#! /usr/bin/atf-sh
#	$NetBSD: net_common.sh,v 1.44 2022/11/02 09:35:12 ozaki-r Exp $
#
# Copyright (c) 2016 Internet Initiative Japan Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#

#
# Common utility functions for tests/net
#

export PATH="/sbin:/usr/sbin:/bin:/usr/bin"

HIJACKING="env LD_PRELOAD=/usr/lib/librumphijack.so \
    RUMPHIJACK=path=/rump,socket=all:nolocal,sysctl=yes"
ONEDAYISH="(23h5[0-9]m|1d0h0m)[0-9]+s ?"

extract_new_packets()
{
	local bus=$1
	local old=./.__old

	if [ ! -f $old ]; then
		old=/dev/null
	fi

	shmif_dumpbus -p - $bus 2>/dev/null |
	    tcpdump -n -e -r - 2>/dev/null > ./.__new
	diff -u $old ./.__new | grep '^+' | cut -d '+' -f 2   > ./.__diff
	mv -f ./.__new ./.__old
	cat ./.__diff
}

check_route()
{
	local target=$1
	local gw=$2
	local flags=${3:-\.\+}
	local ifname=${4:-\.\+}

	target=$(echo $target | sed 's/\./\\./g')
	if [ "$gw" = "" ]; then
		gw=".+"
	else
		gw=$(echo $gw | sed 's/\./\\./g')
	fi

	atf_check -s exit:0 -e ignore \
	    -o match:"^$target +$gw +$flags +- +- +.+ +$ifname" \
	    rump.netstat -rn
}

check_route_flags()
{

	check_route "$1" "" "$2" ""
}

check_route_gw()
{

	check_route "$1" "$2" "" ""
}

check_route_no_entry()
{
	local target=$(echo "$1" | sed 's/\./\\./g')

	atf_check -s exit:0 -e ignore -o not-match:"^$target" rump.netstat -rn
}

get_linklocal_addr()
{

	RUMP_SERVER=${1} rump.ifconfig ${2} inet6 |
	    awk "/fe80/ {sub(/%$2/, \"\"); sub(/\\/[0-9]*/, \"\"); print \$2;}"

	return 0
}

get_macaddr()
{

	RUMP_SERVER=${1} rump.ifconfig ${2} | awk '/address/ {print $2;}'
}

HTTPD_PID=./.__httpd.pid
start_httpd()
{
	local sock=$1
	local ip=$2
	local backup=$RUMP_SERVER

	export RUMP_SERVER=$sock

	# start httpd in daemon mode
	atf_check -s exit:0 env LD_PRELOAD=/usr/lib/librumphijack.so \
	    /usr/libexec/httpd -P $HTTPD_PID -i $ip -b -s $(pwd)

	export RUMP_SERVER=$backup

	sleep 3
}

stop_httpd()
{

	if [ -f $HTTPD_PID ]; then
		kill -9 $(cat $HTTPD_PID)
		rm -f $HTTPD_PID
		sleep 1
	fi
}

NC_PID=./.__nc.pid
start_nc_server()
{
	local sock=$1
	local port=$2
	local outfile=$3
	local proto=${4:-ipv4}
	local extra_opts="$5"
	local backup=$RUMP_SERVER
	local opts=

	export RUMP_SERVER=$sock

	if [ $proto = ipv4 ]; then
		opts="-l -4"
	else
		opts="-l -6"
	fi
	opts="$opts $extra_opts"

	env LD_PRELOAD=/usr/lib/librumphijack.so nc $opts $port > $outfile &
	echo $! > $NC_PID

	if [ $proto = ipv4 ]; then
		$DEBUG && rump.netstat -a -f inet
	else
		$DEBUG && rump.netstat -a -f inet6
	fi

	export RUMP_SERVER=$backup

	sleep 1
}

stop_nc_server()
{

	if [ -f $NC_PID ]; then
		kill -9 $(cat $NC_PID)
		rm -f $NC_PID
		sleep 1
	fi
}

BASIC_LIBS="-lrumpnet -lrumpnet_net -lrumpnet_netinet -lrumpnet_shmif"
FS_LIBS="$BASIC_LIBS -lrumpdev -lrumpvfs -lrumpfs_ffs"
CRYPTO_LIBS="$BASIC_LIBS -lrumpdev -lrumpdev_opencrypto \
    -lrumpkern_z -lrumpkern_crypto"
NPF_LIBS="$BASIC_LIBS -lrumpdev -lrumpvfs -lrumpdev_bpf -lrumpnet_npf"
CRYPTO_NPF_LIBS="$CRYPTO_LIBS -lrumpvfs -lrumpdev_bpf -lrumpnet_npf"
BPF_LIBS="$BASIC_LIBS -lrumpdev -lrumpvfs -lrumpdev_bpf"

# We cannot keep variables between test phases, so need to store in files
_rump_server_socks=./.__socks
_rump_server_ifaces=./.__ifaces
_rump_server_buses=./.__buses
_rump_server_macaddrs=./.__macaddrs

DEBUG_SYSCTL_ENTRIES="net.inet.arp.debug net.inet6.icmp6.nd6_debug \
    net.inet.ipsec.debug"

