2 # SPDX-License-Identifier: BSD-2-Clause
4 # Copyright (c) 2022 Rubicon Communications, LLC ("Netgate")
6 # Redistribution and use in source and binary forms, with or without
7 # modification, are permitted provided that the following conditions
9 # 1. Redistributions of source code must retain the above copyright
10 # notice, this list of conditions and the following disclaimer.
11 # 2. Redistributions in binary form must reproduce the above copyright
12 # notice, this list of conditions and the following disclaimer in the
13 # documentation and/or other materials provided with the distribution.
15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 . $(atf_get_srcdir)/utils.subr
28 . $(atf_get_srcdir)/../../netpfil/pf/utils.subr
30 atf_test_case "4in4" "cleanup"
33 atf_set descr 'IPv4 in IPv4 tunnel'
34 atf_set require.user root
35 atf_set require.progs openvpn
45 jexec a ifconfig ${l}a 192.0.2.1/24 up
47 jexec b ifconfig ${l}b 192.0.2.2/24 up
50 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2
61 server 198.51.100.0 255.255.255.0
62 ca $(atf_get_srcdir)/ca.crt
63 cert $(atf_get_srcdir)/server.crt
64 key $(atf_get_srcdir)/server.key
65 dh $(atf_get_srcdir)/dh.pem
69 auth-user-pass-verify /usr/bin/true via-env
81 auth-user-pass $(atf_get_srcdir)/user.pass
83 ca $(atf_get_srcdir)/ca.crt
84 cert $(atf_get_srcdir)/client.crt
85 key $(atf_get_srcdir)/client.key
86 dh $(atf_get_srcdir)/dh.pem
91 # Give the tunnel time to come up
94 atf_check -s exit:0 -o ignore jexec b ping -c 1 198.51.100.1
96 echo 'foo' | jexec b nc -u -w 2 192.0.2.1 1194
97 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1
105 atf_test_case "4mapped" "cleanup"
108 atf_set descr 'IPv4 mapped addresses'
109 atf_set require.user root
110 atf_set require.progs openvpn
120 jexec a ifconfig ${l}a 192.0.2.1/24 up
122 jexec b ifconfig ${l}b 192.0.2.2/24 up
125 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2
127 #jexec a ifconfig ${l}a
136 server 198.51.100.0 255.255.255.0
137 ca $(atf_get_srcdir)/ca.crt
138 cert $(atf_get_srcdir)/server.crt
139 key $(atf_get_srcdir)/server.key
140 dh $(atf_get_srcdir)/dh.pem
144 auth-user-pass-verify /usr/bin/true via-env
156 auth-user-pass $(atf_get_srcdir)/user.pass
158 ca $(atf_get_srcdir)/ca.crt
159 cert $(atf_get_srcdir)/client.crt
160 key $(atf_get_srcdir)/client.key
161 dh $(atf_get_srcdir)/dh.pem
166 # Give the tunnel time to come up
169 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1
177 atf_test_case "6in4" "cleanup"
180 atf_set descr 'IPv6 in IPv4 tunnel'
181 atf_set require.user root
182 atf_set require.progs openvpn
192 jexec a ifconfig ${l}a 192.0.2.1/24 up
194 jexec b ifconfig ${l}b 192.0.2.2/24 up
197 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2
208 server-ipv6 2001:db8:1::/64
210 ca $(atf_get_srcdir)/ca.crt
211 cert $(atf_get_srcdir)/server.crt
212 key $(atf_get_srcdir)/server.key
213 dh $(atf_get_srcdir)/dh.pem
217 auth-user-pass-verify /usr/bin/true via-env
