCEPT +-A OUTPUT -o eth1 -p icmp -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/shunt-policies/posttest.dat b/testing/tests/ikev2/shunt-policies/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/ikev2/shunt-policies/posttest.dat +++ b/testing/tests/ikev2/shunt-policies/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/shunt-policies/pretest.dat b/testing/tests/ikev2/shunt-policies/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/ikev2/shunt-policies/pretest.dat +++ b/testing/tests/ikev2/shunt-policies/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/ikev2/shunt-policies/test.conf b/testing/tests/ikev2/shunt-policies/test.conf index cf2ef7424..6b7432ca6 100644 --- a/testing/tests/ikev2/shunt-policies/test.conf +++ b/testing/tests/ikev2/shunt-policies/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/strong-keys-certs/evaltest.dat b/testing/tests/ikev2/strong-keys-certs/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/ikev2/strong-keys-certs/evaltest.dat +++ b/testing/tests/ikev2/strong-keys-certs/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/strong-keys-certs/posttest.dat b/testing/tests/ikev2/strong-keys-certs/posttest.dat index 9ccbaa1c2..3fd6a690e 100644 --- a/testing/tests/ikev2/strong-keys-certs/posttest.dat +++ b/testing/tests/ikev2/strong-keys-certs/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/private/* dave::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/strong-keys-certs/pretest.dat b/testing/tests/ikev2/strong-keys-certs/pretest.dat index de51ccdfa..dea5fc162 100644 --- a/testing/tests/ikev2/strong-keys-certs/pretest.dat +++ b/testing/tests/ikev2/strong-keys-certs/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/ikev2/strong-keys-certs/test.conf b/testing/tests/ikev2/strong-keys-certs/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/ikev2/strong-keys-certs/test.conf +++ b/testing/tests/ikev2/strong-keys-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/two-certs/evaltest.dat b/testing/tests/ikev2/two-certs/evaltest.dat index f50e7c30d..2b4476afa 100644 --- a/testing/tests/ikev2/two-certs/evaltest.dat +++ b/testing/tests/ikev2/two-certs/evaltest.dat @@ -1,11 +1,11 @@ moon:: cat /var/log/daemon.log::using certificate.*OU=Research, CN=carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::alice.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::signature validation failed, looking for another key::YES moon:: cat /var/log/daemon.log::using certificate.*OU=Research, SN=002, CN=carol@strongswan.org::YES moon:: ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::venus.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf index a0f44e312..9ec202e3d 100644 --- a/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf @@ -18,11 +18,11 @@ conn %default conn alice leftcert=carolCert.pem - rightsubnet=10.1.0.10/32 + rightsubnet=PH_IP_ALICE/32 auto=add conn venus leftcert=carolCert-002.pem - rightsubnet=10.1.0.20/32 + rightsubnet=PH_IP_VENUS/32 auto=add diff --git a/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf index dac656243..d8f1443ac 100644 --- a/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf @@ -23,10 +23,10 @@ conn %default keyexchange=ikev2 conn alice - leftsubnet=10.1.0.10/32 + leftsubnet=PH_IP_ALICE/32 auto=add conn venus - leftsubnet=10.1.0.20/32 + leftsubnet=PH_IP_VENUS/32 auto=add diff --git a/testing/tests/ikev2/two-certs/posttest.dat b/testing/tests/ikev2/two-certs/posttest.dat index a1f067838..eae8c27d4 100644 --- a/testing/tests/ikev2/two-certs/posttest.dat +++ b/testing/tests/ikev2/two-certs/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/two-certs/pretest.dat b/testing/tests/ikev2/two-certs/pretest.dat index 716cf71e8..fe2aaec19 100644 --- a/testing/tests/ikev2/two-certs/pretest.dat +++ b/testing/tests/ikev2/two-certs/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/ikev2/two-certs/test.conf b/testing/tests/ikev2/two-certs/test.conf index d0306cd25..3f6afa02e 100644 --- a/testing/tests/ikev2/two-certs/test.conf +++ b/testing/tests/ikev2/two-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou" +VIRTHOSTS="alice venus moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/virtual-ip-override/posttest.dat b/testing/tests/ikev2/virtual-ip-override/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/virtual-ip-override/posttest.dat +++ b/testing/tests/ikev2/virtual-ip-override/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/virtual-ip-override/pretest.dat b/testing/tests/ikev2/virtual-ip-override/pretest.dat index 5ec37aae1..1765a83cd 100644 --- a/testing/tests/ikev2/virtual-ip-override/pretest.dat +++ b/testing/tests/ikev2/virtual-ip-override/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/virtual-ip-override/test.conf b/testing/tests/ikev2/virtual-ip-override/test.conf index 01c94f7fb..5139506ac 100644 --- a/testing/tests/ikev2/virtual-ip-override/test.conf +++ b/testing/tests/ikev2/virtual-ip-override/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/virtual-ip/evaltest.dat b/testing/tests/ikev2/virtual-ip/evaltest.dat index dd3143ae7..0f5df71d7 100644 --- a/testing/tests/ikev2/virtual-ip/evaltest.dat +++ b/testing/tests/ikev2/virtual-ip/evaltest.dat @@ -14,12 +14,12 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::src PH_IP_CAROL1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::src PH_IP_DAVE1::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES +moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/virtual-ip/posttest.dat b/testing/tests/ikev2/virtual-ip/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/ikev2/virtual-ip/posttest.dat +++ b/testing/tests/ikev2/virtual-ip/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/ikev2/virtual-ip/pretest.dat b/testing/tests/ikev2/virtual-ip/pretest.dat index 5ec37aae1..1765a83cd 100644 --- a/testing/tests/ikev2/virtual-ip/pretest.dat +++ b/testing/tests/ikev2/virtual-ip/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/virtual-ip/test.conf b/testing/tests/ikev2/virtual-ip/test.conf index 1a8f2a4e0..164b07ff9 100644 --- a/testing/tests/ikev2/virtual-ip/test.conf +++ b/testing/tests/ikev2/virtual-ip/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon alice" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat index e3da87520..3c4832e5e 100644 --- a/testing/tests/ikev2/wildcards/pretest.dat +++ b/testing/tests/ikev2/wildcards/pretest.dat @@ -1,4 +1,3 @@ -moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf index 08e5cc145..9bb88d79f 100644 --- a/testing/tests/ikev2/wildcards/test.conf +++ b/testing/tests/ikev2/wildcards/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev1/posttest.dat b/testing/tests/ipv6/host2host-ikev1/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/host2host-ikev1/posttest.dat +++ b/testing/tests/ipv6/host2host-ikev1/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/host2host-ikev1/pretest.dat b/testing/tests/ipv6/host2host-ikev1/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/host2host-ikev1/pretest.dat +++ b/testing/tests/ipv6/host2host-ikev1/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/host2host-ikev1/test.conf b/testing/tests/ipv6/host2host-ikev1/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/host2host-ikev1/test.conf +++ b/testing/tests/ipv6/host2host-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/host2host-ikev2/posttest.dat b/testing/tests/ipv6/host2host-ikev2/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/host2host-ikev2/posttest.dat +++ b/testing/tests/ipv6/host2host-ikev2/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/host2host-ikev2/pretest.dat b/testing/tests/ipv6/host2host-ikev2/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/host2host-ikev2/pretest.dat +++ b/testing/tests/ipv6/host2host-ikev2/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/host2host-ikev2/test.conf b/testing/tests/ipv6/host2host-ikev2/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/host2host-ikev2/test.conf +++ b/testing/tests/ipv6/host2host-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ikev1/posttest.dat index 4c95e2afe..078fca541 100644 --- a/testing/tests/ipv6/net2net-ikev1/posttest.dat +++ b/testing/tests/ipv6/net2net-ikev1/posttest.dat @@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1" moon::"ip route del fec2:\:/16 via fec0:\:2" sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ikev1/pretest.dat index 8a8af2ccb..a14b3cf79 100644 --- a/testing/tests/ipv6/net2net-ikev1/pretest.dat +++ b/testing/tests/ipv6/net2net-ikev1/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" moon::"ip route add fec2:\:/16 via fec0:\:2" sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ikev1/test.conf b/testing/tests/ipv6/net2net-ikev1/test.conf index 991d884db..55b90befe 100644 --- a/testing/tests/ipv6/net2net-ikev1/test.conf +++ b/testing/tests/ipv6/net2net-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ikev2/posttest.dat index 4c95e2afe..078fca541 100644 --- a/testing/tests/ipv6/net2net-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-ikev2/posttest.dat @@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1" moon::"ip route del fec2:\:/16 via fec0:\:2" sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ikev2/pretest.dat index 8a8af2ccb..a14b3cf79 100644 --- a/testing/tests/ipv6/net2net-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-ikev2/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" moon::"ip route add fec2:\:/16 via fec0:\:2" sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ikev2/test.conf b/testing/tests/ipv6/net2net-ikev2/test.conf index 991d884db..55b90befe 100644 --- a/testing/tests/ipv6/net2net-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat index 3b3200418..151b73c27 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat index a88456d52..812ccd162 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 2 diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf index cab801a1c..8f8d9222d 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip4-in-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat index 3b3200418..151b73c27 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat index a88456d52..812ccd162 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 2 diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf index cab801a1c..8f8d9222d 100644 --- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip4-in-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index d556762b7..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 21ff88d0d..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat index c78d884ee..078fca541 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat @@ -1,8 +1,10 @@ moon::ipsec stop sun::ipsec stop alice::"ip route del fec2:\:/16 via fec1:\:1" -moon::"ip route del fec2:\:/16 via fec0:\:2" -sun::"ip route del fec1:\:/16 via fec0:\:1" +moon::"ip route del fec2:\:/16 via fec0:\:2" +sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat index 7781f9b9f..58711bc06 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" -moon::"ip route add fec2:\:/16 via fec0:\:2" -sun::"ip route add fec1:\:/16 via fec0:\:1" +moon::"ip route add fec2:\:/16 via fec0:\:2" +sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf index d5d55c749..fe141076d 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6-in-ip4.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index d556762b7..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 21ff88d0d..000000000 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat index c78d884ee..078fca541 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat @@ -1,8 +1,10 @@ moon::ipsec stop sun::ipsec stop alice::"ip route del fec2:\:/16 via fec1:\:1" -moon::"ip route del fec2:\:/16 via fec0:\:2" -sun::"ip route del fec1:\:/16 via fec0:\:1" +moon::"ip route del fec2:\:/16 via fec0:\:2" +sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat index 7781f9b9f..58711bc06 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" -moon::"ip route add fec2:\:/16 via fec0:\:2" -sun::"ip route add fec1:\:/16 via fec0:\:1" +moon::"ip route add fec2:\:/16 via fec0:\:2" +sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf index d5d55c749..fe141076d 100644 --- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6-in-ip4.