IPSEC_KEY_DEBUG=${IPSEC_KEY_DEBUG:-false}

_rump_server_start_common()
{
	local sock=$1
	local backup=$RUMP_SERVER

	shift 1

	atf_check -s exit:0 rump_server "$@" "$sock"

	if $DEBUG; then
		# Enable debugging features in the kernel
		export RUMP_SERVER=$sock
		for ent in $DEBUG_SYSCTL_ENTRIES; do
			if rump.sysctl -q $ent; then
				atf_check -s exit:0 rump.sysctl -q -w $ent=1
			fi
		done
		export RUMP_SERVER=$backup
	fi
	if $IPSEC_KEY_DEBUG; then
		# Enable debugging features in the kernel
		export RUMP_SERVER=$sock
		if rump.sysctl -q net.key.debug; then
			atf_check -s exit:0 \
			    rump.sysctl -q -w net.key.debug=0xffff
		fi
		export RUMP_SERVER=$backup
	fi

	echo $sock >> $_rump_server_socks
	$DEBUG && cat $_rump_server_socks
}

rump_server_start()
{
	local sock=$1
	local lib=
	local libs="$BASIC_LIBS"

	shift 1

	for lib
	do
		libs="$libs -lrumpnet_$lib"
	done

	_rump_server_start_common $sock $libs

	return 0
}

rump_server_fs_start()
{
	local sock=$1
	local lib=
	local libs="$FS_LIBS"

	shift 1

	for lib
	do
		libs="$libs -lrumpnet_$lib"
	done

	_rump_server_start_common $sock $libs

	return 0
}

rump_server_crypto_start()
{
	local sock=$1
	local lib=
	local libs="$CRYPTO_LIBS"

	shift 1

	for lib
	do
		libs="$libs -lrumpnet_$lib"
	done

	_rump_server_start_common $sock $libs

	return 0
}

rump_server_npf_start()
{
	local sock=$1
	local lib=
	local libs="$NPF_LIBS"

	shift 1

	for lib
	do
		libs="$libs -lrumpnet_$lib"
	done

	_rump_server_start_common $sock $libs

	return 0
}

rump_server_crypto_npf_start()
{
	local sock=$1
	local lib=
	local libs="$CRYPTO_NPF_LIBS"

	shift 1

	for lib
	do
		libs="$libs -lrumpnet_$lib"
	done

	_rump_server_start_common $sock $libs

	return 0
}

rump_server_bpf_start()
{
	local sock=$1
	local lib=
	local libs="$BPF_LIBS"

	shift 1

	for lib
	do
		libs="$libs -lrumpnet_$lib"
	done

	_rump_server_start_common $sock $libs

	return 0
}

rump_server_add_iface()
{
	local sock=$1
	local ifname=$2
	local bus=$3
	local backup=$RUMP_SERVER
	local macaddr=

	export RUMP_SERVER=$sock
	atf_check -s exit:0 rump.ifconfig $ifname create
	if [ -n "$bus" ]; then
		atf_check -s exit:0 rump.ifconfig $ifname linkstr $bus
	fi

	macaddr=$(get_macaddr $sock $ifname)
	if [ -n "$macaddr" ]; then
		if [ -f $_rump_server_macaddrs ]; then
			atf_check -s not-exit:0 \
			    grep -q $macaddr $_rump_server_macaddrs
		fi
		echo $macaddr >> $_rump_server_macaddrs
	fi

	export RUMP_SERVER=$backup

	echo $sock $ifname >> $_rump_server_ifaces
	$DEBUG && cat $_rump_server_ifaces

	echo $bus >> $_rump_server_buses
	cat $_rump_server_buses |sort -u >./.__tmp
	mv -f ./.__tmp $_rump_server_buses
	$DEBUG && cat $_rump_server_buses

	return 0
}

rump_server_check_poolleaks()
{
	local target=$1

	# XXX rumphijack doesn't work with a binary with suid/sgid bits like
	# vmstat.  Use a copied one to drop sgid bit as a workaround until
	# vmstat stops using kvm(3) for /dev/kmem and the sgid bit.
	cp /usr/bin/vmstat ./vmstat
	reqs=$($HIJACKING ./vmstat -mv | awk "/$target/ {print \$3;}")
	rels=$($HIJACKING ./vmstat -mv | awk "/$target/ {print \$5;}")
	rm -f ./vmstat
	atf_check_equal '$target$reqs' '$target$rels'
}

#
# rump_server_check_memleaks detects memory leaks.  It can detect leaks of pool
# objects that are guaranteed to be all deallocated at this point, i.e., all
# created interfaces are destroyed.  Currently only llentpl satisfies this
# constraint.  This mechanism can't be applied to objects allocated through
# pool_cache(9) because it doesn't track released objects explicitly.
#
rump_server_check_memleaks()
{

	rump_server_check_poolleaks llentrypl
	# This doesn't work for objects allocated through pool_cache
	#rump_server_check_poolleaks mbpl
	#rump_server_check_poolleaks mclpl
	#rump_server_check_poolleaks socket
}

rump_server_destroy_ifaces()
{
	local backup=$RUMP_SERVER
	local output=ignore
	local reqs= rels=

	$DEBUG && cat $_rump_server_ifaces

	# Try to dump states before destroying interfaces
	for sock in $(cat $_rump_server_socks); do
		export RUMP_SERVER=$sock
		if $DEBUG; then
			output=save:/dev/stdout
		fi
		atf_check -s exit:0 -o $output rump.ifconfig
		atf_check -s exit:0 -o $output rump.netstat -nr
		# XXX still need hijacking
		atf_check -s exit:0 -o $output $HIJACKING rump.netstat -nai
		atf_check -s exit:0 -o $output rump.arp -na
		atf_check -s exit:0 -o $output rump.ndp -na
		atf_check -s exit:0 -o $output $HIJACKING ifmcstat
	done

