datapath: Fix namespace refcount leak on failed init.
[sliver-openvswitch.git] / tests / ovs-monitor-ipsec.at
1 AT_BANNER([ovs-monitor-ipsec])
2
3 AT_SETUP([ovs-monitor-ipsec])
4 AT_SKIP_IF([test $HAVE_PYTHON = no])
5
6 OVS_RUNDIR=`pwd`; export OVS_RUNDIR
7 OVS_DBDIR=`pwd`; export OVS_DBDIR
8 OVS_PKGDATADIR=`pwd`; export OVS_PKGDATADIR
9 cp "$top_srcdir/vswitchd/vswitch.ovsschema" .
10
11 ON_EXIT([kill `cat pid ovs-monitor-ipsec.pid`])
12
13 mkdir etc etc/init.d etc/racoon etc/racoon/certs
14 mkdir usr usr/sbin
15
16 AT_DATA([etc/init.d/racoon], [dnl
17 #! /bin/sh
18 echo "racoon: $@" >&3
19 exit 0
20 ])
21 chmod +x etc/init.d/racoon
22
23 AT_DATA([usr/sbin/setkey], [dnl
24 #! /bin/sh
25 exec >&3
26 echo "setkey:"
27 while read line; do
28       echo "> $line"
29 done
30 ])
31 chmod +x usr/sbin/setkey
32
33 touch etc/racoon/certs/ovs-stale.pem
34
35 ovs_vsctl () {
36     ovs-vsctl --timeout=5 --no-wait -vreconnect:emer --db=unix:socket "$@"
37 }
38 trim () {  # Removes blank lines and lines starting with # from input.
39     sed -e '/^#/d' -e '/^[       ]*$/d' "$@"
40 }
41
42 ###
43 ### Start ovsdb-server.
44 ###
45 OVS_VSCTL_SETUP
46
47 ###
48 ### Start ovs-monitor-ipsec and wait for it to delete the stale cert.
49 ###
50 AT_CHECK(
51   [$PYTHON $top_srcdir/debian/ovs-monitor-ipsec "--root-prefix=`pwd`" \
52         "--pidfile=`pwd`/ovs-monitor-ipsec.pid" \
53         unix:socket 2>log 3>actions &])
54 AT_CAPTURE_FILE([log])
55 AT_CAPTURE_FILE([actions])
56 OVS_WAIT_UNTIL([test ! -f etc/racoon/certs/ovs-stale.pem])
57
58 ###
59 ### Add an ipsec_gre psk interface and check what ovs-monitor-ipsec does
60 ###
61 AT_CHECK([ovs_vsctl \
62               -- add-br br0 \
63               -- add-port br0 gre0 \
64               -- set interface gre0 type=ipsec_gre \
65                                     options:remote_ip=1.2.3.4 \
66                                     options:psk=swordfish])
67 OVS_WAIT_UNTIL([test -f actions && grep 'spdadd 1.2.3.4' actions >/dev/null])
68 AT_CHECK([cat actions], [0], [dnl
69 setkey:
70 > flush;
71 setkey:
72 > spdflush;
73 racoon: reload
74 racoon: reload
75 setkey:
76 > spdadd 0.0.0.0/0 1.2.3.4 gre -P out ipsec esp/transport//require;
77 > spdadd 1.2.3.4 0.0.0.0/0 gre -P in ipsec esp/transport//require;
78 ])
79 AT_CHECK([trim etc/racoon/psk.txt], [0], [1.2.3.4   swordfish
80 ])
81 AT_CHECK([trim etc/racoon/racoon.conf], [0], [dnl
82 path pre_shared_key "/etc/racoon/psk.txt";
83 path certificate "/etc/racoon/certs";
84 remote 1.2.3.4 {
85         exchange_mode main;
86         nat_traversal on;
87         proposal {
88                 encryption_algorithm aes;
89                 hash_algorithm sha1;
90                 authentication_method pre_shared_key;
91                 dh_group 2;
92         }
93 }
94 sainfo anonymous {
95         pfs_group 2;
96         lifetime time 1 hour;
97         encryption_algorithm aes;
98         authentication_algorithm hmac_sha1, hmac_md5;
99         compression_algorithm deflate;
100 }
101 ])
102
103 ###
104 ### Delete the ipsec_gre interface and check what ovs-monitor-ipsec does
105 ###
106 AT_CHECK([ovs_vsctl del-port gre0])
107 OVS_WAIT_UNTIL([test `wc -l < actions` -ge 17])
108 AT_CHECK([sed '1,9d' actions], [0], [dnl
109 racoon: reload
110 setkey:
111 > spddelete 0.0.0.0/0 1.2.3.4 gre -P out;
112 > spddelete 1.2.3.4 0.0.0.0/0 gre -P in;
113 setkey:
114 > dump ;
115 setkey:
116 > dump ;
117 ])
118 AT_CHECK([trim etc/racoon/psk.txt], [0], [])
