Lines Matching full:policy
4 # Check xfrm policy resolution. Topology:
15 # ns1: ping 10.0.1.253: passes via ipsec tunnel (direct policy)
16 # ns2: ping 10.0.2.253: passes via ipsec tunnel (direct policy)
38 …ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tu…
40 …ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tu…
64 # Adding a policy for '10.0.1.0/23' will make it necessary to
74 # adds new nodes to tree (neither network exists yet in policy database).
75 ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
78 ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
81 ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
83 # dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
95 # The next 'policy add' adds dst '10.0.0.0/23', which means
107 ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
112 …ip -net $ns xfrm policy add src 10.253.1.$((RANDOM%255))/$p dst 10.254.1.$((RANDOM%255))/$p dir fw…
122 ip -net $ns xfrm policy get src $lnet dst $rnet dir out > /dev/null
125 echo "FAIL: ip -net $ns xfrm policy get src $lnet dst $rnet dir out"
129 ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd > /dev/null
132 echo "FAIL: ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd"
145 ip -net $ns xfrm policy add dst $plain dir out priority 10 action allow
147 # direct policy for $encryptip, use tunnel, higher prio takes precedence
148 …ip -net $ns xfrm policy add dst $encryptip dir out tmpl src $me dst $remote proto esp mode tunnel …
156 # dummy policy with wildcard src/dst.
157 echo netns exec $ns ip xfrm policy add src 0.0.0.0/0 dst 10.$i.99.0/30 dir out action block
158 echo netns exec $ns ip xfrm policy add src 10.$i.99.0/30 dst 0.0.0.0/0 dir out action block
160 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/30 dst 10.$i.$j.0/30 dir out action block
162 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/29 dst 10.$i.$j.0/29 dir out action block
164 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/24 dst 10.$i.$j.0/24 dir out action block
165 … echo netns exec $ns ip xfrm policy add src 10.$i.$j.0/24 dst 10.$i.1.0/24 dir fwd action block
175 … echo netns exec $ns ip xfrm policy add src dead:$i::/64 dst dead:$i:$j::/64 dir out action block
176 … echo netns exec $ns ip xfrm policy add src dead:$i:$j::/64 dst dead:$i::/24 dir fwd action block
185 ip netns exec $ns iptables-save -c |grep policy | ( read c rest
200 # 0: iptables -m policy rule count == 0
201 # 1: iptables -m policy rule count != 0
245 # ping to .253 should use use ipsec due to direct policy exception.
251 echo "PASS: direct policy matches ($logpostfix)"
260 echo "PASS: policy matches ($logpostfix)"
272 …ip -net ${ns[1]} xfrm policy update src e000:0001::0000 dst ff01::0014:0000:0001 dir in tmpl src :…
273 ip -net ${ns[1]} xfrm policy set hthresh6 0 28 || break
275 …ip -net ${ns[1]} xfrm policy update src e000:0001::0000 dst ff01::01 dir in tmpl src :: dst :: pro…
276 ip -net ${ns[1]} xfrm policy set hthresh6 0 28 || break
297 ip -net $ns xfrm policy flush
299 ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow
302 if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then
310 ip -net $ns xfrm policy flush
313 ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow
317 if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then
324 ip -net $ns xfrm policy flush
342 # needed to check if policy lookup got valid ipsec result
401 # abuse iptables rule counter to check if ping matches a policy
402 ip netns exec ${ns[3]} iptables -p icmp -A FORWARD -m policy --dir out --pol ipsec
403 ip netns exec ${ns[4]} iptables -p icmp -A FORWARD -m policy --dir out --pol ipsec
430 echo "PASS: policy before exception matches"
455 ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
461 # full flush of policy db, check everything gets freed incl. internal meta data
462 ip -net ${ns[3]} xfrm policy flush
468 ip -net ${ns[3]} xfrm policy set hthresh4 16 16
475 ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128