mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-02-09 08:16:58 +08:00
aa8ab8ed30
As added inc1a6f2b04a, this test verifies that ocserv will NOT send IPv6 routes to OpenConnect v3 clients, which can't handle them correctly. Additionally, we can also verify that ocserv DOES send IPv6 routes to totally unknown clients, which is the intended outcome resulting from8b8a1a7b53. Signed-off-by: Daniel Lenski <dlenski@amazon.com>
97 lines
2.8 KiB
Bash
Executable File
97 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# Copyright (C) 2023 Nikos Mavrogiannopoulos
|
|
#
|
|
# This file is part of ocserv.
|
|
#
|
|
# ocserv is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by the
|
|
# Free Software Foundation; either version 2 of the License, or (at
|
|
# your option) any later version.
|
|
#
|
|
# ocserv is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with GnuTLS; if not, write to the Free Software Foundation,
|
|
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
|
|
SERV="${SERV:-../src/ocserv}"
|
|
srcdir=${srcdir:-.}
|
|
PIDFILE=ocserv-pid.$$.tmp
|
|
CLIPID=oc-pid.$$.tmp
|
|
IP=$(which ip)
|
|
TMPFILE=$(mktemp)
|
|
|
|
. `dirname $0`/common.sh
|
|
|
|
eval "${GETPORT}"
|
|
|
|
if test -z "${IP}";then
|
|
echo "no IP tool is present"
|
|
exit 77
|
|
fi
|
|
|
|
if test "$(id -u)" != "0";then
|
|
echo "This test must be run as root"
|
|
exit 77
|
|
fi
|
|
|
|
function finish {
|
|
set +e
|
|
echo " * Cleaning up..."
|
|
test -n "${PID}" && kill ${PID} >/dev/null 2>&1
|
|
test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1
|
|
test -n "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1
|
|
test -n "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1
|
|
test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1
|
|
}
|
|
trap finish EXIT
|
|
|
|
OCCTL_SOCKET=./ipv6-no-$$.socket
|
|
USERNAME=test
|
|
|
|
. `dirname $0`/random-net.sh
|
|
. `dirname $0`/ns.sh
|
|
|
|
update_config ipv6-iface.config
|
|
if test "$VERBOSE" = 1;then
|
|
DEBUG="-d 3"
|
|
fi
|
|
|
|
${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
|
|
wait_server $PID
|
|
|
|
echo "Testing that ocserv doesn't assign IPv6 address on (ancient) OpenConnect v3 clients... "
|
|
|
|
echo -n "Connecting to setup interface... "
|
|
echo "test" | ${CMDNS1} timeout 15s $OPENCONNECT -v $ADDRESS:$PORT --useragent="Open AnyConnect VPN Agent v3" --passwd-on-stdin -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1
|
|
|
|
echo ok
|
|
|
|
cat ${TMPFILE}|grep X-CSTP-Split-Include|grep 'fd63:' >/dev/null
|
|
if test $? = 0;then
|
|
cat ${TMPFILE}|grep X-CSTP-Split
|
|
echo "Found IPv6 route that shouldn't be there"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Testing that ocserv DOES assign IPv6 address on totally unknown clients... "
|
|
|
|
echo -n "Connecting to setup interface... "
|
|
echo "test" | ${CMDNS1} timeout 15s $OPENCONNECT -v $ADDRESS:$PORT --useragent="/* An unknown user agent */" --passwd-on-stdin -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1
|
|
|
|
cat ${TMPFILE}|grep X-CSTP-Split-Include|grep 'fd63:' >/dev/null
|
|
if test $? != 0;then
|
|
cat ${TMPFILE}|grep X-CSTP-Split
|
|
echo "Did not find IPv6 which SHOULD be there"
|
|
exit 1
|
|
fi
|
|
|
|
kill $PID
|
|
wait
|
|
|
|
exit 0
|