	# XXX using pipe doesn't work. See PR bin/51667
	#cat $_rump_server_ifaces | while read sock ifname; do
	# Destroy interfaces in the reverse order
	tac $_rump_server_ifaces > __ifaces
	while read sock ifname; do
		export RUMP_SERVER=$sock
		if rump.ifconfig -l |grep -q $ifname; then
			if $DEBUG; then
				rump.ifconfig -v $ifname
			fi
			atf_check -s exit:0 rump.ifconfig $ifname destroy
		fi
		atf_check -s exit:0 -o ignore rump.ifconfig
	done < __ifaces
	rm -f __ifaces

	for sock in $(cat $_rump_server_socks); do
		export RUMP_SERVER=$sock
		rump_server_check_memleaks
	done

	export RUMP_SERVER=$backup

	return 0
}

rump_server_halt_servers()
{
	local backup=$RUMP_SERVER

	$DEBUG && cat $_rump_server_socks
	for sock in $(cat $_rump_server_socks); do
		env RUMP_SERVER=$sock rump.halt
	done
	export RUMP_SERVER=$backup

	return 0
}

extract_rump_server_core()
{

	if [ -f rump_server.core ]; then
		gdb -ex bt /usr/bin/rump_server rump_server.core
		# Extract kernel logs including a panic message
		strings rump_server.core |grep -E '^\[.+\] '
	fi
}

dump_kernel_stats()
{
	local sock=$1

	echo "### Dumping $sock"
	export RUMP_SERVER=$sock
	rump.ifconfig -av
	rump.netstat -nr
	# XXX still need hijacking
	$HIJACKING rump.netstat -nai
	# XXX workaround for vmstat with the sgid bit
	cp /usr/bin/vmstat ./vmstat
	$HIJACKING ./vmstat -m
	rm -f ./vmstat
	rump.arp -na
	rump.ndp -na
	$HIJACKING ifmcstat
	$HIJACKING dmesg
}

rump_server_dump_servers()
{
	local backup=$RUMP_SERVER

	$DEBUG && cat $_rump_server_socks
	for sock in $(cat $_rump_server_socks); do
		dump_kernel_stats $sock
	done
	export RUMP_SERVER=$backup

	extract_rump_server_core
	return 0
}

rump_server_dump_buses()
{

	if [ ! -f $_rump_server_buses ]; then
		return 0
	fi

	$DEBUG && cat $_rump_server_buses
	for bus in $(cat $_rump_server_buses); do
		echo "### Dumping $bus"
		shmif_dumpbus -p - $bus 2>/dev/null| tcpdump -n -e -r -
	done
	return 0
}

cleanup()
{

	rump_server_halt_servers
}

dump()
{

	rump_server_dump_servers
	rump_server_dump_buses
}

skip_if_qemu()
{
	if drvctl -l qemufwcfg0 >/dev/null 2>&1
	then
	    atf_skip "unreliable under qemu, skip until PR kern/43997 fixed"
	fi
}

test_create_destroy_common()
{
	local sock=$1
	local ifname=$2
	local test_address=${3:-false}
	local ipv4="10.0.0.1/24"
	local ipv6="fc00::1"

	export RUMP_SERVER=$sock

	atf_check -s exit:0 rump.ifconfig $ifname create
	atf_check -s exit:0 rump.ifconfig $ifname destroy

	atf_check -s exit:0 rump.ifconfig $ifname create
	atf_check -s exit:0 rump.ifconfig $ifname up
	atf_check -s exit:0 rump.ifconfig $ifname down
	atf_check -s exit:0 rump.ifconfig $ifname destroy

	# Destroy while UP
	atf_check -s exit:0 rump.ifconfig $ifname create
	atf_check -s exit:0 rump.ifconfig $ifname up
	atf_check -s exit:0 rump.ifconfig $ifname destroy

	if ! $test_address; then
		return
	fi

	# With an IPv4 address
	atf_check -s exit:0 rump.ifconfig $ifname create
	atf_check -s exit:0 rump.ifconfig $ifname inet $ipv4
	atf_check -s exit:0 rump.ifconfig $ifname up
	atf_check -s exit:0 rump.ifconfig $ifname destroy

	# With an IPv6 address
	atf_check -s exit:0 rump.ifconfig $ifname create
	atf_check -s exit:0 rump.ifconfig $ifname inet6 $ipv6
	atf_check -s exit:0 rump.ifconfig $ifname up
	atf_check -s exit:0 rump.ifconfig $ifname destroy

	unset RUMP_SERVER
}
#	$NetBSD: common.sh,v 1.8 2020/06/05 03:24:58 knakahara Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#

HIJACKING_NPF="${HIJACKING},blanket=/dev/npf"

test_flush_entries()
{
	local sock=$1

	export RUMP_SERVER=$sock

	atf_check -s exit:0 -o empty $HIJACKING setkey -F
	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P
	atf_check -s exit:0 -o match:"No SAD entries." $HIJACKING setkey -D -a
	atf_check -s exit:0 -o match:"No SPD entries." $HIJACKING setkey -D -P
}

check_sa_entries()
{
	local sock=$1
	local local_addr=$2
	local remote_addr=$3

	export RUMP_SERVER=$sock

	$DEBUG && $HIJACKING setkey -D

	atf_check -s exit:0 -o match:"$local_addr $remote_addr" \
	    $HIJACKING setkey -D
	atf_check -s exit:0 -o match:"$remote_addr $local_addr" \
	    $HIJACKING setkey -D
	# TODO: more detail checks
}

check_sp_entries()
{
	local sock=$1
	local local_addr=$2
	local remote_addr=$3

	export RUMP_SERVER=$sock

	$DEBUG && $HIJACKING setkey -D -P

	atf_check -s exit:0 \
	    -o match:"$local_addr\[any\] $remote_addr\[any\] 255\(reserved\)" \
	    $HIJACKING setkey -D -P
	atf_check -s exit:0 \
	    -o match:"$remote_addr\[any\] $local_addr\[any\] 255\(reserved\)" \
	    $HIJACKING setkey -D -P
	# TODO: more detail checks
}

generate_pktproto()
{
	local proto=$1

	if [ $proto = ipcomp ]; then
		echo IPComp
	else
		echo $proto | tr 'a-z' 'A-Z'
	fi
}

get_natt_port()
{
	local local_addr=$1
	local remote_addr=$2
	local port=""

	# 10.0.1.2:4500         20.0.0.2:4500         shmif1     20.0.0.1:35574
	port=$($HIJACKING_NPF npfctl list | grep $local_addr | awk -F "${remote_addr}:" '/4500/ {print $2;}')
	echo $port
}
#	$NetBSD: algorithms.sh,v 1.7 2021/12/05 02:49:21 msaitoh Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#