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat b/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat index 4c95e2afe..078fca541 100644 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat +++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat @@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1" moon::"ip route del fec2:\:/16 via fec0:\:2" sun::"ip route del fec1:\:/16 via fec0:\:1" bob::"ip route del fec1:\:/16 via fec2:\:1" -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat b/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat index 8a8af2ccb..a14b3cf79 100644 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat +++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat @@ -1,11 +1,13 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec2:\:/16 via fec1:\:1" moon::"ip route add fec2:\:/16 via fec0:\:2" sun::"ip route add fec1:\:/16 via fec0:\:1" bob::"ip route add fec1:\:/16 via fec2:\:1" moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection net-net +sun::expect-connection net-net moon::ipsec up net-net -moon::sleep 1 diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf b/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf index 991d884db..55b90befe 100644 --- a/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf +++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev1/posttest.dat b/testing/tests/ipv6/rw-ikev1/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-ikev1/posttest.dat +++ b/testing/tests/ipv6/rw-ikev1/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-ikev1/pretest.dat b/testing/tests/ipv6/rw-ikev1/pretest.dat index 7da0c1028..f60be3887 100644 --- a/testing/tests/ipv6/rw-ikev1/pretest.dat +++ b/testing/tests/ipv6/rw-ikev1/pretest.dat @@ -1,13 +1,17 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ikev1/test.conf b/testing/tests/ipv6/rw-ikev1/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ikev1/test.conf +++ b/testing/tests/ipv6/rw-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ikev2/posttest.dat b/testing/tests/ipv6/rw-ikev2/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-ikev2/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-ikev2/pretest.dat b/testing/tests/ipv6/rw-ikev2/pretest.dat index 7da0c1028..f60be3887 100644 --- a/testing/tests/ipv6/rw-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-ikev2/pretest.dat @@ -1,13 +1,17 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ikev2/test.conf b/testing/tests/ipv6/rw-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ikev2/test.conf +++ b/testing/tests/ipv6/rw-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index f5bd956ad..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat index 179b8fe58..ebe5e2a80 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat @@ -1,7 +1,10 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec3:\:/16 via fec1:\:1" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat index ca544e373..e73bde487 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat @@ -1,11 +1,15 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec3:\:/16 via fec1:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt deleted file mode 100644 index 9609ae268..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt +++ /dev/null @@ -1,10 +0,0 @@ -The roadwarriors <b>carol</b> and <b>dave</b> set up an IPv6-in-IPv4 tunnel connection each -to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>. -Both <b>carol</b> and <b>dave</b> request a virtual IPv6 address from <b>moon</b> via -the IKEvi1 mode config payload. -<p/> -Upon the successful establishment of the ESP tunnels, <b>leftfirewall=yes</b> -automatically inserts ip6tables-based firewall rules that let pass the tunneled traffic. -In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> send -an IPv6 ICMP request to the client <b>alice</b> behind the gateway <b>moon</b> -using the ping6 command. diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat deleted file mode 100644 index f6dc9aa3e..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat +++ /dev/null @@ -1,15 +0,0 @@ -carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES -dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES -moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES -moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES -carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES -moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES -dave:: ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES -moon::tcpdump::carol.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::moon.strongswan.org > carol.strongswan.org: ESP::YES -moon::tcpdump::dave.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::moon.strongswan.org > dave.strongswan.org: ESP::YES - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat deleted file mode 100644 index 179b8fe58..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -alice::"ip route del fec3:\:/16 via fec1:\:1" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat deleted file mode 100644 index ca544e373..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::"ip route add fec3:\:/16 via fec1:\:1" -moon::ipsec start -carol::ipsec start -dave::ipsec start -carol::sleep 1 -carol::ipsec up home -dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf deleted file mode 100644 index 80cf5e3a1..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# UML instances used for this test - -# All UML instances that are required for this test -# -UMLHOSTS="alice moon carol winnetou dave" - -# Corresponding block diagram -# -DIAGRAM="a-m-c-w-d-ip6.png" - -# UML instances on which tcpdump is to be started -# -TCPDUMPHOSTS="moon" - -# UML instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 7f904a693..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,96 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index f5bd956ad..000000000 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow ESP - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..409f2e9bb --- /dev/null +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,20 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat index 179b8fe58..ebe5e2a80 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat @@ -1,7 +1,10 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec3:\:/16 via fec1:\:1" diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat index ca544e373..e73bde487 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat @@ -1,11 +1,15 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec3:\:/16 via fec1:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf +++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev1/posttest.dat b/testing/tests/ipv6/rw-psk-ikev1/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-psk-ikev1/posttest.dat +++ b/testing/tests/ipv6/rw-psk-ikev1/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-psk-ikev1/pretest.dat b/testing/tests/ipv6/rw-psk-ikev1/pretest.dat index e3040d125..93a96ec36 100644 --- a/testing/tests/ipv6/rw-psk-ikev1/pretest.dat +++ b/testing/tests/ipv6/rw-psk-ikev1/pretest.dat @@ -1,6 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" @@ -10,7 +13,8 @@ dave::rm /etc/ipsec.d/cacerts/* moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 1 diff --git a/testing/tests/ipv6/rw-psk-ikev1/test.conf b/testing/tests/ipv6/rw-psk-ikev1/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-psk-ikev1/test.conf +++ b/testing/tests/ipv6/rw-psk-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 6c437fe03..000000000 --- a/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,100 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-psk-ikev2/posttest.dat b/testing/tests/ipv6/rw-psk-ikev2/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-psk-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-psk-ikev2/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-psk-ikev2/pretest.dat b/testing/tests/ipv6/rw-psk-ikev2/pretest.dat index e3040d125..93a96ec36 100644 --- a/testing/tests/ipv6/rw-psk-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-psk-ikev2/pretest.dat @@ -1,6 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" @@ -10,7 +13,8 @@ dave::rm /etc/ipsec.d/cacerts/* moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 1 diff --git a/testing/tests/ipv6/rw-psk-ikev2/test.conf b/testing/tests/ipv6/rw-psk-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-psk-ikev2/test.conf +++ b/testing/tests/ipv6/rw-psk-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat b/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat index 07e89d7da..4e59395e3 100644 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat +++ b/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat b/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat index 7da0c1028..f60be3887 100644 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat +++ b/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat @@ -1,13 +1,17 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +carol::iptables-restore < /etc/iptables.drop +dave::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" moon::ipsec start carol::ipsec start dave::ipsec start -carol::sleep 1 +moon::expect-connection rw +carol::expect-connection home +dave::expect-connection home carol::ipsec up home dave::ipsec up home -dave::sleep 2 diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf b/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf +++ b/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 343fd49ed..000000000 --- a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certficate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables deleted file mode 100755 index 47db6db82..000000000 --- a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,108 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow last IPv6 UDP fragments - ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT - ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev1/posttest.dat b/testing/tests/ipv6/transport-ikev1/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/transport-ikev1/posttest.dat +++ b/testing/tests/ipv6/transport-ikev1/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/transport-ikev1/pretest.dat b/testing/tests/ipv6/transport-ikev1/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/transport-ikev1/pretest.dat +++ b/testing/tests/ipv6/transport-ikev1/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/transport-ikev1/test.conf b/testing/tests/ipv6/transport-ikev1/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/transport-ikev1/test.conf +++ b/testing/tests/ipv6/transport-ikev1/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables deleted file mode 100755 index b1e7073af..000000000 --- a/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certficate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables deleted file mode 100755 index b3509f8df..000000000 --- a/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables +++ /dev/null @@ -1,104 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl and certificate fetch from winnetou - ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/ipv6/transport-ikev2/posttest.dat b/testing/tests/ipv6/transport-ikev2/posttest.dat index 5a9150bc8..d3bebd0c6 100644 --- a/testing/tests/ipv6/transport-ikev2/posttest.dat +++ b/testing/tests/ipv6/transport-ikev2/posttest.dat @@ -1,4 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/transport-ikev2/pretest.dat b/testing/tests/ipv6/transport-ikev2/pretest.dat index 7e97e7783..46c015387 100644 --- a/testing/tests/ipv6/transport-ikev2/pretest.dat +++ b/testing/tests/ipv6/transport-ikev2/pretest.dat @@ -1,7 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules moon::ipsec start sun::ipsec start -moon::sleep 2 +moon::expect-connection host-host +sun::expect-connection host-host moon::ipsec up host-host -moon::sleep 1 diff --git a/testing/tests/ipv6/transport-ikev2/test.conf b/testing/tests/ipv6/transport-ikev2/test.conf index 6ab5b8a96..56df1a0da 100644 --- a/testing/tests/ipv6/transport-ikev2/test.conf +++ b/testing/tests/ipv6/transport-ikev2/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat index 5b5c94fb1..4d614bf7e 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat +++ b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/openssl-ikev1/alg-camellia/posttest.dat b/testing/tests/openssl-ikev1/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/posttest.dat +++ b/testing/tests/openssl-ikev1/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/alg-camellia/pretest.dat b/testing/tests/openssl-ikev1/alg-camellia/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/pretest.dat +++ b/testing/tests/openssl-ikev1/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/openssl-ikev1/alg-camellia/test.conf b/testing/tests/openssl-ikev1/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/openssl-ikev1/alg-camellia/test.conf +++ b/testing/tests/openssl-ikev1/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat index 2ba48e5ce..ac7d8cd98 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/test.conf b/testing/tests/openssl-ikev1/alg-ecp-high/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-high/test.conf +++ b/testing/tests/openssl-ikev1/alg-ecp-high/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat index 6cf2438d4..178d541da 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat @@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_224::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat +++ b/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/test.conf b/testing/tests/openssl-ikev1/alg-ecp-low/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev1/alg-ecp-low/test.conf +++ b/testing/tests/openssl-ikev1/alg-ecp-low/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat index 244ea0331..69c893f0c 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat +++ b/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA successful::YES carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA successful::YES dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat +++ b/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat +++ b/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/test.conf b/testing/tests/openssl-ikev1/ecdsa-certs/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev1/ecdsa-certs/test.conf +++ b/testing/tests/openssl-ikev1/ecdsa-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat b/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat index 3787bdb68..cd83c56b4 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat @@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_384_192,::YES dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA2_256_128,::YES carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES diff --git a/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat b/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat b/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/alg-blowfish/test.conf b/testing/tests/openssl-ikev2/alg-blowfish/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/alg-blowfish/test.conf +++ b/testing/tests/openssl-ikev2/alg-blowfish/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat index 5b5c94fb1..4d614bf7e 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat @@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES moon:: ip xfrm state::enc cbc(camellia)::YES diff --git a/testing/tests/openssl-ikev2/alg-camellia/posttest.dat b/testing/tests/openssl-ikev2/alg-camellia/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-camellia/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-camellia/pretest.dat b/testing/tests/openssl-ikev2/alg-camellia/pretest.dat index 3c3df0196..886fdf55c 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-camellia/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/openssl-ikev2/alg-camellia/test.conf b/testing/tests/openssl-ikev2/alg-camellia/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/openssl-ikev2/alg-camellia/test.conf +++ b/testing/tests/openssl-ikev2/alg-camellia/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat index 2540eb106..375ed86a1 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat @@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::ECP_256.*ECP_384::YES dave:: cat /var/log/daemon.log::ECP_256.*ECP_521::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/test.conf b/testing/tests/openssl-ikev2/alg-ecp-high/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-high/test.conf +++ b/testing/tests/openssl-ikev2/alg-ecp-high/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat index f82159e7c..c46ed1dd2 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat @@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::ECP_192.*ECP_224::YES dave:: cat /var/log/daemon.log::ECP_192.*ECP_256::YES carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_224::YES dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat +++ b/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/test.conf b/testing/tests/openssl-ikev2/alg-ecp-low/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/alg-ecp-low/test.conf +++ b/testing/tests/openssl-ikev2/alg-ecp-low/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/critical-extension/posttest.dat b/testing/tests/openssl-ikev2/critical-extension/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/openssl-ikev2/critical-extension/posttest.dat +++ b/testing/tests/openssl-ikev2/critical-extension/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/critical-extension/pretest.dat b/testing/tests/openssl-ikev2/critical-extension/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/openssl-ikev2/critical-extension/pretest.dat +++ b/testing/tests/openssl-ikev2/critical-extension/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/openssl-ikev2/critical-extension/test.conf b/testing/tests/openssl-ikev2/critical-extension/test.conf index 41ee3037e..b286ef6eb 100644 --- a/testing/tests/openssl-ikev2/critical-extension/test.conf +++ b/testing/tests/openssl-ikev2/critical-extension/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat index 5918faa8c..0110bb996 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat @@ -10,8 +10,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA-384 signature successful::YES carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/test.conf b/testing/tests/openssl-ikev2/ecdsa-certs/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/ecdsa-certs/test.conf +++ b/testing/tests/openssl-ikev2/ecdsa-certs/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat index 52913759f..8a4215dcc 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat @@ -6,8 +6,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA-384 signature successful::YES carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf b/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf +++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/rw-cert/evaltest.dat b/testing/tests/openssl-ikev2/rw-cert/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/openssl-ikev2/rw-cert/evaltest.dat +++ b/testing/tests/openssl-ikev2/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/rw-cert/posttest.dat b/testing/tests/openssl-ikev2/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/openssl-ikev2/rw-cert/posttest.dat +++ b/testing/tests/openssl-ikev2/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/rw-cert/pretest.dat b/testing/tests/openssl-ikev2/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/openssl-ikev2/rw-cert/pretest.dat +++ b/testing/tests/openssl-ikev2/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/openssl-ikev2/rw-cert/test.conf b/testing/tests/openssl-ikev2/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/openssl-ikev2/rw-cert/test.conf +++ b/testing/tests/openssl-ikev2/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat index e476da03f..1ae780e4b 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat @@ -5,6 +5,6 @@ carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_ECDHE_ECDSA_W carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=ECDSA 521 bit, CN=moon.strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=ECDSA 256 bit, CN=carol@strongswan.org' with EAP successful::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat index ed5498bfe..388339fb8 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf b/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf +++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/p2pnat/behind-same-nat/evaltest.dat b/testing/tests/p2pnat/behind-same-nat/evaltest.dat index 8c79a28c1..378520596 100644 --- a/testing/tests/p2pnat/behind-same-nat/evaltest.dat +++ b/testing/tests/p2pnat/behind-same-nat/evaltest.dat @@ -7,5 +7,5 @@ alice::ipsec status 2> /dev/null::peer.*ESTABLISHED.*alice@strongswan.org.*venus venus::ipsec status 2> /dev/null::peer.*ESTABLISHED.*venus.strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES venus::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 1eb88c15c..000000000 --- a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..da385d22a --- /dev/null +++ b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 40510ce60..000000000 --- a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE behind NAT - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables deleted file mode 100755 index 6fca87b4a..000000000 --- a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables +++ /dev/null @@ -1,78 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules new file mode 100644 index 000000000..da385d22a --- /dev/null +++ b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules @@ -0,0 +1,28 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/behind-same-nat/posttest.dat b/testing/tests/p2pnat/behind-same-nat/posttest.dat index 36cd0f36d..a1d5b4612 100644 --- a/testing/tests/p2pnat/behind-same-nat/posttest.dat +++ b/testing/tests/p2pnat/behind-same-nat/posttest.dat @@ -1,8 +1,8 @@ venus::ipsec stop alice::ipsec stop carol::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush moon::conntrack -F diff --git a/testing/tests/p2pnat/behind-same-nat/pretest.dat b/testing/tests/p2pnat/behind-same-nat/pretest.dat index f1e33dc39..eb1d67fa2 100644 --- a/testing/tests/p2pnat/behind-same-nat/pretest.dat +++ b/testing/tests/p2pnat/behind-same-nat/pretest.dat @@ -1,7 +1,7 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +moon::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT @@ -10,5 +10,5 @@ carol::ipsec start carol::sleep 1 alice::ipsec start alice::sleep 1 -venus::ipsec start -venus::sleep 4 +venus::ipsec start +venus::sleep 4 diff --git a/testing/tests/p2pnat/behind-same-nat/test.conf b/testing/tests/p2pnat/behind-same-nat/test.conf index f98a0ab1b..fe44ff97b 100644 --- a/testing/tests/p2pnat/behind-same-nat/test.conf +++ b/testing/tests/p2pnat/behind-same-nat/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou" +VIRTHOSTS="alice venus moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-med.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus carol" diff --git a/testing/tests/p2pnat/medsrv-psk/evaltest.dat b/testing/tests/p2pnat/medsrv-psk/evaltest.dat index 1b89c7ebe..2c6080775 100644 --- a/testing/tests/p2pnat/medsrv-psk/evaltest.dat +++ b/testing/tests/p2pnat/medsrv-psk/evaltest.dat @@ -6,7 +6,7 @@ alice::ipsec status 2> /dev/null::peer.*ESTABLISHED.*alice@strongswan.org.*bob@s bob:: ipsec status 2> /dev/null::peer.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES alice::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES bob:: ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.*: UDP::YES moon::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables deleted file mode 100755 index c6371c745..000000000 --- a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 40510ce60..000000000 --- a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,77 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE behind NAT - iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/p2pnat/medsrv-psk/posttest.dat b/testing/tests/p2pnat/medsrv-psk/posttest.dat index ca3cebc0a..4b696b90f 100644 --- a/testing/tests/p2pnat/medsrv-psk/posttest.dat +++ b/testing/tests/p2pnat/medsrv-psk/posttest.dat @@ -1,10 +1,10 @@ bob::ipsec stop alice::ipsec stop carol::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::conntrack -F sun::conntrack -F diff --git a/testing/tests/p2pnat/medsrv-psk/pretest.dat b/testing/tests/p2pnat/medsrv-psk/pretest.dat index fba7be01d..09b658318 100644 --- a/testing/tests/p2pnat/medsrv-psk/pretest.dat +++ b/testing/tests/p2pnat/medsrv-psk/pretest.dat @@ -1,8 +1,8 @@ -alice::/etc/init.d/iptables start 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT @@ -15,5 +15,5 @@ carol::ipsec start carol::sleep 1 bob::ipsec start bob::sleep 1 -alice::ipsec start -alice::sleep 4 +alice::ipsec start +alice::sleep 4 diff --git a/testing/tests/p2pnat/medsrv-psk/test.conf b/testing/tests/p2pnat/medsrv-psk/test.conf index 2dc4cd8c1..a1c6b8c15 100644 --- a/testing/tests/p2pnat/medsrv-psk/test.conf +++ b/testing/tests/p2pnat/medsrv-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou sun bob" +VIRTHOSTS="alice moon carol winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-c-w-s-b-med.