229 auth-user-pass $(atf_get_srcdir)/user.pass
231 ca $(atf_get_srcdir)/ca.crt
232 cert $(atf_get_srcdir)/client.crt
233 key $(atf_get_srcdir)/client.key
234 dh $(atf_get_srcdir)/dh.pem
239 # Give the tunnel time to come up
242 atf_check -s exit:0 -o ignore jexec b ping6 -c 3 2001:db8:1::1
250 atf_test_case "4in6" "cleanup"
253 atf_set descr 'IPv4 in IPv6 tunnel'
254 atf_set require.user root
255 atf_set require.progs openvpn
265 jexec a ifconfig ${l}a inet6 2001:db8::1/64 up no_dad
267 jexec b ifconfig ${l}b inet6 2001:db8::2/64 up no_dad
270 atf_check -s exit:0 -o ignore jexec a ping6 -c 1 2001:db8::2
281 server 198.51.100.0 255.255.255.0
282 ca $(atf_get_srcdir)/ca.crt
283 cert $(atf_get_srcdir)/server.crt
284 key $(atf_get_srcdir)/server.key
285 dh $(atf_get_srcdir)/dh.pem
289 auth-user-pass-verify /usr/bin/true via-env
301 auth-user-pass $(atf_get_srcdir)/user.pass
303 ca $(atf_get_srcdir)/ca.crt
304 cert $(atf_get_srcdir)/client.crt
305 key $(atf_get_srcdir)/client.key
306 dh $(atf_get_srcdir)/dh.pem
311 # Give the tunnel time to come up
314 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1
322 atf_test_case "6in6" "cleanup"
325 atf_set descr 'IPv6 in IPv6 tunnel'
326 atf_set require.user root
327 atf_set require.progs openvpn
337 jexec a ifconfig ${l}a inet6 2001:db8::1/64 up no_dad
339 jexec b ifconfig ${l}b inet6 2001:db8::2/64 up no_dad
342 atf_check -s exit:0 -o ignore jexec a ping6 -c 1 2001:db8::2
353 server-ipv6 2001:db8:1::/64
355 ca $(atf_get_srcdir)/ca.crt
356 cert $(atf_get_srcdir)/server.crt
357 key $(atf_get_srcdir)/server.key
358 dh $(atf_get_srcdir)/dh.pem
362 auth-user-pass-verify /usr/bin/true via-env
374 auth-user-pass $(atf_get_srcdir)/user.pass
376 ca $(atf_get_srcdir)/ca.crt
377 cert $(atf_get_srcdir)/client.crt
378 key $(atf_get_srcdir)/client.key
379 dh $(atf_get_srcdir)/dh.pem
384 # Give the tunnel time to come up
387 atf_check -s exit:0 -o ignore jexec b ping6 -c 3 2001:db8:1::1
388 atf_check -s exit:0 -o ignore jexec b ping6 -c 3 -z 16 2001:db8:1::1
396 atf_test_case "timeout_client" "cleanup"
397 timeout_client_head()
399 atf_set descr 'IPv4 in IPv4 tunnel'
400 atf_set require.user root
401 atf_set require.progs openvpn
404 timeout_client_body()
411 jexec a ifconfig ${l}a 192.0.2.1/24 up
412 jexec a ifconfig lo0 127.0.0.1/8 up
414 jexec b ifconfig ${l}b 192.0.2.2/24 up
417 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2
428 server 198.51.100.0 255.255.255.0
429 ca $(atf_get_srcdir)/ca.crt
430 cert $(atf_get_srcdir)/server.crt
431 key $(atf_get_srcdir)/server.key
432 dh $(atf_get_srcdir)/dh.pem
436 auth-user-pass-verify /usr/bin/true via-env
441 management 192.0.2.1 1234
450 auth-user-pass $(atf_get_srcdir)/user.pass
452 ca $(atf_get_srcdir)/ca.crt
453 cert $(atf_get_srcdir)/client.crt
454 key $(atf_get_srcdir)/client.key
455 dh $(atf_get_srcdir)/dh.pem
460 # Give the tunnel time to come up
463 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1
466 jexec b killall openvpn