ESP_ENCRYPTION_ALGORITHMS="des-cbc 3des-cbc null blowfish-cbc cast128-cbc \
    des-deriv rijndael-cbc aes-ctr camellia-cbc aes-gcm-16 aes-gmac"
ESP_ENCRYPTION_ALGORITHMS_MINIMUM="null rijndael-cbc"

# Valid key lengths of ESP encryption algorithms
#    des-cbc         64
#    3des-cbc        192
#    null            0 to 2048     XXX only accept 0 length
#    blowfish-cbc    40 to 448
#    cast128-cbc     40 to 128
#    des-deriv       64
#    3des-deriv      192           XXX not implemented
#    rijndael-cbc    128/192/256
#    twofish-cbc     0 to 256      XXX not supported
#    aes-ctr         160/224/288
#    camellia-cbc    128/192/256
#    aes-gcm-16      160/224/288
#    aes-gmac        160/224/288
valid_keys_descbc="64"
invalid_keys_descbc="56 72"
valid_keys_3descbc="192"
invalid_keys_3descbc="184 200"
#valid_keys_null="0 2048"
valid_keys_null="0"
invalid_keys_null="8"
valid_keys_blowfishcbc="40 448"
invalid_keys_blowfishcbc="32 456"
valid_keys_cast128cbc="40 128"
invalid_keys_cast128cbc="32 136"
valid_keys_desderiv="64"
invalid_keys_desderiv="56 72"
#valid_keys_3desderiv="192"
#invalid_keys_3desderiv="184 200"
valid_keys_rijndaelcbc="128 192 256"
invalid_keys_rijndaelcbc="120 136 184 200 248 264"
#valid_keys_twofishcbc="0 256"
#invalid_keys_twofishcbc="264"
valid_keys_aesctr="160 224 288"
invalid_keys_aesctr="152 168 216 232 280 296"
valid_keys_camelliacbc="128 192 256"
invalid_keys_camelliacbc="120 136 184 200 248 264"
valid_keys_aesgcm16="160 224 288"
invalid_keys_aesgcm16="152 168 216 232 280 296"
valid_keys_aesgmac="160 224 288"
invalid_keys_aesgmac="152 168 216 232 280 296"

AH_AUTHENTICATION_ALGORITHMS="hmac-md5 hmac-sha1 keyed-md5 keyed-sha1 null \
    hmac-sha256 hmac-sha384 hmac-sha512 hmac-ripemd160 aes-xcbc-mac"
AH_AUTHENTICATION_ALGORITHMS_MINIMUM="null hmac-sha512"

# Valid key lengths of AH authentication algorithms
#    hmac-md5        128
#    hmac-sha1       160
#    keyed-md5       128
#    keyed-sha1      160
#    null            0 to 2048
#    hmac-sha256     256
#    hmac-sha384     384
#    hmac-sha512     512
#    hmac-ripemd160  160
#    aes-xcbc-mac    128
#    tcp-md5         8 to 640  XXX not enabled in rump kernels
valid_keys_hmacmd5="128"
invalid_keys_hmacmd5="120 136"
valid_keys_hmacsha1="160"
invalid_keys_hmacsha1="152 168"
valid_keys_keyedmd5="128"
invalid_keys_keyedmd5="120 136"
valid_keys_keyedsha1="160"
invalid_keys_keyedsha1="152 168"
#valid_keys_null="0 2048"
valid_keys_null="0"
invalid_keys_null="8"
valid_keys_hmacsha256="256"
invalid_keys_hmacsha256="248 264"
valid_keys_hmacsha384="384"
invalid_keys_hmacsha384="376 392"
valid_keys_hmacsha512="512"
invalid_keys_hmacsha512="504 520"
valid_keys_hmacripemd160="160"
invalid_keys_hmacripemd160="152 168"
valid_keys_aesxcbcmac="128"
invalid_keys_aesxcbcmac="120 136"
#valid_keys_tcpmd5="8 640"
#invalid_keys_tcpmd5="648"

IPCOMP_COMPRESSION_ALGORITHMS="deflate"
IPCOMP_COMPRESSION_ALGORITHMS_MINIMUM="deflate"
valid_keys_deflate="0"
invalid_keys_deflate="8"
minlen_deflate="90"

get_one_valid_keylen()
{
	local algo=$1
	local _algo=$(echo $algo | sed 's/-//g')
	local len=
	local keylengths=

	eval keylengths="\$valid_keys_${_algo}"

	for len in $(echo $keylengths); do
		break;
	done

	echo $len
}

get_valid_keylengths()
{
	local algo=$1
	local _algo=$(echo $algo | sed 's/-//g')

	eval keylengths="\$valid_keys_${_algo}"
	echo $keylengths
}

get_invalid_keylengths()
{
	local algo=$1
	local _algo=$(echo $algo | sed 's/-//g')

	eval keylengths="\$invalid_keys_${_algo}"
	echo $keylengths
}

generate_key()
{
	local keylen=$(($1 / 8))
	local key=

	while [ $keylen -gt 0 ]; do
		key="${key}a"
		keylen=$((keylen - 1))
	done
	if [ ! -z "$key" ]; then
		key="\"$key\""
	fi

	echo $key
}

generate_algo_args()
{
	local proto=$1
	local algo=$2
	local keylen=$(get_one_valid_keylen $algo)
	local key=$(generate_key $keylen)

	if [ $proto = esp -o $proto = "esp-udp" ]; then
		echo "-E $algo $key"
	elif [ $proto = ah ]; then
		echo "-A $algo $key"
	else
		echo "-C $algo $key"
	fi
}

get_minlen()
{
	local algo=$1
	local minlen=

	eval minlen="\$minlen_${algo}"
	echo $minlen
}
#	$NetBSD: t_ipsec_misc.sh,v 1.25 2022/01/07 22:59:32 andvar Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#