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice carol bob" diff --git a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat index 9ca168e82..590b7fe9c 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat +++ b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES -moon:: ip xfrm state::auth xcbc(aes)::YES -carol::ip xfrm state::auth xcbc(aes)::YES +moon:: ip xfrm state::auth-trunc xcbc(aes)::YES +carol::ip xfrm state::auth-trunc xcbc(aes)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES diff --git a/testing/tests/pfkey/alg-aes-xcbc/posttest.dat b/testing/tests/pfkey/alg-aes-xcbc/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/posttest.dat +++ b/testing/tests/pfkey/alg-aes-xcbc/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/alg-aes-xcbc/pretest.dat b/testing/tests/pfkey/alg-aes-xcbc/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/pretest.dat +++ b/testing/tests/pfkey/alg-aes-xcbc/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/alg-aes-xcbc/test.conf b/testing/tests/pfkey/alg-aes-xcbc/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/alg-aes-xcbc/test.conf +++ b/testing/tests/pfkey/alg-aes-xcbc/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/alg-sha384/evaltest.dat b/testing/tests/pfkey/alg-sha384/evaltest.dat index 21b3d5a4f..3b24217c5 100644 --- a/testing/tests/pfkey/alg-sha384/evaltest.dat +++ b/testing/tests/pfkey/alg-sha384/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES -moon:: ip xfrm state::auth hmac(sha384)::YES -carol::ip xfrm state::auth hmac(sha384)::YES +moon:: ip xfrm state::auth-trunc hmac(sha384)::YES +carol::ip xfrm state::auth-trunc hmac(sha384)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/pfkey/alg-sha384/posttest.dat b/testing/tests/pfkey/alg-sha384/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/alg-sha384/posttest.dat +++ b/testing/tests/pfkey/alg-sha384/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/alg-sha384/pretest.dat b/testing/tests/pfkey/alg-sha384/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/alg-sha384/pretest.dat +++ b/testing/tests/pfkey/alg-sha384/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/alg-sha384/test.conf b/testing/tests/pfkey/alg-sha384/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/alg-sha384/test.conf +++ b/testing/tests/pfkey/alg-sha384/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/alg-sha512/evaltest.dat b/testing/tests/pfkey/alg-sha512/evaltest.dat index 7b94d2182..6bdceeb44 100644 --- a/testing/tests/pfkey/alg-sha512/evaltest.dat +++ b/testing/tests/pfkey/alg-sha512/evaltest.dat @@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES -carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES -moon:: ip xfrm state::auth hmac(sha512)::YES -carol::ip xfrm state::auth hmac(sha512)::YES +moon:: ip xfrm state::auth-trunc hmac(sha512)::YES +carol::ip xfrm state::auth-trunc hmac(sha512)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES diff --git a/testing/tests/pfkey/alg-sha512/posttest.dat b/testing/tests/pfkey/alg-sha512/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/alg-sha512/posttest.dat +++ b/testing/tests/pfkey/alg-sha512/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/alg-sha512/pretest.dat b/testing/tests/pfkey/alg-sha512/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/alg-sha512/pretest.dat +++ b/testing/tests/pfkey/alg-sha512/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/alg-sha512/test.conf b/testing/tests/pfkey/alg-sha512/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/alg-sha512/test.conf +++ b/testing/tests/pfkey/alg-sha512/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/esp-alg-null/evaltest.dat b/testing/tests/pfkey/esp-alg-null/evaltest.dat index 271e274c8..c50b188bb 100644 --- a/testing/tests/pfkey/esp-alg-null/evaltest.dat +++ b/testing/tests/pfkey/esp-alg-null/evaltest.dat @@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES moon:: ip xfrm state::enc ecb(cipher_null)::YES diff --git a/testing/tests/pfkey/esp-alg-null/posttest.dat b/testing/tests/pfkey/esp-alg-null/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/esp-alg-null/posttest.dat +++ b/testing/tests/pfkey/esp-alg-null/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/esp-alg-null/pretest.dat b/testing/tests/pfkey/esp-alg-null/pretest.dat index f360351e1..4fc25772b 100644 --- a/testing/tests/pfkey/esp-alg-null/pretest.dat +++ b/testing/tests/pfkey/esp-alg-null/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/esp-alg-null/test.conf b/testing/tests/pfkey/esp-alg-null/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/esp-alg-null/test.conf +++ b/testing/tests/pfkey/esp-alg-null/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/host2host-transport/evaltest.dat b/testing/tests/pfkey/host2host-transport/evaltest.dat index 5ef5bed9c..fbd0c1c96 100644 --- a/testing/tests/pfkey/host2host-transport/evaltest.dat +++ b/testing/tests/pfkey/host2host-transport/evaltest.dat @@ -5,6 +5,6 @@ sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES moon::cat /var/log/daemon.log::parsed IKE_AUTH response.*N(USE_TRANSP)::YES moon::ip xfrm state::mode transport::YES sun:: ip xfrm state::mode transport::YES -moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/host2host-transport/posttest.dat b/testing/tests/pfkey/host2host-transport/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/pfkey/host2host-transport/posttest.dat +++ b/testing/tests/pfkey/host2host-transport/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/host2host-transport/pretest.dat b/testing/tests/pfkey/host2host-transport/pretest.dat index e2d98f2eb..99789b90f 100644 --- a/testing/tests/pfkey/host2host-transport/pretest.dat +++ b/testing/tests/pfkey/host2host-transport/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/pfkey/host2host-transport/test.conf b/testing/tests/pfkey/host2host-transport/test.conf index cf2e704fd..5a286c84f 100644 --- a/testing/tests/pfkey/host2host-transport/test.conf +++ b/testing/tests/pfkey/host2host-transport/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="moon winnetou sun" +VIRTHOSTS="moon winnetou sun" # Corresponding block diagram # DIAGRAM="m-w-s.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/pfkey/nat-rw/evaltest.dat b/testing/tests/pfkey/nat-rw/evaltest.dat index a0b9c678f..ac09e2d6b 100644 --- a/testing/tests/pfkey/nat-rw/evaltest.dat +++ b/testing/tests/pfkey/nat-rw/evaltest.dat @@ -6,7 +6,7 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES -moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES +moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/pfkey/nat-rw/posttest.dat b/testing/tests/pfkey/nat-rw/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/pfkey/nat-rw/posttest.dat +++ b/testing/tests/pfkey/nat-rw/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/pfkey/nat-rw/pretest.dat b/testing/tests/pfkey/nat-rw/pretest.dat index e365ff5c5..d701a1d61 100644 --- a/testing/tests/pfkey/nat-rw/pretest.dat +++ b/testing/tests/pfkey/nat-rw/pretest.dat @@ -1,7 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null -moon::echo 1 > /proc/sys/net/ipv4/ip_forward +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 alice::ipsec start diff --git a/testing/tests/pfkey/nat-rw/test.conf b/testing/tests/pfkey/nat-rw/test.conf index 84317fd70..f515d4bc7 100644 --- a/testing/tests/pfkey/nat-rw/test.conf +++ b/testing/tests/pfkey/nat-rw/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="alice venus sun" diff --git a/testing/tests/pfkey/net2net-route/evaltest.dat b/testing/tests/pfkey/net2net-route/evaltest.dat index 9adb31e97..1de6ca8e1 100644 --- a/testing/tests/pfkey/net2net-route/evaltest.dat +++ b/testing/tests/pfkey/net2net-route/evaltest.dat @@ -4,6 +4,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/net2net-route/posttest.dat b/testing/tests/pfkey/net2net-route/posttest.dat index 5a9150bc8..1f7aa73a1 100644 --- a/testing/tests/pfkey/net2net-route/posttest.dat +++ b/testing/tests/pfkey/net2net-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/net2net-route/pretest.dat b/testing/tests/pfkey/net2net-route/pretest.dat index 2eef7de19..e4ee3fac2 100644 --- a/testing/tests/pfkey/net2net-route/pretest.dat +++ b/testing/tests/pfkey/net2net-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 2 diff --git a/testing/tests/pfkey/net2net-route/test.conf b/testing/tests/pfkey/net2net-route/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/pfkey/net2net-route/test.conf +++ b/testing/tests/pfkey/net2net-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/pfkey/protoport-dual/evaltest.dat b/testing/tests/pfkey/protoport-dual/evaltest.dat index d2fc698f9..50b53cc00 100644 --- a/testing/tests/pfkey/protoport-dual/evaltest.dat +++ b/testing/tests/pfkey/protoport-dual/evaltest.dat @@ -4,8 +4,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/protoport-dual/posttest.dat b/testing/tests/pfkey/protoport-dual/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/protoport-dual/posttest.dat +++ b/testing/tests/pfkey/protoport-dual/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/protoport-dual/pretest.dat b/testing/tests/pfkey/protoport-dual/pretest.dat index d3d0061c3..efb2e5712 100644 --- a/testing/tests/pfkey/protoport-dual/pretest.dat +++ b/testing/tests/pfkey/protoport-dual/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/pfkey/protoport-dual/test.conf b/testing/tests/pfkey/protoport-dual/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/protoport-dual/test.conf +++ b/testing/tests/pfkey/protoport-dual/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/protoport-route/evaltest.dat b/testing/tests/pfkey/protoport-route/evaltest.dat index 09dfd8f42..9e970f055 100644 --- a/testing/tests/pfkey/protoport-route/evaltest.dat +++ b/testing/tests/pfkey/protoport-route/evaltest.dat @@ -1,5 +1,5 @@ -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES -carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req::YES carol::ssh PH_IP_ALICE hostname::alice::YES carol::cat /var/log/daemon.log::creating acquire job::YES carol::ipsec status 2> /dev/null::home-icmp.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES diff --git a/testing/tests/pfkey/protoport-route/posttest.dat b/testing/tests/pfkey/protoport-route/posttest.dat index 94a400606..046d4cfdc 100644 --- a/testing/tests/pfkey/protoport-route/posttest.dat +++ b/testing/tests/pfkey/protoport-route/posttest.dat @@ -1,4 +1,4 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/protoport-route/pretest.dat b/testing/tests/pfkey/protoport-route/pretest.dat index 0aded0f4d..5a15574d6 100644 --- a/testing/tests/pfkey/protoport-route/pretest.dat +++ b/testing/tests/pfkey/protoport-route/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/pfkey/protoport-route/test.conf b/testing/tests/pfkey/protoport-route/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/pfkey/protoport-route/test.conf +++ b/testing/tests/pfkey/protoport-route/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/rw-cert/evaltest.dat b/testing/tests/pfkey/rw-cert/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/pfkey/rw-cert/evaltest.dat +++ b/testing/tests/pfkey/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/pfkey/rw-cert/posttest.dat b/testing/tests/pfkey/rw-cert/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/pfkey/rw-cert/posttest.dat +++ b/testing/tests/pfkey/rw-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/rw-cert/pretest.dat b/testing/tests/pfkey/rw-cert/pretest.dat index 42e9d7c24..8bbea1412 100644 --- a/testing/tests/pfkey/rw-cert/pretest.dat +++ b/testing/tests/pfkey/rw-cert/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/pfkey/rw-cert/test.conf b/testing/tests/pfkey/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/pfkey/rw-cert/test.conf +++ b/testing/tests/pfkey/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/pfkey/shunt-policies/evaltest.dat b/testing/tests/pfkey/shunt-policies/evaltest.dat index 87368fb31..6ba3a988f 100644 --- a/testing/tests/pfkey/shunt-policies/evaltest.dat +++ b/testing/tests/pfkey/shunt-policies/evaltest.dat @@ -4,16 +4,16 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO +venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES venus::ssh PH_IP_BOB hostname::bob::YES diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 2b90a14c7..