119 AT_CHECK([trim etc/racoon/racoon.conf], [0], [dnl
120 path pre_shared_key "/etc/racoon/psk.txt";
121 path certificate "/etc/racoon/certs";
122 sainfo anonymous {
123         pfs_group 2;
124         lifetime time 1 hour;
125         encryption_algorithm aes;
126         authentication_algorithm hmac_sha1, hmac_md5;
127         compression_algorithm deflate;
128 }
129 ])
130
131 ###
132 ### Add ipsec_gre certificate interface and check what ovs-monitor-ipsec does
133 ###
134 AT_DATA([cert.pem], [dnl
135 -----BEGIN CERTIFICATE-----
136 (not a real certificate)
137 -----END CERTIFICATE-----
138 ])
139 AT_DATA([key.pem], [dnl
140 -----BEGIN RSA PRIVATE KEY-----
141 (not a real private key)
142 -----END RSA PRIVATE KEY-----
143 ])
144 AT_CHECK([ovs_vsctl \
145               -- add-port br0 gre1 \
146               -- set Interface gre1 type=ipsec_gre \
147                  options:remote_ip=2.3.4.5 \
148                  options:peer_cert='"-----BEGIN CERTIFICATE-----
149 (not a real peer certificate)
150 -----END CERTIFICATE-----
151 "' \
152                  options:certificate='"/cert.pem"' \
153                  options:private_key='"/key.pem"'])
154 OVS_WAIT_UNTIL([test `wc -l < actions` -ge 21])
155 AT_CHECK([sed '1,17d' actions], [0], [dnl
156 racoon: reload
157 setkey:
158 > spdadd 0.0.0.0/0 2.3.4.5 gre -P out ipsec esp/transport//require;
159 > spdadd 2.3.4.5 0.0.0.0/0 gre -P in ipsec esp/transport//require;
160 ])
161 AT_CHECK([trim etc/racoon/psk.txt], [0], [])
162 AT_CHECK([trim etc/racoon/racoon.conf], [0], [dnl
163 path pre_shared_key "/etc/racoon/psk.txt";
164 path certificate "/etc/racoon/certs";
165 remote 2.3.4.5 {
166         exchange_mode main;
167         nat_traversal on;
168         ike_frag on;
169         certificate_type x509 "/cert.pem" "/key.pem";
170         my_identifier asn1dn;
171         peers_identifier asn1dn;
172         peers_certfile x509 "/etc/racoon/certs/ovs-2.3.4.5.pem";
173         verify_identifier on;
174         proposal {
175                 encryption_algorithm aes;
176                 hash_algorithm sha1;
177                 authentication_method rsasig;
178                 dh_group 2;
179         }
180 }
181 sainfo anonymous {
182         pfs_group 2;
183         lifetime time 1 hour;
184         encryption_algorithm aes;
185         authentication_algorithm hmac_sha1, hmac_md5;
186         compression_algorithm deflate;
187 }
188 ])
189 AT_CHECK([cat etc/racoon/certs/ovs-2.3.4.5.pem], [0], [dnl
190 -----BEGIN CERTIFICATE-----
191 (not a real peer certificate)
192 -----END CERTIFICATE-----
193 ])
194
195 ###
196 ### Delete the ipsec_gre certificate interface.
197 ###
198 AT_CHECK([ovs_vsctl del-port gre1])
199 OVS_WAIT_UNTIL([test `wc -l < actions` -ge 29])
200 AT_CHECK([sed '1,21d' actions], [0], [dnl
201 racoon: reload
202 setkey:
203 > spddelete 0.0.0.0/0 2.3.4.5 gre -P out;
204 > spddelete 2.3.4.5 0.0.0.0/0 gre -P in;
205 setkey:
206 > dump ;
207 setkey:
208 > dump ;
209 ])
210 AT_CHECK([trim etc/racoon/psk.txt], [0], [])
211 AT_CHECK([trim etc/racoon/racoon.conf], [0], [dnl
212 path pre_shared_key "/etc/racoon/psk.txt";
213 path certificate "/etc/racoon/certs";
214 sainfo anonymous {
215         pfs_group 2;
216         lifetime time 1 hour;
217         encryption_algorithm aes;
218         authentication_algorithm hmac_sha1, hmac_md5;
219         compression_algorithm deflate;
220 }
221 ])
222 AT_CHECK([test ! -f etc/racoon/certs/ovs-2.3.4.5.pem])
223
224 ###
225 ### Add an SSL certificate interface.