SOCK_LOCAL=unix://ipsec_local
SOCK_PEER=unix://ipsec_peer
BUS=./bus_ipsec

DEBUG=${DEBUG:-true}

setup_sasp()
{
	local proto=$1
	local algo_args="$2"
	local ip_local=$3
	local ip_peer=$4
	local lifetime=$5
	local update=$6
	local tmpfile=./tmp
	local saadd=add
	local saadd_algo_args="$algo_args"
	local extra=

	if [ "$update" = getspi ]; then
		saadd=getspi
		saadd_algo_args=
	fi

	if [ "$update" = sa -o "$update" = getspi ]; then
		extra="update $ip_local $ip_peer $proto 10000 $algo_args;
		       update $ip_peer $ip_local $proto 10001 $algo_args;"
	elif [ "$update" = sp ]; then
		extra="spdupdate $ip_local $ip_peer any -P out ipsec $proto/transport//require;"
	fi

	export RUMP_SERVER=$SOCK_LOCAL
	cat > $tmpfile <<-EOF
	$saadd $ip_local $ip_peer $proto 10000 -lh $lifetime -ls $lifetime $saadd_algo_args;
	$saadd $ip_peer $ip_local $proto 10001 -lh $lifetime -ls $lifetime $saadd_algo_args;
	spdadd $ip_local $ip_peer any -P out ipsec $proto/transport//require;
	$extra
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	# XXX it can be expired if $lifetime is very short
	#check_sa_entries $SOCK_LOCAL $ip_local $ip_peer

	if [ "$update" = sp ]; then
		extra="spdupdate $ip_peer $ip_local any -P out ipsec $proto/transport//require;"
	fi

	export RUMP_SERVER=$SOCK_PEER
	cat > $tmpfile <<-EOF
	$saadd $ip_local $ip_peer $proto 10000 -lh $lifetime -ls $lifetime $saadd_algo_args;
	$saadd $ip_peer $ip_local $proto 10001 -lh $lifetime -ls $lifetime $saadd_algo_args;
	spdadd $ip_peer $ip_local any -P out ipsec $proto/transport//require;
	$extra
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	# XXX it can be expired if $lifetime is very short
	#check_sa_entries $SOCK_PEER $ip_local $ip_peer
}

test_sad_disapper_until()
{
	local time=$1
	local check_dead_sa=$2
	local setkey_opts=
	local n=$time
	local tmpfile=./__tmp
	local sock= ok=

	if $check_dead_sa; then
		setkey_opts="-D -a"
	else
		setkey_opts="-D"
	fi

	while [ $n -ne 0 ]; do
		ok=0
		sleep 1
		for sock in $SOCK_LOCAL $SOCK_PEER; do
			export RUMP_SERVER=$sock
			$HIJACKING setkey $setkey_opts > $tmpfile
			$DEBUG && cat $tmpfile
			if grep -q 'No SAD entries.' $tmpfile; then
				ok=$((ok + 1))
			fi
		done
		if [ $ok -eq 2 ]; then
			return
		fi

		n=$((n - 1))
	done

	atf_fail "SAs didn't disappear after $time sec."
}

test_ipsec4_lifetime()
{
	local proto=$1
	local algo=$2
	local ip_local=10.0.0.1
	local ip_peer=10.0.0.2
	local outfile=./out
	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
	local algo_args="$(generate_algo_args $proto $algo)"
	local lifetime=3
	local buffertime=2

	rump_server_crypto_start $SOCK_LOCAL netipsec
	rump_server_crypto_start $SOCK_PEER netipsec
	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
	rump_server_add_iface $SOCK_PEER shmif0 $BUS

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
	#atf_check -s exit:0 -o ignore rump.sysctl -w net.key.debug=0xff

	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24
	#atf_check -s exit:0 -o ignore rump.sysctl -w net.key.debug=0xff

	extract_new_packets $BUS > $outfile

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer

	extract_new_packets $BUS > $outfile
	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: ICMP echo request" \
	    cat $outfile
	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: ICMP echo reply" \
	    cat $outfile

	# Set up SAs with lifetime 1 sec.
	setup_sasp $proto "$algo_args" $ip_local $ip_peer 1

	# Check the SAs have been expired
	test_sad_disapper_until $((1 + $buffertime)) false

	# Clean up SPs
	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P
	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P

	# Set up SAs with lifetime with $lifetime
	setup_sasp $proto "$algo_args" $ip_local $ip_peer $lifetime

	# Use the SAs; this will create a reference from an SP to an SA
	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer

	extract_new_packets $BUS > $outfile
	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \
	    cat $outfile
	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \
	    cat $outfile

	# Check the SAs have been expired
	test_sad_disapper_until $((lifetime + $buffertime)) true

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s not-exit:0 -o match:'0 packets received' \
	    rump.ping -c 1 -n -w 1 $ip_peer

	test_flush_entries $SOCK_LOCAL
	test_flush_entries $SOCK_PEER
}

test_ipsec6_lifetime()
{
	local proto=$1
	local algo=$2
	local ip_local=fd00::1
	local ip_peer=fd00::2
	local outfile=./out
	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
	local algo_args="$(generate_algo_args $proto $algo)"
	local lifetime=3
	local buffertime=2

	rump_server_crypto_start $SOCK_LOCAL netinet6 netipsec
	rump_server_crypto_start $SOCK_PEER netinet6 netipsec
	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
	rump_server_add_iface $SOCK_PEER shmif0 $BUS

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local

	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_peer

	extract_new_packets $BUS > $outfile

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_peer

	extract_new_packets $BUS > $outfile
	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: ICMP6, echo request" \
	    cat $outfile
	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: ICMP6, echo reply" \
	    cat $outfile

