Lines Matching full:policy
4 # Check xfrm policy resolution. Topology:
15 # ns1: ping 10.0.1.253: passes via ipsec tunnel (direct policy)
16 # ns2: ping 10.0.2.253: passes via ipsec tunnel (direct policy)
39 …ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tu…
41 …ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tu…
65 # Adding a policy for '10.0.1.0/23' will make it necessary to
75 # adds new nodes to tree (neither network exists yet in policy database).
76 ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
79 ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
82 ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
84 # dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
96 # The next 'policy add' adds dst '10.0.0.0/23', which means
108 ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
113 …ip -net $ns xfrm policy add src 10.253.1.$((RANDOM%255))/$p dst 10.254.1.$((RANDOM%255))/$p dir fw…
123 ip -net $ns xfrm policy get src $lnet dst $rnet dir out > /dev/null
126 echo "FAIL: ip -net $ns xfrm policy get src $lnet dst $rnet dir out"
130 ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd > /dev/null
133 echo "FAIL: ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd"
146 ip -net $ns xfrm policy add dst $plain dir out priority 10 action allow
148 # direct policy for $encryptip, use tunnel, higher prio takes precedence
149 …ip -net $ns xfrm policy add dst $encryptip dir out tmpl src $me dst $remote proto esp mode tunnel …
157 # dummy policy with wildcard src/dst.
158 echo netns exec $ns ip xfrm policy add src 0.0.0.0/0 dst 10.$i.99.0/30 dir out action block
159 echo netns exec $ns ip xfrm policy add src 10.$i.99.0/30 dst 0.0.0.0/0 dir out action block
161 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/30 dst 10.$i.$j.0/30 dir out action block
163 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/29 dst 10.$i.$j.0/29 dir out action block
165 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/24 dst 10.$i.$j.0/24 dir out action block
166 … echo netns exec $ns ip xfrm policy add src 10.$i.$j.0/24 dst 10.$i.1.0/24 dir fwd action block
176 … echo netns exec $ns ip xfrm policy add src dead:$i::/64 dst dead:$i:$j::/64 dir out action block
177 … echo netns exec $ns ip xfrm policy add src dead:$i:$j::/64 dst dead:$i::/24 dir fwd action block
186 ip netns exec $ns iptables-save -c |grep policy | ( read c rest
201 # 0: iptables -m policy rule count == 0
202 # 1: iptables -m policy rule count != 0
246 # ping to .253 should use use ipsec due to direct policy exception.
252 echo "PASS: direct policy matches ($logpostfix)"
261 echo "PASS: policy matches ($logpostfix)"
273 …ip -net ns1 xfrm policy update src e000:0001::0000 dst ff01::0014:0000:0001 dir in tmpl src :: dst…
274 ip -net ns1 xfrm policy set hthresh6 0 28 || break
276 …ip -net ns1 xfrm policy update src e000:0001::0000 dst ff01::01 dir in tmpl src :: dst :: proto es…
277 ip -net ns1 xfrm policy set hthresh6 0 28 || break
298 ip -net $ns xfrm policy flush
300 ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow
303 if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then
311 ip -net $ns xfrm policy flush
314 ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow
318 if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then
325 ip -net $ns xfrm policy flush
343 # needed to check if policy lookup got valid ipsec result
401 # abuse iptables rule counter to check if ping matches a policy
402 ip netns exec ns3 iptables -p icmp -A FORWARD -m policy --dir out --pol ipsec
403 ip netns exec ns4 iptables -p icmp -A FORWARD -m policy --dir out --pol ipsec
430 echo "PASS: policy before exception matches"
455 ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
461 # full flush of policy db, check everything gets freed incl. internal meta data
462 ip -net ns3 xfrm policy flush
468 ip -net ns3 xfrm policy set hthresh4 16 16
475 ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128