468 # Now wait for the server to notice
471 while echo "status" | jexec a nc -N 192.0.2.1 1234 | grep 192.0.2.2; do
472 echo "Client disconnect not discovered"
477 timeout_client_cleanup()
482 atf_test_case "explicit_exit" "cleanup"
485 atf_set descr 'Test explicit exit notification'
486 atf_set require.user root
487 atf_set require.progs openvpn
497 jexec a ifconfig ${l}a 192.0.2.1/24 up
498 jexec a ifconfig lo0 127.0.0.1/8 up
500 jexec b ifconfig ${l}b 192.0.2.2/24 up
503 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2
514 server 198.51.100.0 255.255.255.0
515 ca $(atf_get_srcdir)/ca.crt
516 cert $(atf_get_srcdir)/server.crt
517 key $(atf_get_srcdir)/server.key
518 dh $(atf_get_srcdir)/dh.pem
522 auth-user-pass-verify /usr/bin/true via-env
525 management 192.0.2.1 1234
534 auth-user-pass $(atf_get_srcdir)/user.pass
536 ca $(atf_get_srcdir)/ca.crt
537 cert $(atf_get_srcdir)/client.crt
538 key $(atf_get_srcdir)/client.key
539 dh $(atf_get_srcdir)/dh.pem
544 # Give the tunnel time to come up
547 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1
549 if ! echo "status" | jexec a nc -N 192.0.2.1 1234 | grep 192.0.2.2; then
550 atf_fail "Client not found in status list!"
554 jexec b killall openvpn
556 while echo "status" | jexec a nc -N 192.0.2.1 1234 | grep 192.0.2.2; do
558 echo "Client disconnect not discovered"
563 explicit_exit_cleanup()
568 atf_test_case "multi_client" "cleanup"
571 atf_set descr 'Multiple simultaneous clients'
572 atf_set require.user root
573 atf_set require.progs openvpn
580 bridge=$(vnet_mkbridge)
585 ifconfig ${bridge} up
588 ifconfig ${bridge} addm ${srv}a
590 ifconfig ${bridge} addm ${one}a
592 ifconfig ${bridge} addm ${two}a
594 vnet_mkjail srv ${srv}b
595 jexec srv ifconfig ${srv}b 192.0.2.1/24 up
596 vnet_mkjail one ${one}b
597 jexec one ifconfig ${one}b 192.0.2.2/24 up
598 vnet_mkjail two ${two}b
599 jexec two ifconfig ${two}b 192.0.2.3/24 up
600 jexec two ifconfig lo0 127.0.0.1/8 up
601 jexec two ifconfig lo0 inet alias 203.0.113.1/24
604 atf_check -s exit:0 -o ignore jexec one ping -c 1 192.0.2.1
605 atf_check -s exit:0 -o ignore jexec two ping -c 1 192.0.2.1
607 jexec srv sysctl net.inet.ip.forwarding=1
618 server 198.51.100.0 255.255.255.0
620 push \"route 203.0.113.0 255.255.255.0 198.51.100.1\"
622 ca $(atf_get_srcdir)/ca.crt
623 cert $(atf_get_srcdir)/server.crt
624 key $(atf_get_srcdir)/server.key
625 dh $(atf_get_srcdir)/dh.pem
630 auth-user-pass-verify /usr/bin/true via-env
635 client-config-dir $(atf_get_srcdir)/ccd
644 auth-user-pass $(atf_get_srcdir)/user.pass
646 ca $(atf_get_srcdir)/ca.crt
647 cert $(atf_get_srcdir)/client.crt
648 key $(atf_get_srcdir)/client.key
649 dh $(atf_get_srcdir)/dh.pem
660 auth-user-pass $(atf_get_srcdir)/user.pass
662 ca $(atf_get_srcdir)/ca.crt
663 cert $(atf_get_srcdir)/client2.crt
664 key $(atf_get_srcdir)/client2.key
665 dh $(atf_get_srcdir)/dh.pem
670 # Give the tunnel time to come up
673 atf_check -s exit:0 -o ignore jexec one ping -c 3 198.51.100.1