	# Set up SAs with lifetime 1 sec.
	setup_sasp $proto "$algo_args" $ip_local $ip_peer 1

	# Check the SAs have been expired
	test_sad_disapper_until $((1 + $buffertime)) false

	# Clean up SPs
	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P
	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P

	# Set up SAs with lifetime with $lifetime
	setup_sasp $proto "$algo_args" $ip_local $ip_peer $lifetime

	# Use the SAs; this will create a reference from an SP to an SA
	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_peer

	extract_new_packets $BUS > $outfile
	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \
	    cat $outfile
	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \
	    cat $outfile

	# Check the SAs have been expired
	test_sad_disapper_until $((lifetime + $buffertime)) true

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s not-exit:0 -o match:'0 packets received' \
	    rump.ping6 -c 1 -n -X 1 $ip_peer

	test_flush_entries $SOCK_LOCAL
	test_flush_entries $SOCK_PEER
}

test_lifetime_common()
{
	local ipproto=$1
	local proto=$2
	local algo=$3

	if [ $ipproto = ipv4 ]; then
		test_ipsec4_lifetime $proto $algo
	else
		test_ipsec6_lifetime $proto $algo
	fi
}

add_test_lifetime()
{
	local ipproto=$1
	local proto=$2
	local algo=$3
	local _algo=$(echo $algo | sed 's/-//g')
	local name= desc=

	name="ipsec_lifetime_${ipproto}_${proto}_${_algo}"
	desc="Tests of lifetime of IPsec ($ipproto) with $proto ($algo)"

	atf_test_case ${name} cleanup
	eval "
	    ${name}_head() {
	        atf_set descr \"$desc\"
	        atf_set require.progs rump_server setkey
	    }
	    ${name}_body() {
	        test_lifetime_common $ipproto $proto $algo
	        rump_server_destroy_ifaces
	    }
	    ${name}_cleanup() {
	        \$DEBUG && dump
	        cleanup
	    }
	"
	atf_add_test_case ${name}
}

test_update()
{
	local proto=$1
	local algo=$2
	local update=$3
	local ip_local=10.0.0.1
	local ip_peer=10.0.0.2
	local algo_args="$(generate_algo_args $proto $algo)"
	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
	local outfile=./out

	rump_server_crypto_start $SOCK_LOCAL netipsec
	rump_server_crypto_start $SOCK_PEER netipsec
	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
	rump_server_add_iface $SOCK_PEER shmif0 $BUS

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24

	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24

	setup_sasp $proto "$algo_args" $ip_local $ip_peer 100 $update

	extract_new_packets $BUS > $outfile

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer

	extract_new_packets $BUS > $outfile
	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \
	    cat $outfile
	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \
	    cat $outfile
}

add_test_update()
{
	local proto=$1
	local algo=$2
	local update=$3
	local _update=$(echo $update |tr 'a-z' 'A-Z')
	local _algo=$(echo $algo | sed 's/-//g')
	local name= desc=

	desc="Tests trying to update $_update of $proto ($algo)"
	name="ipsec_update_${update}_${proto}_${_algo}"

	atf_test_case ${name} cleanup
	eval "
	    ${name}_head() {
	        atf_set descr \"$desc\"
	        atf_set require.progs rump_server setkey
	    }
	    ${name}_body() {
	        test_update $proto $algo $update
	        rump_server_destroy_ifaces
	    }
	    ${name}_cleanup() {
	        \$DEBUG && dump
	        cleanup
	    }
	"
	atf_add_test_case ${name}
}

test_getspi_update()
{
	local proto=$1
	local algo=$2
	local ip_local=10.0.0.1
	local ip_peer=10.0.0.2
	local algo_args="$(generate_algo_args $proto $algo)"
	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
	local outfile=./out

	rump_server_crypto_start $SOCK_LOCAL netipsec
	rump_server_crypto_start $SOCK_PEER netipsec
	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
	rump_server_add_iface $SOCK_PEER shmif0 $BUS

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24

	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24

	setup_sasp $proto "$algo_args" $ip_local $ip_peer 100 getspi

	extract_new_packets $BUS > $outfile

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer

	extract_new_packets $BUS > $outfile
	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \
	    cat $outfile
	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \
	    cat $outfile
}

add_test_getspi_update()
{
	local proto=$1
	local algo=$2
	local _algo=$(echo $algo | sed 's/-//g')
	local name= desc=

	desc="Tests trying to getspi and update SA of $proto ($algo)"
	name="ipsec_getspi_update_sa_${proto}_${_algo}"

	atf_test_case ${name} cleanup
	eval "
	    ${name}_head() {
	        atf_set descr \"$desc\"
	        atf_set require.progs rump_server setkey
	    }
	    ${name}_body() {
	        test_getspi_update $proto $algo
	        rump_server_destroy_ifaces
	    }
	    ${name}_cleanup() {
	        \$DEBUG && dump
	        cleanup
	    }
	"
	atf_add_test_case ${name}
}

add_sa()
{
	local proto=$1
	local algo_args="$2"
	local ip_local=$3
	local ip_peer=$4
	local lifetime=$5
	local spi=$6
	local tmpfile=./tmp
	local extra=

	export RUMP_SERVER=$SOCK_LOCAL
	cat > $tmpfile <<-EOF
	add $ip_local $ip_peer $proto $((spi)) -lh $lifetime -ls $lifetime $algo_args;
	add $ip_peer $ip_local $proto $((spi + 1)) -lh $lifetime -ls $lifetime $algo_args;
	$extra
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	$DEBUG && $HIJACKING setkey -D
	# XXX it can be expired if $lifetime is very short
	#check_sa_entries $SOCK_LOCAL $ip_local $ip_peer

	export RUMP_SERVER=$SOCK_PEER
	cat > $tmpfile <<-EOF
	add $ip_local $ip_peer $proto $((spi)) -lh $lifetime -ls $lifetime $algo_args;
	add $ip_peer $ip_local $proto $((spi + 1)) -lh $lifetime -ls $lifetime $algo_args;
	$extra
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	$DEBUG && $HIJACKING setkey -D
	# XXX it can be expired if $lifetime is very short
	#check_sa_entries $SOCK_PEER $ip_local $ip_peer
}