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow icmp in local net - iptables -A INPUT -i eth1 -p icmp -j ACCEPT - iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..af0f25209 --- /dev/null +++ b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow icmp in local net +-A INPUT -i eth1 -p icmp -j ACCEPT +-A OUTPUT -o eth1 -p icmp -j ACCEPT + +COMMIT diff --git a/testing/tests/pfkey/shunt-policies/posttest.dat b/testing/tests/pfkey/shunt-policies/posttest.dat index a4c96e10f..837738fc6 100644 --- a/testing/tests/pfkey/shunt-policies/posttest.dat +++ b/testing/tests/pfkey/shunt-policies/posttest.dat @@ -1,5 +1,5 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/pfkey/shunt-policies/pretest.dat b/testing/tests/pfkey/shunt-policies/pretest.dat index 2d7a78acb..c724e5df8 100644 --- a/testing/tests/pfkey/shunt-policies/pretest.dat +++ b/testing/tests/pfkey/shunt-policies/pretest.dat @@ -1,5 +1,5 @@ -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/pfkey/shunt-policies/test.conf b/testing/tests/pfkey/shunt-policies/test.conf index cf2ef7424..6b7432ca6 100644 --- a/testing/tests/pfkey/shunt-policies/test.conf +++ b/testing/tests/pfkey/shunt-policies/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/ip-pool-db-expired/evaltest.dat b/testing/tests/sql/ip-pool-db-expired/evaltest.dat index 3239dfe1f..5ff5edbf8 100644 --- a/testing/tests/sql/ip-pool-db-expired/evaltest.dat +++ b/testing/tests/sql/ip-pool-db-expired/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/sql/ip-pool-db-expired/posttest.dat b/testing/tests/sql/ip-pool-db-expired/posttest.dat index 40b1a403e..1b963fcec 100644 --- a/testing/tests/sql/ip-pool-db-expired/posttest.dat +++ b/testing/tests/sql/ip-pool-db-expired/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/ip-pool-db-expired/pretest.dat b/testing/tests/sql/ip-pool-db-expired/pretest.dat index 4df33509f..391785a1c 100644 --- a/testing/tests/sql/ip-pool-db-expired/pretest.dat +++ b/testing/tests/sql/ip-pool-db-expired/pretest.dat @@ -8,9 +8,9 @@ moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db moon::ipsec pool --leases 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/ip-pool-db-expired/test.conf b/testing/tests/sql/ip-pool-db-expired/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-pool-db-expired/test.conf +++ b/testing/tests/sql/ip-pool-db-expired/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-pool-db-restart/evaltest.dat b/testing/tests/sql/ip-pool-db-restart/evaltest.dat index 58706fa48..f70e2d2de 100644 --- a/testing/tests/sql/ip-pool-db-restart/evaltest.dat +++ b/testing/tests/sql/ip-pool-db-restart/evaltest.dat @@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired existing lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/sql/ip-pool-db-restart/posttest.dat b/testing/tests/sql/ip-pool-db-restart/posttest.dat index 40b1a403e..1b963fcec 100644 --- a/testing/tests/sql/ip-pool-db-restart/posttest.dat +++ b/testing/tests/sql/ip-pool-db-restart/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/ip-pool-db-restart/pretest.dat b/testing/tests/sql/ip-pool-db-restart/pretest.dat index b5108051c..20b1937b7 100644 --- a/testing/tests/sql/ip-pool-db-restart/pretest.dat +++ b/testing/tests/sql/ip-pool-db-restart/pretest.dat @@ -8,9 +8,9 @@ moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db moon::ipsec pool --leases 2> /dev/null -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/ip-pool-db-restart/test.conf b/testing/tests/sql/ip-pool-db-restart/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-pool-db-restart/test.conf +++ b/testing/tests/sql/ip-pool-db-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-pool-db/evaltest.dat b/testing/tests/sql/ip-pool-db/evaltest.dat index 3910ab9c2..cfa87ae3f 100644 --- a/testing/tests/sql/ip-pool-db/evaltest.dat +++ b/testing/tests/sql/ip-pool-db/evaltest.dat @@ -7,7 +7,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES @@ -18,7 +18,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave:: ipsec status 2> /dev/null::.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon:: cat /var/log/daemon.log::assigning virtual IP::YES diff --git a/testing/tests/sql/ip-pool-db/posttest.dat b/testing/tests/sql/ip-pool-db/posttest.dat index 40b1a403e..1b963fcec 100644 --- a/testing/tests/sql/ip-pool-db/posttest.dat +++ b/testing/tests/sql/ip-pool-db/posttest.dat @@ -1,9 +1,9 @@ carol::ipsec stop dave::ipsec stop moon::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/ip-pool-db/pretest.dat b/testing/tests/sql/ip-pool-db/pretest.dat index a5d786b3f..819aca3d9 100644 --- a/testing/tests/sql/ip-pool-db/pretest.dat +++ b/testing/tests/sql/ip-pool-db/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/ip-pool-db/test.conf b/testing/tests/sql/ip-pool-db/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-pool-db/test.conf +++ b/testing/tests/sql/ip-pool-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-split-pools-db-restart/test.conf b/testing/tests/sql/ip-split-pools-db-restart/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-split-pools-db-restart/test.conf +++ b/testing/tests/sql/ip-split-pools-db-restart/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/ip-split-pools-db/test.conf b/testing/tests/sql/ip-split-pools-db/test.conf index 75510b295..9b1ec0b54 100644 --- a/testing/tests/sql/ip-split-pools-db/test.conf +++ b/testing/tests/sql/ip-split-pools-db/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="alice moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/multi-level-ca/evaltest.dat b/testing/tests/sql/multi-level-ca/evaltest.dat index dfdd36a51..72a555d4b 100644 --- a/testing/tests/sql/multi-level-ca/evaltest.dat +++ b/testing/tests/sql/multi-level-ca/evaltest.dat @@ -14,8 +14,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/multi-level-ca/posttest.dat b/testing/tests/sql/multi-level-ca/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/multi-level-ca/posttest.dat +++ b/testing/tests/sql/multi-level-ca/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/multi-level-ca/pretest.dat b/testing/tests/sql/multi-level-ca/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/multi-level-ca/pretest.dat +++ b/testing/tests/sql/multi-level-ca/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/multi-level-ca/test.conf b/testing/tests/sql/multi-level-ca/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/multi-level-ca/test.conf +++ b/testing/tests/sql/multi-level-ca/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/net2net-cert/evaltest.dat b/testing/tests/sql/net2net-cert/evaltest.dat index dbd06104f..f003f822f 100644 --- a/testing/tests/sql/net2net-cert/evaltest.dat +++ b/testing/tests/sql/net2net-cert/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-cert/posttest.dat b/testing/tests/sql/net2net-cert/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-cert/posttest.dat +++ b/testing/tests/sql/net2net-cert/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-cert/pretest.dat b/testing/tests/sql/net2net-cert/pretest.dat index 2ab18542f..a1777efb0 100644 --- a/testing/tests/sql/net2net-cert/pretest.dat +++ b/testing/tests/sql/net2net-cert/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/net2net-cert/test.conf b/testing/tests/sql/net2net-cert/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/sql/net2net-cert/test.conf +++ b/testing/tests/sql/net2net-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/net2net-psk/evaltest.dat b/testing/tests/sql/net2net-psk/evaltest.dat index dbd06104f..f003f822f 100644 --- a/testing/tests/sql/net2net-psk/evaltest.dat +++ b/testing/tests/sql/net2net-psk/evaltest.dat @@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-psk/posttest.dat b/testing/tests/sql/net2net-psk/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-psk/posttest.dat +++ b/testing/tests/sql/net2net-psk/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-psk/pretest.dat b/testing/tests/sql/net2net-psk/pretest.dat index 2ab18542f..a1777efb0 100644 --- a/testing/tests/sql/net2net-psk/pretest.dat +++ b/testing/tests/sql/net2net-psk/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/net2net-psk/test.conf b/testing/tests/sql/net2net-psk/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/sql/net2net-psk/test.conf +++ b/testing/tests/sql/net2net-psk/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/net2net-route-pem/evaltest.dat b/testing/tests/sql/net2net-route-pem/evaltest.dat index 719ba09ff..3fd32907c 100644 --- a/testing/tests/sql/net2net-route-pem/evaltest.dat +++ b/testing/tests/sql/net2net-route-pem/evaltest.dat @@ -10,7 +10,7 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-route-pem/posttest.dat b/testing/tests/sql/net2net-route-pem/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-route-pem/posttest.dat +++ b/testing/tests/sql/net2net-route-pem/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-route-pem/pretest.dat b/testing/tests/sql/net2net-route-pem/pretest.dat index 5a537e15b..8ca573ee5 100644 --- a/testing/tests/sql/net2net-route-pem/pretest.dat +++ b/testing/tests/sql/net2net-route-pem/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ipsec start moon::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/net2net-route-pem/test.conf b/testing/tests/sql/net2net-route-pem/test.conf index 13a8a2a48..10c582c9b 100644 --- a/testing/tests/sql/net2net-route-pem/test.conf +++ b/testing/tests/sql/net2net-route-pem/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/net2net-start-pem/evaltest.dat b/testing/tests/sql/net2net-start-pem/evaltest.dat index e6b8890f9..6534adc07 100644 --- a/testing/tests/sql/net2net-start-pem/evaltest.dat +++ b/testing/tests/sql/net2net-start-pem/evaltest.dat @@ -6,7 +6,7 @@ moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/net2net-start-pem/posttest.dat b/testing/tests/sql/net2net-start-pem/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/net2net-start-pem/posttest.dat +++ b/testing/tests/sql/net2net-start-pem/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/net2net-start-pem/pretest.dat b/testing/tests/sql/net2net-start-pem/pretest.dat index c09d50f08..1c71f0c14 100644 --- a/testing/tests/sql/net2net-start-pem/pretest.dat +++ b/testing/tests/sql/net2net-start-pem/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules sun::ipsec start moon::ipsec start moon::sleep 3 diff --git a/testing/tests/sql/net2net-start-pem/test.conf b/testing/tests/sql/net2net-start-pem/test.conf index 13a8a2a48..10c582c9b 100644 --- a/testing/tests/sql/net2net-start-pem/test.conf +++ b/testing/tests/sql/net2net-start-pem/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon winnetou sun bob" +VIRTHOSTS="alice venus moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-v-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/sql/rw-cert/evaltest.dat b/testing/tests/sql/rw-cert/evaltest.dat index b545c2289..2342d024b 100644 --- a/testing/tests/sql/rw-cert/evaltest.dat +++ b/testing/tests/sql/rw-cert/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-cert/posttest.dat b/testing/tests/sql/rw-cert/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/rw-cert/posttest.dat +++ b/testing/tests/sql/rw-cert/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/rw-cert/pretest.dat b/testing/tests/sql/rw-cert/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-cert/pretest.dat +++ b/testing/tests/sql/rw-cert/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-cert/test.conf b/testing/tests/sql/rw-cert/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-cert/test.conf +++ b/testing/tests/sql/rw-cert/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat b/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat index 65a7c8e09..e1d33feb7 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat +++ b/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat @@ -5,7 +5,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon. moon:: ipsec status 2> /dev/null::rw-eap-aka.