674 atf_check -s exit:0 -o ignore jexec two ping -c 3 198.51.100.1
676 # Client-to-client communication
677 atf_check -s exit:0 -o ignore jexec one ping -c 3 198.51.100.3
678 atf_check -s exit:0 -o ignore jexec two ping -c 3 198.51.100.2
681 atf_check -s exit:0 -o ignore jexec one ping -c 3 203.0.113.1
684 multi_client_cleanup()
689 atf_test_case "route_to" "cleanup"
692 atf_set descr "Test pf's route-to with OpenVPN tunnels"
693 atf_set require.user root
694 atf_set require.progs openvpn
706 jexec a ifconfig ${l}a 192.0.2.1/24 up
707 vnet_mkjail b ${l}b ${n}a
708 jexec b ifconfig ${l}b 192.0.2.2/24 up
709 jexec b ifconfig ${n}a up
712 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2
723 server 198.51.100.0 255.255.255.0
724 ca $(atf_get_srcdir)/ca.crt
725 cert $(atf_get_srcdir)/server.crt
726 key $(atf_get_srcdir)/server.key
727 dh $(atf_get_srcdir)/dh.pem
731 auth-user-pass-verify /usr/bin/true via-env
743 auth-user-pass $(atf_get_srcdir)/user.pass
745 ca $(atf_get_srcdir)/ca.crt
746 cert $(atf_get_srcdir)/client.crt
747 key $(atf_get_srcdir)/client.key
748 dh $(atf_get_srcdir)/dh.pem
753 # Give the tunnel time to come up
755 jexec a ifconfig ovpn0 inet alias 198.51.100.254/24
758 atf_check -s exit:0 -o ignore jexec b ping -c 1 -S 198.51.100.2 198.51.100.1
759 atf_check -s exit:0 -o ignore jexec b ping -c 1 -S 198.51.100.2 198.51.100.254
761 # Break our route to .254 so that we need a route-to to make things work.
762 jexec b ifconfig ${n}a 203.0.113.1/24 up
763 jexec b route add 198.51.100.254 -interface ${n}a
765 # Make sure it's broken.
766 atf_check -s exit:2 -o ignore jexec b ping -c 1 -S 198.51.100.2 198.51.100.254
770 "pass out route-to (tun0 198.51.100.1) proto icmp from 198.51.100.2 "
771 atf_check -s exit:0 -o ignore jexec b ping -c 3 -S 198.51.100.2 198.51.100.254
780 atf_test_case "ra" "cleanup"
783 atf_set descr 'Remote access with multiple clients'
784 atf_set require.user root
785 atf_set require.progs openvpn
792 bridge=$(vnet_mkbridge)
798 ifconfig ${bridge} up
801 ifconfig ${bridge} addm ${srv}a
803 ifconfig ${bridge} addm ${one}a
805 ifconfig ${bridge} addm ${two}a
807 vnet_mkjail srv ${srv}b ${lan}a
808 jexec srv ifconfig ${srv}b 192.0.2.1/24 up
809 jexec srv ifconfig ${lan}a 203.0.113.1/24 up
810 vnet_mkjail lan ${lan}b
811 jexec lan ifconfig ${lan}b 203.0.113.2/24 up
812 jexec lan route add default 203.0.113.1
813 vnet_mkjail one ${one}b
814 jexec one ifconfig ${one}b 192.0.2.2/24 up
815 vnet_mkjail two ${two}b
816 jexec two ifconfig ${two}b 192.0.2.3/24 up
819 atf_check -s exit:0 -o ignore jexec one ping -c 1 192.0.2.1
820 atf_check -s exit:0 -o ignore jexec two ping -c 1 192.0.2.1
821 atf_check -s exit:0 -o ignore jexec srv ping -c 1 203.0.113.2
823 jexec srv sysctl net.inet.ip.forwarding=1
834 server 198.51.100.0 255.255.255.0
836 push \"route 203.0.113.0 255.255.255.0\"
838 ca $(atf_get_srcdir)/ca.crt
839 cert $(atf_get_srcdir)/server.crt