delete_sa()
{
	local proto=$1
	local ip_local=$2
	local ip_peer=$3
	local spi=$4
	local tmpfile=./tmp
	local extra=

	export RUMP_SERVER=$SOCK_LOCAL
	cat > $tmpfile <<-EOF
	delete $ip_local $ip_peer $proto $((spi));
	delete $ip_peer $ip_local $proto $((spi + 1));
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	$DEBUG && $HIJACKING setkey -D

	export RUMP_SERVER=$SOCK_PEER
	cat > $tmpfile <<-EOF
	delete $ip_local $ip_peer $proto $((spi));
	delete $ip_peer $ip_local $proto $((spi + 1));
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	$DEBUG && $HIJACKING setkey -D
}

check_packet_spi()
{
	local outfile=$1
	local ip_local=$2
	local ip_peer=$3
	local proto=$4
	local spi=$5
	local spistr=

	$DEBUG && cat $outfile
	spistr=$(printf "%08x" $spi)
	atf_check -s exit:0 \
	    -o match:"$ip_local > $ip_peer: $proto_cap\(spi=0x$spistr," \
	    cat $outfile
	spistr=$(printf "%08x" $((spi + 1)))
	atf_check -s exit:0 \
	    -o match:"$ip_peer > $ip_local: $proto_cap\(spi=0x$spistr," \
	    cat $outfile
}

wait_sa_disappeared()
{
	local spi=$1
	local i=

	export RUMP_SERVER=$SOCK_LOCAL
	for i in $(seq 1 10); do
		$HIJACKING setkey -D |grep -q "spi=$spi"
		[ $? != 0 ] && break
		sleep 1
	done
	if [ $i -eq 10 ]; then
		atf_fail "SA (spi=$spi) didn't disappear in 10s"
	fi
	export RUMP_SERVER=$SOCK_PEER
	for i in $(seq 1 10); do
		$HIJACKING setkey -D |grep -q "spi=$spi"
		[ $? != 0 ] && break
		sleep 1
	done
	if [ $i -eq 10 ]; then
		atf_fail "SA (spi=$spi) didn't disappear in 10s"
	fi
}

test_spi()
{
	local proto=$1
	local algo=$2
	local preferred=$3
	local method=$4
	local ip_local=10.0.0.1
	local ip_peer=10.0.0.2
	local algo_args="$(generate_algo_args $proto $algo)"
	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
	local outfile=./out
	local spistr=
	local longtime= shorttime=

	if [ $method = timeout ]; then
		atf_skip \
	   "PR 55632: test fails randomly, leaving spurious rump_server around"
	fi
	if [ $method = timeout -a $preferred = new ]; then
		skip_if_qemu
	fi

	if [ $method = delete ]; then
		shorttime=100
		longtime=100
	else
		shorttime=3
		longtime=6
	fi

	rump_server_crypto_start $SOCK_LOCAL netipsec
	rump_server_crypto_start $SOCK_PEER netipsec
	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
	rump_server_add_iface $SOCK_PEER shmif0 $BUS

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
	if [ $preferred = old ]; then
		atf_check -s exit:0 rump.sysctl -q -w net.key.prefered_oldsa=1
	fi

	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24
	if [ $preferred = old ]; then
		atf_check -s exit:0 rump.sysctl -q -w net.key.prefered_oldsa=1
	fi

	setup_sasp $proto "$algo_args" $ip_local $ip_peer 100

	extract_new_packets $BUS > $outfile

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	extract_new_packets $BUS > $outfile
	check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10000

	# Add a new SA with a different SPI
	add_sa $proto "$algo_args" $ip_local $ip_peer $longtime 10010

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	extract_new_packets $BUS > $outfile
	if [ $preferred = old ]; then
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10000
	else
		# The new SA is preferred
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10010
	fi

	# Add another SA with a different SPI
	add_sa $proto "$algo_args" $ip_local $ip_peer $shorttime 10020

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	extract_new_packets $BUS > $outfile
	if [ $preferred = old ]; then
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10000
	else
		# The newest SA is preferred
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10020
	fi

	if [ $method = delete ]; then
		delete_sa $proto $ip_local $ip_peer 10020
	else
		wait_sa_disappeared 10020
	fi

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	extract_new_packets $BUS > $outfile
	if [ $preferred = old ]; then
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10000
	else
		# The newest one is removed and the second one is used
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10010
	fi

	if [ $method = delete ]; then
		delete_sa $proto $ip_local $ip_peer 10010
	else
		wait_sa_disappeared 10010
	fi

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	extract_new_packets $BUS > $outfile
	if [ $preferred = old ]; then
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10000
	else
		# The second one is removed and the original one is used
		check_packet_spi $outfile $ip_local $ip_peer $proto_cap 10000
	fi
}

add_test_spi()
{
	local proto=$1
	local algo=$2
	local preferred=$3
	local method=$4
	local _algo=$(echo $algo | sed 's/-//g')
	local name= desc=

	desc="Tests SAs with different SPIs of $proto ($algo) ($preferred SA preferred) ($method)"
	name="ipsec_spi_${proto}_${_algo}_preferred_${preferred}_${method}"

	atf_test_case ${name} cleanup
	eval "
	    ${name}_head() {
	        atf_set descr \"$desc\"
	        atf_set require.progs rump_server setkey
	    }
	    ${name}_body() {
	        test_spi $proto $algo $preferred $method
	        rump_server_destroy_ifaces
	    }
	    ${name}_cleanup() {
	        \$DEBUG && dump
	        cleanup
	    }
	"
	atf_add_test_case ${name}
}

setup_sp()
{
	local proto=$1
	local algo_args="$2"
	local ip_local=$3
	local ip_peer=$4
	local tmpfile=./tmp