226 ###
227 cp cert.pem ssl-cert.pem
228 cp key.pem ssl-key.pem
229 AT_DATA([ssl-cacert.pem], [dnl
230 -----BEGIN CERTIFICATE-----
231 (not a real CA certificate)
232 -----END CERTIFICATE-----
233 ])
234 AT_CHECK([ovs_vsctl set-ssl /ssl-key.pem /ssl-cert.pem /ssl-cacert.pem \
235               -- add-port br0 gre2 \
236               -- set Interface gre2 type=ipsec_gre \
237                  options:remote_ip=3.4.5.6 \
238                  options:peer_cert='"-----BEGIN CERTIFICATE-----
239 (not a real peer certificate)
240 -----END CERTIFICATE-----
241 "' \
242                  options:use_ssl_cert='"true"'])
243 OVS_WAIT_UNTIL([test `wc -l < actions` -ge 33])
244 AT_CHECK([sed '1,29d' actions], [0], [dnl
245 racoon: reload
246 setkey:
247 > spdadd 0.0.0.0/0 3.4.5.6 gre -P out ipsec esp/transport//require;
248 > spdadd 3.4.5.6 0.0.0.0/0 gre -P in ipsec esp/transport//require;
249 ])
250 AT_CHECK([trim etc/racoon/psk.txt], [0], [])
251 AT_CHECK([trim etc/racoon/racoon.conf], [0], [dnl
252 path pre_shared_key "/etc/racoon/psk.txt";
253 path certificate "/etc/racoon/certs";
254 remote 3.4.5.6 {
255         exchange_mode main;
256         nat_traversal on;
257         ike_frag on;
258         certificate_type x509 "/ssl-cert.pem" "/ssl-key.pem";
259         my_identifier asn1dn;
260         peers_identifier asn1dn;
261         peers_certfile x509 "/etc/racoon/certs/ovs-3.4.5.6.pem";
262         verify_identifier on;
263         proposal {
264                 encryption_algorithm aes;
265                 hash_algorithm sha1;
266                 authentication_method rsasig;
267                 dh_group 2;
268         }
269 }
270 sainfo anonymous {
271         pfs_group 2;
272         lifetime time 1 hour;
273         encryption_algorithm aes;
274         authentication_algorithm hmac_sha1, hmac_md5;
275         compression_algorithm deflate;
276 }
277 ])
278 AT_CHECK([cat etc/racoon/certs/ovs-3.4.5.6.pem], [0], [dnl
279 -----BEGIN CERTIFICATE-----
280 (not a real peer certificate)
281 -----END CERTIFICATE-----
282 ])
283
284 ###
285 ### Delete the SSL certificate interface.
286 ###
287 AT_CHECK([ovs_vsctl del-port gre2])
288 OVS_WAIT_UNTIL([test `wc -l < actions` -ge 41])
289 AT_CHECK([sed '1,33d' actions], [0], [dnl
290 racoon: reload
291 setkey:
292 > spddelete 0.0.0.0/0 3.4.5.6 gre -P out;
293 > spddelete 3.4.5.6 0.0.0.0/0 gre -P in;
294 setkey:
295 > dump ;
296 setkey:
297 > dump ;
298 ])
299 AT_CHECK([trim etc/racoon/psk.txt], [0], [])
300 AT_CHECK([trim etc/racoon/racoon.conf], [0], [dnl
301 path pre_shared_key "/etc/racoon/psk.txt";
302 path certificate "/etc/racoon/certs";
303 sainfo anonymous {
304         pfs_group 2;
305         lifetime time 1 hour;
306         encryption_algorithm aes;
307         authentication_algorithm hmac_sha1, hmac_md5;
308         compression_algorithm deflate;
309 }
310 ])
311 AT_CHECK([test ! -f etc/racoon/certs/ovs-3.4.5.6.pem])
312
313 OVSDB_SERVER_SHUTDOWN
314
315 AT_CLEANUP