840 key $(atf_get_srcdir)/server.key
841 dh $(atf_get_srcdir)/dh.pem
846 auth-user-pass-verify /usr/bin/true via-env
858 auth-user-pass $(atf_get_srcdir)/user.pass
860 ca $(atf_get_srcdir)/ca.crt
861 cert $(atf_get_srcdir)/client.crt
862 key $(atf_get_srcdir)/client.key
863 dh $(atf_get_srcdir)/dh.pem
875 auth-user-pass $(atf_get_srcdir)/user.pass
877 ca $(atf_get_srcdir)/ca.crt
878 cert $(atf_get_srcdir)/client2.crt
879 key $(atf_get_srcdir)/client2.key
880 dh $(atf_get_srcdir)/dh.pem
885 # Give the tunnel time to come up
888 atf_check -s exit:0 -o ignore jexec one ping -c 1 198.51.100.1
889 atf_check -s exit:0 -o ignore jexec two ping -c 1 198.51.100.1
891 # Client-to-client communication
892 atf_check -s exit:0 -o ignore jexec one ping -c 1 198.51.100.3
893 atf_check -s exit:0 -o ignore jexec two ping -c 1 198.51.100.2
896 atf_check -s exit:0 -o ignore jexec one ping -c 1 203.0.113.1
897 atf_check -s exit:0 -o ignore jexec two ping -c 1 203.0.113.1
899 atf_check -s exit:0 -o ignore jexec srv ping -c 1 -S 203.0.113.1 198.51.100.2
900 atf_check -s exit:0 -o ignore jexec srv ping -c 1 -S 203.0.113.1 198.51.100.3
902 atf_check -s exit:0 -o ignore jexec one ping -c 1 203.0.113.2
903 atf_check -s exit:0 -o ignore jexec two ping -c 1 203.0.113.2
905 atf_check -s exit:0 -o ignore jexec lan ping -c 1 198.51.100.1
906 atf_check -s exit:0 -o ignore jexec lan ping -c 1 198.51.100.2
907 atf_check -s exit:0 -o ignore jexec lan ping -c 1 198.51.100.3
908 atf_check -s exit:2 -o ignore jexec lan ping -c 1 198.51.100.4
925 jexec a ifconfig ${l}a 192.0.2.1/24 up
927 jexec b ifconfig ${l}b 192.0.2.2/24 up
930 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2
942 server 198.51.100.0 255.255.255.0
943 ca $(atf_get_srcdir)/ca.crt
944 cert $(atf_get_srcdir)/server.crt
945 key $(atf_get_srcdir)/server.key
946 dh $(atf_get_srcdir)/dh.pem
950 auth-user-pass-verify /usr/bin/true via-env
965 auth-user-pass $(atf_get_srcdir)/user.pass
967 ca $(atf_get_srcdir)/ca.crt
968 cert $(atf_get_srcdir)/client.crt
969 key $(atf_get_srcdir)/client.key
970 dh $(atf_get_srcdir)/dh.pem
975 # Give the tunnel time to come up
978 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1
981 atf_test_case "chacha" "cleanup"
984 atf_set descr 'Test DCO with the chacha algorithm'
985 atf_set require.user root
986 atf_set require.progs openvpn
991 ovpn_algo_body CHACHA20-POLY1305
999 atf_test_case "gcm_128" "cleanup"
1002 atf_set descr 'Test DCO with AES-128-GCM'
1003 atf_set require.user root
1004 atf_set require.progs openvpn
1009 ovpn_algo_body AES-128-GCM
1017 atf_init_test_cases()
1019 atf_add_test_case "4in4"
1020 atf_add_test_case "4mapped"
1021 atf_add_test_case "6in4"
1022 atf_add_test_case "6in6"
1023 atf_add_test_case "4in6"
1024 atf_add_test_case "timeout_client"
1025 atf_add_test_case "explicit_exit"
1026 atf_add_test_case "multi_client"
1027 atf_add_test_case "route_to"
1028 atf_add_test_case "ra"
1029 atf_add_test_case "chacha"
1030 atf_add_test_case "gcm_128"