shell bypass 403
UnknownSec Shell
:
/
usr
/
src
/
linux-headers-6.8.0-36-generic
/
tools
/
testing
/
selftests
/
net
/ [
drwxr-xr-x
]
upload
mass deface
mass delete
console
info server
name :
l2tp.sh
#!/bin/bash # SPDX-License-Identifier: GPL-2.0 # # L2TPv3 tunnel between 2 hosts # # host-1 | router | host-2 # | | # lo l2tp | | l2tp lo # 172.16.101.1 172.16.1.1 | | 172.16.1.2 172.16.101.2 # fc00:101::1 fc00:1::1 | | fc00:1::2 fc00:101::2 # | | # eth0 | | eth0 # 10.1.1.1 | | 10.1.2.1 # 2001:db8:1::1 | | 2001:db8:2::1 source lib.sh VERBOSE=0 PAUSE_ON_FAIL=no which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping) ################################################################################ # log_test() { local rc=$1 local expected=$2 local msg="$3" if [ ${rc} -eq ${expected} ]; then printf "TEST: %-60s [ OK ]\n" "${msg}" nsuccess=$((nsuccess+1)) else ret=1 nfail=$((nfail+1)) printf "TEST: %-60s [FAIL]\n" "${msg}" if [ "${PAUSE_ON_FAIL}" = "yes" ]; then echo echo "hit enter to continue, 'q' to quit" read a [ "$a" = "q" ] && exit 1 fi fi } run_cmd() { local ns local cmd local out local rc ns="$1" shift cmd="$*" if [ "$VERBOSE" = "1" ]; then printf " COMMAND: $cmd\n" fi out=$(eval ip netns exec ${ns} ${cmd} 2>&1) rc=$? if [ "$VERBOSE" = "1" -a -n "$out" ]; then echo " $out" fi [ "$VERBOSE" = "1" ] && echo return $rc } ################################################################################ # create namespaces and interconnects create_ns() { local ns=$1 local addr=$2 local addr6=$3 [ -z "${addr}" ] && addr="-" [ -z "${addr6}" ] && addr6="-" if [ "${addr}" != "-" ]; then ip -netns ${ns} addr add dev lo ${addr} fi if [ "${addr6}" != "-" ]; then ip -netns ${ns} -6 addr add dev lo ${addr6} fi ip -netns ${ns} ro add unreachable default metric 8192 ip -netns ${ns} -6 ro add unreachable default metric 8192 ip netns exec ${ns} sysctl -qw net.ipv4.ip_forward=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0 } # create veth pair to connect namespaces and apply addresses. connect_ns() { local ns1=$1 local ns1_dev=$2 local ns1_addr=$3 local ns1_addr6=$4 local ns2=$5 local ns2_dev=$6 local ns2_addr=$7 local ns2_addr6=$8 ip -netns ${ns1} li add ${ns1_dev} type veth peer name tmp ip -netns ${ns1} li set ${ns1_dev} up ip -netns ${ns1} li set tmp netns ${ns2} name ${ns2_dev} ip -netns ${ns2} li set ${ns2_dev} up if [ "${ns1_addr}" != "-" ]; then ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr} ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr} fi if [ "${ns1_addr6}" != "-" ]; then ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr6} ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr6} fi } ################################################################################ # test setup cleanup() { cleanup_ns $host_1 $host_2 $router } setup_l2tp_ipv4() { # # configure l2tpv3 tunnel on host-1 # ip -netns $host_1 l2tp add tunnel tunnel_id 1041 peer_tunnel_id 1042 \ encap ip local 10.1.1.1 remote 10.1.2.1 ip -netns $host_1 l2tp add session name l2tp4 tunnel_id 1041 \ session_id 1041 peer_session_id 1042 ip -netns $host_1 link set dev l2tp4 up ip -netns $host_1 addr add dev l2tp4 172.16.1.1 peer 172.16.1.2 # # configure l2tpv3 tunnel on host-2 # ip -netns $host_2 l2tp add tunnel tunnel_id 1042 peer_tunnel_id 1041 \ encap ip local 10.1.2.1 remote 10.1.1.1 ip -netns $host_2 l2tp add session name l2tp4 tunnel_id 1042 \ session_id 1042 peer_session_id 1041 ip -netns $host_2 link set dev l2tp4 up ip -netns $host_2 addr add dev l2tp4 172.16.1.2 peer 172.16.1.1 # # add routes to loopback addresses # ip -netns $host_1 ro add 172.16.101.2/32 via 172.16.1.2 ip -netns $host_2 ro add 172.16.101.1/32 via 172.16.1.1 } setup_l2tp_ipv6() { # # configure l2tpv3 tunnel on host-1 # ip -netns $host_1 l2tp add tunnel tunnel_id 1061 peer_tunnel_id 1062 \ encap ip local 2001:db8:1::1 remote 2001:db8:2::1 ip -netns $host_1 l2tp add session name l2tp6 tunnel_id 1061 \ session_id 1061 peer_session_id 1062 ip -netns $host_1 link set dev l2tp6 up ip -netns $host_1 addr add dev l2tp6 fc00:1::1 peer fc00:1::2 # # configure l2tpv3 tunnel on host-2 # ip -netns $host_2 l2tp add tunnel tunnel_id 1062 peer_tunnel_id 1061 \ encap ip local 2001:db8:2::1 remote 2001:db8:1::1 ip -netns $host_2 l2tp add session name l2tp6 tunnel_id 1062 \ session_id 1062 peer_session_id 1061 ip -netns $host_2 link set dev l2tp6 up ip -netns $host_2 addr add dev l2tp6 fc00:1::2 peer fc00:1::1 # # add