blob: 69e90d9c1ec870fb30c74b3587a6af65fbc890d1 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
# $FreeBSD$
#
# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
#
# Copyright (c) 2021 The FreeBSD Foundation
. $(atf_get_srcdir)/../common/vnet.subr
atf_test_case "wg_basic" "cleanup"
wg_basic_head()
{
atf_set descr 'Create a wg(4) tunnel over an epair and pass traffic between jails'
atf_set require.user root
}
wg_basic_body()
{
local epair pri1 pri2 pub1 pub2 wg1 wg2
local endpoint1 endpoint2 tunnel1 tunnel2
kldload -n if_wg
pri1=$(openssl rand -base64 32)
pri2=$(openssl rand -base64 32)
endpoint1=192.168.2.1
endpoint2=192.168.2.2
tunnel1=169.254.0.1
tunnel2=169.254.0.2
epair=$(vnet_mkepair)
vnet_init
vnet_mkjail wgtest1 ${epair}a
vnet_mkjail wgtest2 ${epair}b
# Workaround for PR 254212.
jexec wgtest1 ifconfig lo0 up
jexec wgtest2 ifconfig lo0 up
jexec wgtest1 ifconfig ${epair}a $endpoint1 up
jexec wgtest2 ifconfig ${epair}b $endpoint2 up
wg1=$(jexec wgtest1 ifconfig wg create listen-port 12345 private-key "$pri1")
pub1=$(jexec wgtest1 ifconfig $wg1 | awk '/public-key:/ {print $2}')
wg2=$(jexec wgtest2 ifconfig wg create listen-port 12345 private-key "$pri2")
pub2=$(jexec wgtest2 ifconfig $wg2 | awk '/public-key:/ {print $2}')
atf_check -s exit:0 -o ignore \
jexec wgtest1 ifconfig $wg1 peer public-key "$pub2" \
endpoint ${endpoint2}:12345 allowed-ips ${tunnel2}/32
atf_check -s exit:0 \
jexec wgtest1 ifconfig $wg1 inet $tunnel1 up
atf_check -s exit:0 -o ignore \
jexec wgtest2 ifconfig $wg2 peer public-key "$pub1" \
endpoint ${endpoint1}:12345 allowed-ips ${tunnel1}/32
atf_check -s exit:0 \
jexec wgtest2 ifconfig $wg2 inet $tunnel2 up
# Generous timeout since the handshake takes some time.
atf_check -s exit:0 -o ignore jexec wgtest1 ping -o -t 5 -i 0.25 $tunnel2
atf_check -s exit:0 -o ignore jexec wgtest2 ping -o -t 5 -i 0.25 $tunnel1
}
wg_basic_cleanup()
{
vnet_cleanup
}
# The kernel is expecteld to silently ignore any attempt to add a peer with a
# public key identical to the host's.
atf_test_case "wg_key_peerdev_shared" "cleanup"
wg_key_peerdev_shared_head()
{
atf_set descr 'Create a wg(4) interface with a shared pubkey between device and a peer'
atf_set require.user root
}
wg_key_peerdev_shared_body()
{
local epair pri1 pub1 wg1
local endpoint1 tunnel1
kldload -n if_wg
pri1=$(openssl rand -base64 32)
endpoint1=192.168.2.1
tunnel1=169.254.0.1
vnet_mkjail wgtest1
wg1=$(jexec wgtest1 ifconfig wg create listen-port 12345 private-key "$pri1")
pub1=$(jexec wgtest1 ifconfig $wg1 | awk '/public-key:/ {print $2}')
atf_check -s exit:0 \
jexec wgtest1 ifconfig ${wg1} peer public-key "${pub1}" \
allowed-ips "${tunnel1}/32"
atf_check -o empty jexec wgtest1 ifconfig ${wg1} peers
}
wg_key_peerdev_shared_cleanup()
{
vnet_cleanup
}
# When a wg(8) interface has a private key reassigned that corresponds to the
# public key already on a peer, the kernel is expected to deconfigure the peer
# to resolve the conflict.
atf_test_case "wg_key_peerdev_makeshared" "cleanup"
wg_key_peerdev_makeshared_head()
{
atf_set descr 'Create a wg(4) interface and assign peer key to device'
atf_set require.progs wg
}
wg_key_peerdev_makeshared_body()
{
local epair pri1 pub1 pri2 wg1 wg2
local endpoint1 tunnel1
kldload -n if_wg
pri1=$(openssl rand -base64 32)
pri2=$(openssl rand -base64 32)
endpoint1=192.168.2.1
tunnel1=169.254.0.1
vnet_mkjail wgtest1
wg1=$(jexec wgtest1 ifconfig wg create listen-port 12345 private-key "$pri1")
pub1=$(jexec wgtest1 ifconfig $wg1 | awk '/public-key:/ {print $2}')
wg2=$(jexec wgtest1 ifconfig wg create listen-port 12345 private-key "$pri2")
atf_check -s exit:0 -o ignore \
jexec wgtest1 ifconfig ${wg2} peer public-key "${pub1}" \
allowed-ips "${tunnel1}/32"
atf_check -o not-empty jexec wgtest1 ifconfig ${wg2} peers
jexec wgtest1 sh -c "echo '${pri1}' > pri1"
atf_check -s exit:0 \
jexec wgtest1 wg set ${wg2} private-key pri1
atf_check -o empty jexec wgtest1 ifconfig ${wg2} peers
}
wg_key_peerdev_makeshared_cleanup()
{
vnet_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "wg_basic"
atf_add_test_case "wg_key_peerdev_shared"
atf_add_test_case "wg_key_peerdev_makeshared"
}
|