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw-eap-aka.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-eap-aka-rsa/posttest.dat b/testing/tests/sql/rw-eap-aka-rsa/posttest.dat index 23eeb0d17..584356d8e 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/posttest.dat +++ b/testing/tests/sql/rw-eap-aka-rsa/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* ~ diff --git a/testing/tests/sql/rw-eap-aka-rsa/pretest.dat b/testing/tests/sql/rw-eap-aka-rsa/pretest.dat index b78fd480f..8f2387ba1 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/pretest.dat +++ b/testing/tests/sql/rw-eap-aka-rsa/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql carol::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start carol::sleep 1 diff --git a/testing/tests/sql/rw-eap-aka-rsa/test.conf b/testing/tests/sql/rw-eap-aka-rsa/test.conf index 9cd583b16..4a5fc470f 100644 --- a/testing/tests/sql/rw-eap-aka-rsa/test.conf +++ b/testing/tests/sql/rw-eap-aka-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou" +VIRTHOSTS="alice moon carol winnetou" # Corresponding block diagram # DIAGRAM="a-m-c-w.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol" diff --git a/testing/tests/sql/rw-psk-ipv4/evaltest.dat b/testing/tests/sql/rw-psk-ipv4/evaltest.dat index 1ad36fcaf..eaf47395e 100644 --- a/testing/tests/sql/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/sql/rw-psk-ipv4/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-psk-ipv4/posttest.dat b/testing/tests/sql/rw-psk-ipv4/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/rw-psk-ipv4/posttest.dat +++ b/testing/tests/sql/rw-psk-ipv4/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/rw-psk-ipv4/pretest.dat b/testing/tests/sql/rw-psk-ipv4/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-psk-ipv4/pretest.dat +++ b/testing/tests/sql/rw-psk-ipv4/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-psk-ipv4/test.conf b/testing/tests/sql/rw-psk-ipv4/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-psk-ipv4/test.conf +++ b/testing/tests/sql/rw-psk-ipv4/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables deleted file mode 100755 index 25074a0f1..000000000 --- a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables +++ /dev/null @@ -1,107 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow last UDP fragment - ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules new file mode 100644 index 000000000..7362b2e25 --- /dev/null +++ b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules @@ -0,0 +1,16 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables deleted file mode 100755 index 25074a0f1..000000000 --- a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables +++ /dev/null @@ -1,107 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow last UDP fragment - ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules new file mode 100644 index 000000000..7362b2e25 --- /dev/null +++ b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules @@ -0,0 +1,16 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 25074a0f1..000000000 --- a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,107 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv6/conf/all/forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - /sbin/ip6tables -P INPUT DROP - /sbin/ip6tables -P OUTPUT DROP - /sbin/ip6tables -P FORWARD DROP - - # allow esp - ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow last UDP fragment - ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT - - # allow ICMPv6 neighbor-solicitations - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - - # allow ICMPv6 neighbor-advertisements - ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # log dropped packets - ip6tables -A INPUT -j LOG --log-prefix " IN: " - ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/ip6tables -t filter -P INPUT ACCEPT - /sbin/ip6tables -t filter -P FORWARD ACCEPT - /sbin/ip6tables -t filter -P OUTPUT ACCEPT - - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/ip6tables -F -t $a - /sbin/ip6tables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..7362b2e25 --- /dev/null +++ b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules @@ -0,0 +1,16 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/rw-psk-ipv6/posttest.dat b/testing/tests/sql/rw-psk-ipv6/posttest.dat index bdfd9ed00..ab753507f 100644 --- a/testing/tests/sql/rw-psk-ipv6/posttest.dat +++ b/testing/tests/sql/rw-psk-ipv6/posttest.dat @@ -1,9 +1,12 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +carol::ip6tables-restore < /etc/ip6tables.flush +dave::ip6tables-restore < /etc/ip6tables.flush alice::"ip route del fec0:\:/16 via fec1:\:1" carol::"ip route del fec1:\:/16 via fec0:\:1" dave::"ip route del fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/sql/rw-psk-ipv6/pretest.dat b/testing/tests/sql/rw-psk-ipv6/pretest.dat index 253438dbf..587dd7f85 100644 --- a/testing/tests/sql/rw-psk-ipv6/pretest.dat +++ b/testing/tests/sql/rw-psk-ipv6/pretest.dat @@ -7,9 +7,12 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +carol::ip6tables-restore < /etc/ip6tables.rules +dave::ip6tables-restore < /etc/ip6tables.rules alice::"ip route add fec0:\:/16 via fec1:\:1" carol::"ip route add fec1:\:/16 via fec0:\:1" dave::"ip route add fec1:\:/16 via fec0:\:1" diff --git a/testing/tests/sql/rw-psk-ipv6/test.conf b/testing/tests/sql/rw-psk-ipv6/test.conf index 80cf5e3a1..05bb8ab6d 100644 --- a/testing/tests/sql/rw-psk-ipv6/test.conf +++ b/testing/tests/sql/rw-psk-ipv6/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d-ip6.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-psk-rsa-split/evaltest.dat b/testing/tests/sql/rw-psk-rsa-split/evaltest.dat index 9a1ab3f8f..1648c9557 100644 --- a/testing/tests/sql/rw-psk-rsa-split/evaltest.dat +++ b/testing/tests/sql/rw-psk-rsa-split/evaltest.dat @@ -9,8 +9,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-psk-rsa-split/posttest.dat b/testing/tests/sql/rw-psk-rsa-split/posttest.dat index d4d57ad83..e9ad4bea6 100644 --- a/testing/tests/sql/rw-psk-rsa-split/posttest.dat +++ b/testing/tests/sql/rw-psk-rsa-split/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* carol::rm /etc/ipsec.d/ipsec.* dave::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/rw-psk-rsa-split/pretest.dat b/testing/tests/sql/rw-psk-rsa-split/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-psk-rsa-split/pretest.dat +++ b/testing/tests/sql/rw-psk-rsa-split/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-psk-rsa-split/test.conf b/testing/tests/sql/rw-psk-rsa-split/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-psk-rsa-split/test.conf +++ b/testing/tests/sql/rw-psk-rsa-split/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-rsa-keyid/evaltest.dat b/testing/tests/sql/rw-rsa-keyid/evaltest.dat index 26f82653a..4f5cd724c 100644 --- a/testing/tests/sql/rw-rsa-keyid/evaltest.dat +++ b/testing/tests/sql/rw-rsa-keyid/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-rsa-keyid/posttest.dat b/testing/tests/sql/rw-rsa-keyid/posttest.dat index b10aeb3aa..892650ccb 100644 --- a/testing/tests/sql/rw-rsa-keyid/posttest.dat +++ b/testing/tests/sql/rw-rsa-keyid/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.db carol::rm /etc/ipsec.d/ipsec.db dave::rm /etc/ipsec.d/ipsec.db diff --git a/testing/tests/sql/rw-rsa-keyid/pretest.dat b/testing/tests/sql/rw-rsa-keyid/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-rsa-keyid/pretest.dat +++ b/testing/tests/sql/rw-rsa-keyid/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-rsa-keyid/test.conf b/testing/tests/sql/rw-rsa-keyid/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-rsa-keyid/test.conf +++ b/testing/tests/sql/rw-rsa-keyid/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/rw-rsa/evaltest.dat b/testing/tests/sql/rw-rsa/evaltest.dat index f8cfb111b..ba661975b 100644 --- a/testing/tests/sql/rw-rsa/evaltest.dat +++ b/testing/tests/sql/rw-rsa/evaltest.dat @@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/rw-rsa/posttest.dat b/testing/tests/sql/rw-rsa/posttest.dat index b10aeb3aa..892650ccb 100644 --- a/testing/tests/sql/rw-rsa/posttest.dat +++ b/testing/tests/sql/rw-rsa/posttest.dat @@ -1,9 +1,9 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.db carol::rm /etc/ipsec.d/ipsec.db dave::rm /etc/ipsec.d/ipsec.db diff --git a/testing/tests/sql/rw-rsa/pretest.dat b/testing/tests/sql/rw-rsa/pretest.dat index 76316f33d..fdd4df5f9 100644 --- a/testing/tests/sql/rw-rsa/pretest.dat +++ b/testing/tests/sql/rw-rsa/pretest.dat @@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::ipsec start carol::ipsec start dave::ipsec start diff --git a/testing/tests/sql/rw-rsa/test.conf b/testing/tests/sql/rw-rsa/test.conf index 70416826e..f29298850 100644 --- a/testing/tests/sql/rw-rsa/test.conf +++ b/testing/tests/sql/rw-rsa/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" diff --git a/testing/tests/sql/shunt-policies/evaltest.dat b/testing/tests/sql/shunt-policies/evaltest.dat index 70aea411e..51dd9610b 100644 --- a/testing/tests/sql/shunt-policies/evaltest.dat +++ b/testing/tests/sql/shunt-policies/evaltest.dat @@ -4,16 +4,16 @@ moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES moon:: ipsec status 2> /dev/null::local-net.*PASS::YES moon:: ipsec status 2> /dev/null::venus-icmp.*DROP::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO +venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES +moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES +bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES venus::ssh PH_IP_BOB hostname::bob::YES diff --git a/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 2b90a14c7..000000000 --- a/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - # allow icmp in local net - iptables -A INPUT -i eth1 -p icmp -j ACCEPT - iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..af0f25209 --- /dev/null +++ b/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow icmp in local net +-A INPUT -i eth1 -p icmp -j ACCEPT +-A OUTPUT -o eth1 -p icmp -j ACCEPT + +COMMIT diff --git a/testing/tests/sql/shunt-policies/posttest.dat b/testing/tests/sql/shunt-policies/posttest.dat index 13f7ede0a..329a572b2 100644 --- a/testing/tests/sql/shunt-policies/posttest.dat +++ b/testing/tests/sql/shunt-policies/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::rm /etc/ipsec.d/ipsec.* sun::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/sql/shunt-policies/pretest.dat b/testing/tests/sql/shunt-policies/pretest.dat index 2ab18542f..a1777efb0 100644 --- a/testing/tests/sql/shunt-policies/pretest.dat +++ b/testing/tests/sql/shunt-policies/pretest.dat @@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::ipsec start sun::ipsec start moon::sleep 1 diff --git a/testing/tests/sql/shunt-policies/test.conf b/testing/tests/sql/shunt-policies/test.conf index d9a61590f..646b8b3e6 100644 --- a/testing/tests/sql/shunt-policies/test.conf +++ b/testing/tests/sql/shunt-policies/test.conf @@ -1,21 +1,21 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon winnetou sun bob" +VIRTHOSTS="alice moon winnetou sun bob" # Corresponding block diagram # DIAGRAM="a-m-w-s-b.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="sun" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon sun" diff --git a/testing/tests/tnc/tnccs-11-fhh/evaltest.dat b/testing/tests/tnc/tnccs-11-fhh/evaltest.dat index b6663ea5e..6b7c713ef 100644 --- a/testing/tests/tnc/tnccs-11-fhh/evaltest.dat +++ b/testing/tests/tnc/tnccs-11-fhh/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11-fhh/posttest.dat b/testing/tests/tnc/tnccs-11-fhh/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-11-fhh/posttest.dat +++ b/testing/tests/tnc/tnccs-11-fhh/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-11-fhh/pretest.dat b/testing/tests/tnc/tnccs-11-fhh/pretest.dat index c7a30ee7c..997c70a8e 100644 --- a/testing/tests/tnc/tnccs-11-fhh/pretest.dat +++ b/testing/tests/tnc/tnccs-11-fhh/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-11-fhh/test.conf b/testing/tests/tnc/tnccs-11-fhh/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-11-fhh/test.conf +++ b/testing/tests/tnc/tnccs-11-fhh/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat b/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat index b875eed49..d93407434 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat +++ b/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat @@ -9,6 +9,6 @@ dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/3 moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer dave@strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/eap.