routes to loopback addresses # ip -netns $host_1 -6 ro add fc00:101::2/128 via fc00:1::2 ip -netns $host_2 -6 ro add fc00:101::1/128 via fc00:1::1 } setup() { # start clean cleanup set -e setup_ns host_1 host_2 router create_ns $host_1 172.16.101.1/32 fc00:101::1/128 create_ns $host_2 172.16.101.2/32 fc00:101::2/128 create_ns $router connect_ns $host_1 eth0 10.1.1.1/24 2001:db8:1::1/64 \ $router eth1 10.1.1.2/24 2001:db8:1::2/64 connect_ns $host_2 eth0 10.1.2.1/24 2001:db8:2::1/64 \ $router eth2 10.1.2.2/24 2001:db8:2::2/64 ip -netns $host_1 ro add 10.1.2.0/24 via 10.1.1.2 ip -netns $host_1 -6 ro add 2001:db8:2::/64 via 2001:db8:1::2 ip -netns $host_2 ro add 10.1.1.0/24 via 10.1.2.2 ip -netns $host_2 -6 ro add 2001:db8:1::/64 via 2001:db8:2::2 setup_l2tp_ipv4 setup_l2tp_ipv6 set +e } setup_ipsec() { # # IPv4 # run_cmd $host_1 ip xfrm policy add \ src 10.1.1.1 dst 10.1.2.1 dir out \ tmpl proto esp mode transport run_cmd $host_1 ip xfrm policy add \ src 10.1.2.1 dst 10.1.1.1 dir in \ tmpl proto esp mode transport run_cmd $host_2 ip xfrm policy add \ src 10.1.1.1 dst 10.1.2.1 dir in \ tmpl proto esp mode transport run_cmd $host_2 ip xfrm policy add \ src 10.1.2.1 dst 10.1.1.1 dir out \ tmpl proto esp mode transport ip -netns $host_1 xfrm state add \ src 10.1.1.1 dst 10.1.2.1 \ spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport ip -netns $host_1 xfrm state add \ src 10.1.2.1 dst 10.1.1.1 \ spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport ip -netns $host_2 xfrm state add \ src 10.1.1.1 dst 10.1.2.1 \ spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport ip -netns $host_2 xfrm state add \ src 10.1.2.1 dst 10.1.1.1 \ spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport # # IPV6 # run_cmd $host_1 ip -6 xfrm policy add \ src 2001:db8:1::1 dst 2001:db8:2::1 dir out \ tmpl proto esp mode transport run_cmd $host_1 ip -6 xfrm policy add \ src 2001:db8:2::1 dst 2001:db8:1::1 dir in \ tmpl proto esp mode transport run_cmd $host_2 ip -6 xfrm policy add \ src 2001:db8:1::1 dst 2001:db8:2::1 dir in \ tmpl proto esp mode transport run_cmd $host_2 ip -6 xfrm policy add \ src 2001:db8:2::1 dst 2001:db8:1::1 dir out \ tmpl proto esp mode transport ip -netns $host_1 -6 xfrm state add \ src 2001:db8:1::1 dst 2001:db8:2::1 \ spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport ip -netns $host_1 -6 xfrm state add \ src 2001:db8:2::1 dst 2001:db8:1::1 \ spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport ip -netns $host_2 -6 xfrm state add \ src 2001:db8:1::1 dst 2001:db8:2::1 \ spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport ip -netns $host_2 -6 xfrm state add \ src 2001:db8:2::1 dst 2001:db8:1::1 \ spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \ 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport } teardown_ipsec() { run_cmd $host_1 ip xfrm state flush run_cmd $host_1 ip xfrm policy flush run_cmd $host_2 ip xfrm state flush run_cmd $host_2 ip xfrm policy flush } ################################################################################ # generate traffic through tunnel for various cases run_ping() { local desc="$1" run_cmd $host_1 ping -c1 -w1 172.16.1.2 log_test $? 0 "IPv4 basic L2TP tunnel ${desc}" run_cmd $host_1 ping -c1 -w1 -I 172.16.101.1 172.16.101.2 log_test $? 0 "IPv4 route through L2TP tunnel ${desc}" run_cmd $host_1 ${ping6} -c1 -w1 fc00:1::2 log_test $? 0 "IPv6 basic L2TP tunnel ${desc}" run_cmd $host_1 ${ping6} -c1 -w1 -I fc00:101::1 fc00:101::2 log_test $? 0 "IPv6 route through L2TP tunnel ${desc}" } run_tests() { local desc setup run_ping setup_ipsec run_ping "- with IPsec" run_cmd $host_1 ping -c1 -w1 172.16.1.2 log_test $? 0 "IPv4 basic L2TP tunnel ${desc}" run_cmd $host_1 ping -c1 -w1 -I 172.16.101.1 172.16.101.2 log_test $? 0 "IPv4 route through L2TP tunnel ${desc}" run_cmd $host_1 ${ping6} -c1 -w1 fc00:1::2 log_test $? 0 "IPv6 basic L2TP tunnel - with IPsec" run_cmd $host_1 ${ping6} -c1 -w1 -I fc00:101::1 fc00:101::2 log_test $? 0 "IPv6 route through L2TP tunnel - with IPsec" teardown_ipsec run_ping "- after IPsec teardown" } ################################################################################ # main declare -i nfail=0 declare -i nsuccess=0 while getopts :pv o do case $o in p) PAUSE_ON_FAIL=yes;; v) VERBOSE=$(($VERBOSE + 1));; *) exit 1;; esac done run_tests cleanup printf "\nTests passed: %3d\n" ${nsuccess} printf "Tests failed: %3d\n" ${nfail}
© 2026 UnknownSec