	export RUMP_SERVER=$SOCK_LOCAL
	cat > $tmpfile <<-EOF
	spdadd $ip_local $ip_peer any -P out ipsec $proto/transport//require;
	spdadd $ip_peer $ip_local any -P in ipsec $proto/transport//require;
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	check_sp_entries $SOCK_LOCAL $ip_local $ip_peer

	export RUMP_SERVER=$SOCK_PEER
	cat > $tmpfile <<-EOF
	spdadd $ip_peer $ip_local any -P out ipsec $proto/transport//require;
	spdadd $ip_local $ip_peer any -P in ipsec $proto/transport//require;
	EOF
	$DEBUG && cat $tmpfile
	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
	check_sp_entries $SOCK_PEER $ip_peer $ip_local
}

test_nosa()
{
	local proto=$1
	local algo=$2
	local update=$3
	local ip_local=10.0.0.1
	local ip_peer=10.0.0.2
	local algo_args="$(generate_algo_args $proto $algo)"
	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
	local outfile=./out

	rump_server_crypto_start $SOCK_LOCAL netipsec
	rump_server_crypto_start $SOCK_PEER netipsec
	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
	rump_server_add_iface $SOCK_PEER shmif0 $BUS

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24

	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24

	setup_sp $proto "$algo_args" $ip_local $ip_peer

	extract_new_packets $BUS > $outfile

	export RUMP_SERVER=$SOCK_LOCAL
	# It doesn't work because there is no SA
	atf_check -s not-exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
}

add_test_nosa()
{
	local proto=$1
	local algo=$2
	local _algo=$(echo $algo | sed 's/-//g')
	local name= desc=

	desc="Tests SPs with no relevant SAs with $proto ($algo)"
	name="ipsec_nosa_${proto}_${_algo}"

	atf_test_case ${name} cleanup
	eval "
	    ${name}_head() {
	        atf_set descr \"$desc\"
	        atf_set require.progs rump_server setkey
	    }
	    ${name}_body() {
	        test_nosa $proto $algo
	        rump_server_destroy_ifaces
	    }
	    ${name}_cleanup() {
	        \$DEBUG && dump
	        cleanup
	    }
	"
	atf_add_test_case ${name}
}

test_multiple_sa()
{
	local proto=$1
	local algo=$2
	local update=$3
	local ip_local=10.0.0.1
	local ip_peer=10.0.0.2
	local ip_peer2=10.0.0.3
	local algo_args="$(generate_algo_args $proto $algo)"
	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
	local outfile=./out

	rump_server_crypto_start $SOCK_LOCAL netipsec
	rump_server_crypto_start $SOCK_PEER netipsec
	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
	rump_server_add_iface $SOCK_PEER shmif0 $BUS

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24

	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24
	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer2/24 alias

	setup_sp $proto "$algo_args" "$ip_local" "0.0.0.0/0"

	extract_new_packets $BUS > $outfile

	export RUMP_SERVER=$SOCK_LOCAL
	# There is no SA, so ping should fail
	atf_check -s not-exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	atf_check -s not-exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer2

	add_sa $proto "$algo_args" $ip_local $ip_peer 100 10000

	export RUMP_SERVER=$SOCK_LOCAL
	# There is only an SA for $ip_peer, so ping to $ip_peer2 should fail
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	atf_check -s not-exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer2

	add_sa $proto "$algo_args" $ip_local $ip_peer2 100 10010

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer2

	export RUMP_SERVER=$SOCK_LOCAL
	atf_check -s exit:0 -o match:"$proto/transport//require" \
	    $HIJACKING setkey -D -P
	# Check if the policy isn't modified accidentally
	atf_check -s exit:0 -o not-match:"$proto/transport/.+\-.+/require" \
	    $HIJACKING setkey -D -P
	export RUMP_SERVER=$SOCK_PEER
	atf_check -s exit:0 -o match:"$proto/transport//require" \
	    $HIJACKING setkey -D -P
	# Check if the policy isn't modified accidentally
	atf_check -s exit:0 -o not-match:"$proto/transport/.+\-.+/require" \
	    $HIJACKING setkey -D -P
}

add_test_multiple_sa()
{
	local proto=$1
	local algo=$2
	local _algo=$(echo $algo | sed 's/-//g')
	local name= desc=

	desc="Tests multiple SAs with $proto ($algo)"
	name="ipsec_multiple_sa_${proto}_${_algo}"

	atf_test_case ${name} cleanup
	eval "
	    ${name}_head() {
	        atf_set descr \"$desc\"
	        atf_set require.progs rump_server setkey
	    }
	    ${name}_body() {
	        test_multiple_sa $proto $algo
	        rump_server_destroy_ifaces
	    }
	    ${name}_cleanup() {
	        \$DEBUG && dump
	        cleanup
	    }
	"
	atf_add_test_case ${name}
}

atf_init_test_cases()
{
	local algo=

	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
		add_test_lifetime ipv4 esp $algo
		add_test_lifetime ipv6 esp $algo
		add_test_update esp $algo sa
		add_test_update esp $algo sp
		add_test_getspi_update esp $algo
		add_test_spi esp $algo new delete
		add_test_spi esp $algo old delete
		add_test_spi esp $algo new timeout
		add_test_spi esp $algo old timeout
		add_test_nosa esp $algo
		add_test_multiple_sa esp $algo
	done
	for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do
		add_test_lifetime ipv4 ah $algo
		add_test_lifetime ipv6 ah $algo
		add_test_update ah $algo sa
		add_test_update ah $algo sp
		add_test_getspi_update ah $algo
		add_test_spi ah $algo new delete
		add_test_spi ah $algo old delete
		add_test_spi ah $algo new timeout
		add_test_spi ah $algo old timeout
		add_test_nosa ah $algo
		add_test_multiple_sa ah $algo
	done
}