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf index 31556361e..31556361e 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/proxy.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default new file mode 100644 index 000000000..dd0825858 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default @@ -0,0 +1,43 @@ +authorize { + suffix + eap { + ok = return + } + files +} + +authenticate { + eap +} + +preacct { + preprocess + acct_unique + suffix + files +} + +accounting { + detail + unix + radutmp + attr_filter.accounting_response +} + +session { + radutmp +} + +post-auth { + exec + Post-Auth-Type REJECT { + attr_filter.access_reject + } +} + +pre-proxy { +} + +post-proxy { + eap +} diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel-second b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second index 2d4961288..2d4961288 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel-second +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/users b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/users +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary deleted file mode 100644 index 1a27a02fc..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary +++ /dev/null @@ -1,2 +0,0 @@ -$INCLUDE /usr/share/freeradius/dictionary -$INCLUDE /etc/raddb/dictionary.tnc diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc deleted file mode 100644 index f295467a9..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc +++ /dev/null @@ -1,5 +0,0 @@ -ATTRIBUTE TNC-Status 3001 integer - -VALUE TNC-Status Access 0 -VALUE TNC-Status Isolate 1 -VALUE TNC-Status None 2 diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default deleted file mode 100644 index 802fcfd8d..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default +++ /dev/null @@ -1,44 +0,0 @@ -authorize { - suffix - eap { - ok = return - } - files -} - -authenticate { - eap -} - -preacct { - preprocess - acct_unique - suffix - files -} - -accounting { - detail - unix - radutmp - attr_filter.accounting_response -} - -session { - radutmp -} - -post-auth { - exec - Post-Auth-Type REJECT { - attr_filter.access_reject - } -} - -pre-proxy { -} - -post-proxy { - eap -} - diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/tnc/tnccs-11-radius-block/posttest.dat b/testing/tests/tnc/tnccs-11-radius-block/posttest.dat index 51d8ca1b3..5e5a8514d 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/posttest.dat +++ b/testing/tests/tnc/tnccs-11-radius-block/posttest.dat @@ -2,8 +2,8 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop alice::killall radiusd -alice::rm /etc/raddb/sites-enabled/inner-tunnel-second -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush dave::/etc/init.d/apache2 stop 2> /dev/null diff --git a/testing/tests/tnc/tnccs-11-radius-block/pretest.dat b/testing/tests/tnc/tnccs-11-radius-block/pretest.dat index 0fa88dbc7..c8f2139a8 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/pretest.dat +++ b/testing/tests/tnc/tnccs-11-radius-block/pretest.dat @@ -1,9 +1,9 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules dave::/etc/init.d/apache2 start 2> /dev/null -alice::ln -s /etc/raddb/sites-available/inner-tunnel-second /etc/raddb/sites-enabled/inner-tunnel-second -alice::cat /etc/raddb/sites-enabled/inner-tunnel-second +alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second +alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd moon::ipsec start carol::LEAK_DETECTIVE_DISABLE=1 ipsec start diff --git a/testing/tests/tnc/tnccs-11-radius-block/test.conf b/testing/tests/tnc/tnccs-11-radius-block/test.conf index bb6b68687..29bfaa78c 100644 --- a/testing/tests/tnc/tnccs-11-radius-block/test.conf +++ b/testing/tests/tnc/tnccs-11-radius-block/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice moon carol winnetou dave" +VIRTHOSTS="alice moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/tnc/tnccs-11-radius/evaltest.dat b/testing/tests/tnc/tnccs-11-radius/evaltest.dat index d72239e8e..e22b767f7 100644 --- a/testing/tests/tnc/tnccs-11-radius/evaltest.dat +++ b/testing/tests/tnc/tnccs-11-radius/evaltest.dat @@ -1,10 +1,10 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate':: moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf index 31556361e..31556361e 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/eap.conf +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf index 23cba8d11..23cba8d11 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/proxy.conf +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default new file mode 100644 index 000000000..dd0825858 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default @@ -0,0 +1,43 @@ +authorize { + suffix + eap { + ok = return + } + files +} + +authenticate { + eap +} + +preacct { + preprocess + acct_unique + suffix + files +} + +accounting { + detail + unix + radutmp + attr_filter.accounting_response +} + +session { + radutmp +} + +post-auth { + exec + Post-Auth-Type REJECT { + attr_filter.access_reject + } +} + +pre-proxy { +} + +post-proxy { + eap +} diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel index e088fae14..e088fae14 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second index f91bccc72..c5bde6a9e 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second @@ -17,14 +17,14 @@ session { post-auth { if (control:TNC-Status == "Access") { update reply { - Tunnel-Type := ESP + Tunnel-Type := ESP Filter-Id := "allow" } } elsif (control:TNC-Status == "Isolate") { update reply { - Tunnel-Type := ESP - Filter-Id := "isolate" + Tunnel-Type := ESP + Filter-Id := "isolate" } } diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/users b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users index 50ccf3e76..50ccf3e76 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/users +++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf deleted file mode 100644 index f4e179aa4..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf +++ /dev/null @@ -1,4 +0,0 @@ -client PH_IP_MOON1 { - secret = gv6URkSs - shortname = moon -} diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary deleted file mode 100644 index 1a27a02fc..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary +++ /dev/null @@ -1,2 +0,0 @@ -$INCLUDE /usr/share/freeradius/dictionary -$INCLUDE /etc/raddb/dictionary.tnc diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc deleted file mode 100644 index f295467a9..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc +++ /dev/null @@ -1,5 +0,0 @@ -ATTRIBUTE TNC-Status 3001 integer - -VALUE TNC-Status Access 0 -VALUE TNC-Status Isolate 1 -VALUE TNC-Status None 2 diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf deleted file mode 100644 index 1143a0473..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf +++ /dev/null @@ -1,120 +0,0 @@ -# radiusd.conf -- FreeRADIUS server configuration file. - -prefix = /usr -exec_prefix = ${prefix} -sysconfdir = /etc -localstatedir = /var -sbindir = ${exec_prefix}/sbin -logdir = ${localstatedir}/log/radius -raddbdir = ${sysconfdir}/raddb -radacctdir = ${logdir}/radacct - -# name of the running server. See also the "-n" command-line option. -name = radiusd - -# Location of config and logfiles. -confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd - -# Should likely be ${localstatedir}/lib/radiusd -db_dir = ${raddbdir} - -# libdir: Where to find the rlm_* modules. -libdir = ${exec_prefix}/lib - -# pidfile: Where to place the PID of the RADIUS server. -pidfile = ${run_dir}/${name}.pid - -# max_request_time: The maximum time (in seconds) to handle a request. -max_request_time = 30 - -# cleanup_delay: The time to wait (in seconds) before cleaning up -cleanup_delay = 5 - -# max_requests: The maximum number of requests which the server keeps -max_requests = 1024 - -# listen: Make the server listen on a particular IP address, and send -listen { - type = auth - ipaddr = PH_IP_ALICE - port = 0 -} - -# This second "listen" section is for listening on the accounting -# port, too. -# -listen { - type = acct - ipaddr = PH_IP_ALICE - port = 0 -} - -# hostname_lookups: Log the names of clients or just their IP addresses -hostname_lookups = no - -# Core dumps are a bad thing. This should only be set to 'yes' -allow_core_dumps = no - -# Regular expressions -regular_expressions = yes -extended_expressions = yes - -# Logging section. The various "log_*" configuration items -log { - destination = files - file = ${logdir}/radius.log - syslog_facility = daemon - stripped_names = no - auth = yes - auth_badpass = yes - auth_goodpass = yes -} - -# The program to execute to do concurrency checks. -checkrad = ${sbindir}/checkrad - -# Security considerations -security { - max_attributes = 200 - reject_delay = 1 - status_server = yes -} - -# PROXY CONFIGURATION -proxy_requests = yes -$INCLUDE proxy.conf - -# CLIENTS CONFIGURATION -$INCLUDE clients.conf - -# THREAD POOL CONFIGURATION -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} - -# MODULE CONFIGURATION -modules { - $INCLUDE ${confdir}/modules/ - $INCLUDE eap.conf - $INCLUDE sql.conf - $INCLUDE sql/mysql/counter.conf -} - -# Instantiation -instantiate { - exec - expr - expiration - logintime -} - -# Policies -$INCLUDE policy.conf - -# Include all enabled virtual hosts -$INCLUDE sites-enabled/ diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default deleted file mode 100644 index 802fcfd8d..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default +++ /dev/null @@ -1,44 +0,0 @@ -authorize { - suffix - eap { - ok = return - } - files -} - -authenticate { - eap -} - -preacct { - preprocess - acct_unique - suffix - files -} - -accounting { - detail - unix - radutmp - attr_filter.accounting_response -} - -session { - radutmp -} - -post-auth { - exec - Post-Auth-Type REJECT { - attr_filter.access_reject - } -} - -pre-proxy { -} - -post-proxy { - eap -} - diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/tnc/tnccs-11-radius/posttest.dat b/testing/tests/tnc/tnccs-11-radius/posttest.dat index 86bd89dea..a64a9147c 100644 --- a/testing/tests/tnc/tnccs-11-radius/posttest.dat +++ b/testing/tests/tnc/tnccs-11-radius/posttest.dat @@ -2,7 +2,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop alice::killall radiusd -alice::rm /etc/raddb/sites-enabled/inner-tunnel-second -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-11-radius/pretest.dat b/testing/tests/tnc/tnccs-11-radius/pretest.dat index b5d284278..8f79c776a 100644 --- a/testing/tests/tnc/tnccs-11-radius/pretest.dat +++ b/testing/tests/tnc/tnccs-11-radius/pretest.dat @@ -1,8 +1,8 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null -alice::ln -s /etc/raddb/sites-available/inner-tunnel-second /etc/raddb/sites-enabled/inner-tunnel-second -alice::cat /etc/raddb/sites-enabled/inner-tunnel-second +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second +alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd alice::cat /etc/tnc_config carol::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-11-radius/test.conf b/testing/tests/tnc/tnccs-11-radius/test.conf index 2a52df203..f23a19329 100644 --- a/testing/tests/tnc/tnccs-11-radius/test.conf +++ b/testing/tests/tnc/tnccs-11-radius/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS="alice" diff --git a/testing/tests/tnc/tnccs-11/evaltest.dat b/testing/tests/tnc/tnccs-11/evaltest.dat index b6663ea5e..6b7c713ef 100644 --- a/testing/tests/tnc/tnccs-11/evaltest.dat +++ b/testing/tests/tnc/tnccs-11/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-11/posttest.dat b/testing/tests/tnc/tnccs-11/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-11/posttest.dat +++ b/testing/tests/tnc/tnccs-11/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-11/pretest.dat b/testing/tests/tnc/tnccs-11/pretest.dat index dd729cb0b..7bfcf0d07 100644 --- a/testing/tests/tnc/tnccs-11/pretest.dat +++ b/testing/tests/tnc/tnccs-11/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-11/test.conf b/testing/tests/tnc/tnccs-11/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-11/test.conf +++ b/testing/tests/tnc/tnccs-11/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-block/evaltest.dat b/testing/tests/tnc/tnccs-20-block/evaltest.dat index 881f442b7..03b576efa 100644 --- a/testing/tests/tnc/tnccs-20-block/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-block/evaltest.dat @@ -8,5 +8,5 @@ dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/3 moon:: cat /var/log/daemon.log::added group membership 'allow'::YES moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer dave@strongswan.org::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-block/posttest.dat b/testing/tests/tnc/tnccs-20-block/posttest.dat index 50bb7e117..2258e03ff 100644 --- a/testing/tests/tnc/tnccs-20-block/posttest.dat +++ b/testing/tests/tnc/tnccs-20-block/posttest.dat @@ -1,7 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush dave::/etc/init.d/apache2 stop 2> /dev/null diff --git a/testing/tests/tnc/tnccs-20-block/pretest.dat b/testing/tests/tnc/tnccs-20-block/pretest.dat index 7b0a42fcd..f5b3b2e8c 100644 --- a/testing/tests/tnc/tnccs-20-block/pretest.dat +++ b/testing/tests/tnc/tnccs-20-block/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules dave::/etc/init.d/apache2 start 2> /dev/null moon::cat /etc/tnc_config carol::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-block/test.conf b/testing/tests/tnc/tnccs-20-block/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-block/test.conf +++ b/testing/tests/tnc/tnccs-20-block/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat b/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-client-retry/posttest.dat b/testing/tests/tnc/tnccs-20-client-retry/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/posttest.dat +++ b/testing/tests/tnc/tnccs-20-client-retry/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-client-retry/pretest.dat b/testing/tests/tnc/tnccs-20-client-retry/pretest.dat index 208f9daa9..b2b243ba3 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/pretest.dat +++ b/testing/tests/tnc/tnccs-20-client-retry/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-client-retry/test.conf b/testing/tests/tnc/tnccs-20-client-retry/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-client-retry/test.conf +++ b/testing/tests/tnc/tnccs-20-client-retry/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-fhh/evaltest.dat b/testing/tests/tnc/tnccs-20-fhh/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-fhh/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-fhh/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-fhh/posttest.dat b/testing/tests/tnc/tnccs-20-fhh/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-fhh/posttest.dat +++ b/testing/tests/tnc/tnccs-20-fhh/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-fhh/pretest.dat b/testing/tests/tnc/tnccs-20-fhh/pretest.dat index 76ad91f98..72c9b1665 100644 --- a/testing/tests/tnc/tnccs-20-fhh/pretest.dat +++ b/testing/tests/tnc/tnccs-20-fhh/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-fhh/test.conf b/testing/tests/tnc/tnccs-20-fhh/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-fhh/test.conf +++ b/testing/tests/tnc/tnccs-20-fhh/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-os/evaltest.dat b/testing/tests/tnc/tnccs-20-os/evaltest.dat index 3d84f81e3..3c13e5ffa 100644 --- a/testing/tests/tnc/tnccs-20-os/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-os/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-os/posttest.dat b/testing/tests/tnc/tnccs-20-os/posttest.dat index 7cebd7f25..74b902c69 100644 --- a/testing/tests/tnc/tnccs-20-os/posttest.dat +++ b/testing/tests/tnc/tnccs-20-os/posttest.dat @@ -1,6 +1,7 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +carol::echo 1 > /proc/sys/net/ipv4/ip_forward diff --git a/testing/tests/tnc/tnccs-20-os/pretest.dat b/testing/tests/tnc/tnccs-20-os/pretest.dat index 208f9daa9..8169afab2 100644 --- a/testing/tests/tnc/tnccs-20-os/pretest.dat +++ b/testing/tests/tnc/tnccs-20-os/pretest.dat @@ -1,6 +1,7 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +carol::echo 0 > /proc/sys/net/ipv4/ip_forward moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-os/test.conf b/testing/tests/tnc/tnccs-20-os/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-os/test.conf +++ b/testing/tests/tnc/tnccs-20-os/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-pdp/evaltest.dat b/testing/tests/tnc/tnccs-20-pdp/evaltest.dat index 83739b70a..e969774c5 100644 --- a/testing/tests/tnc/tnccs-20-pdp/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-pdp/evaltest.dat @@ -1,10 +1,10 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES carol::cat /var/log/daemon.log::PB-TNC access recommendation is .*Access Allowed::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is .*Quarantined::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES @@ -12,7 +12,7 @@ moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate':: moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2>/dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2>/dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables deleted file mode 100755 index 56587b2e8..000000000 --- a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # enable IP forwarding - echo 1 > /proc/sys/net/ipv4/ip_forward - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow esp - iptables -A INPUT -i eth0 -p 50 -j ACCEPT - iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow MobIKE - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow RADIUS protocol with alice - iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT - iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..1eb755354 --- /dev/null +++ b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules @@ -0,0 +1,32 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +# allow RADIUS protocol with alice +-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT + +COMMIT diff --git a/testing/tests/tnc/tnccs-20-pdp/posttest.dat b/testing/tests/tnc/tnccs-20-pdp/posttest.dat index 16218f385..e7eecd5f4 100644 --- a/testing/tests/tnc/tnccs-20-pdp/posttest.dat +++ b/testing/tests/tnc/tnccs-20-pdp/posttest.dat @@ -2,6 +2,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop alice::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-pdp/pretest.dat b/testing/tests/tnc/tnccs-20-pdp/pretest.dat index 9b9d6b699..32ed4d854 100644 --- a/testing/tests/tnc/tnccs-20-pdp/pretest.dat +++ b/testing/tests/tnc/tnccs-20-pdp/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules alice::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-pdp/test.conf b/testing/tests/tnc/tnccs-20-pdp/test.conf index 400628531..c4ca1a19f 100644 --- a/testing/tests/tnc/tnccs-20-pdp/test.conf +++ b/testing/tests/tnc/tnccs-20-pdp/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave alice" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat b/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-server-retry/posttest.dat b/testing/tests/tnc/tnccs-20-server-retry/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/posttest.dat +++ b/testing/tests/tnc/tnccs-20-server-retry/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-server-retry/pretest.dat b/testing/tests/tnc/tnccs-20-server-retry/pretest.dat index 208f9daa9..b2b243ba3 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/pretest.dat +++ b/testing/tests/tnc/tnccs-20-server-retry/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-server-retry/test.conf b/testing/tests/tnc/tnccs-20-server-retry/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-server-retry/test.conf +++ b/testing/tests/tnc/tnccs-20-server-retry/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20-tls/evaltest.dat b/testing/tests/tnc/tnccs-20-tls/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20-tls/evaltest.dat +++ b/testing/tests/tnc/tnccs-20-tls/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20-tls/posttest.dat b/testing/tests/tnc/tnccs-20-tls/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20-tls/posttest.dat +++ b/testing/tests/tnc/tnccs-20-tls/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20-tls/pretest.dat b/testing/tests/tnc/tnccs-20-tls/pretest.dat index c332f131b..cac1cfafc 100644 --- a/testing/tests/tnc/tnccs-20-tls/pretest.dat +++ b/testing/tests/tnc/tnccs-20-tls/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20-tls/test.conf b/testing/tests/tnc/tnccs-20-tls/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20-tls/test.conf +++ b/testing/tests/tnc/tnccs-20-tls/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-20/evaltest.dat b/testing/tests/tnc/tnccs-20/evaltest.dat index 3d84f81e3..bac7294b2 100644 --- a/testing/tests/tnc/tnccs-20/evaltest.dat +++ b/testing/tests/tnc/tnccs-20/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::added group membership 'allow'::YES @@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-20/posttest.dat b/testing/tests/tnc/tnccs-20/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-20/posttest.dat +++ b/testing/tests/tnc/tnccs-20/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-20/pretest.dat b/testing/tests/tnc/tnccs-20/pretest.dat index 208f9daa9..b2b243ba3 100644 --- a/testing/tests/tnc/tnccs-20/pretest.dat +++ b/testing/tests/tnc/tnccs-20/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-20/test.conf b/testing/tests/tnc/tnccs-20/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-20/test.conf +++ b/testing/tests/tnc/tnccs-20/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= diff --git a/testing/tests/tnc/tnccs-dynamic/evaltest.dat b/testing/tests/tnc/tnccs-dynamic/evaltest.dat index 69baaf592..405298381 100644 --- a/testing/tests/tnc/tnccs-dynamic/evaltest.dat +++ b/testing/tests/tnc/tnccs-dynamic/evaltest.dat @@ -1,9 +1,9 @@ carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES -carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES -dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES +dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES moon:: cat /var/log/daemon.log::TNCCS 1.1 protocol detected dynamically::YES @@ -20,8 +20,8 @@ moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP moon:: cat /var/log/daemon.log::removed TNCCS Connection ID 2::YES moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO -dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO +dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO diff --git a/testing/tests/tnc/tnccs-dynamic/posttest.dat b/testing/tests/tnc/tnccs-dynamic/posttest.dat index 7cebd7f25..1865a1c60 100644 --- a/testing/tests/tnc/tnccs-dynamic/posttest.dat +++ b/testing/tests/tnc/tnccs-dynamic/posttest.dat @@ -1,6 +1,6 @@ moon::ipsec stop carol::ipsec stop dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/tnc/tnccs-dynamic/pretest.dat b/testing/tests/tnc/tnccs-dynamic/pretest.dat index a7a3bf412..60775a11e 100644 --- a/testing/tests/tnc/tnccs-dynamic/pretest.dat +++ b/testing/tests/tnc/tnccs-dynamic/pretest.dat @@ -1,6 +1,6 @@ -moon::/etc/init.d/iptables start 2> /dev/null -carol::/etc/init.d/iptables start 2> /dev/null -dave::/etc/init.d/iptables start 2> /dev/null +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules moon::cat /etc/tnc_config carol::cat /etc/tnc_config dave::cat /etc/tnc_config diff --git a/testing/tests/tnc/tnccs-dynamic/test.conf b/testing/tests/tnc/tnccs-dynamic/test.conf index e28b8259b..a8a05af19 100644 --- a/testing/tests/tnc/tnccs-dynamic/test.conf +++ b/testing/tests/tnc/tnccs-dynamic/test.conf @@ -1,26 +1,26 @@ #!/bin/bash # # This configuration file provides information on the -# UML instances used for this test +# guest instances used for this test -# All UML instances that are required for this test +# All guest instances that are required for this test # -UMLHOSTS="alice venus moon carol winnetou dave" +VIRTHOSTS="alice venus moon carol winnetou dave" # Corresponding block diagram # DIAGRAM="a-v-m-c-w-d.png" -# UML instances on which tcpdump is to be started +# Guest instances on which tcpdump is to be started # TCPDUMPHOSTS="moon" -# UML instances on which IPsec is started +# Guest instances on which IPsec is started # Used for IPsec logging purposes # IPSECHOSTS="moon carol dave" -# UML instances on which FreeRadius is started +# Guest instances on which FreeRadius is started # RADIUSHOSTS= |