Source/charon/testcases/sa_config_test.c

   1 /**
   2  * @file sa_config_test.c
   3  *
   4  * @brief Tests for the sa_config_t class.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include "sa_config_test.h"
  24
  25 #include <daemon.h>
  26 #include <config/sa_config.h>
  27 #include <config/traffic_selector.h>
  28 #include <utils/allocator.h>
  29 #include <utils/logger.h>
  30 #include <encoding/payloads/ts_payload.h>
  31
  32
  33 /**
  34  * Described in header.
  35  */
  36 void test_sa_config(protected_tester_t *tester)
  37 {
  38         sa_config_t *sa_config;
  39         traffic_selector_t *ts_policy[3], *ts_request[4], *ts_reference[3], **ts_result;
  40         proposal_t *proposal1, *proposal2, *proposal3, *proposal_sel;
  41         linked_list_t *proposals_list;
  42         iterator_t *iterator;
  43         size_t count;
  44         logger_t *logger;
  45         ts_payload_t *ts_payload;
  46
  47         logger = charon->logger_manager->create_logger(charon->logger_manager, TESTER, NULL);
  48         logger->disable_level(logger, FULL);
  49
  50         sa_config = sa_config_create(ID_IPV4_ADDR, "152.96.193.130",
  51                                                                  ID_IPV4_ADDR, "152.96.193.131",
  52                                                                  RSA_DIGITAL_SIGNATURE,
  53                                                                  30000);
  54
  55         tester->assert_true(tester, (sa_config != NULL), "sa_config construction");
  56
  57
  58         /*
  59          * test proposal getting and selection
  60          *
  61          */
  62
  63         /* esp only prop */
  64         proposal1 = proposal_create(1);
  65         proposal1->add_algorithm(proposal1, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
  66
  67         /* ah only prop */
  68         proposal2 = proposal_create(2);
  69         proposal2->add_algorithm(proposal2, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
  70
  71         /* ah and esp prop */
  72         proposal3 = proposal_create(3);
  73         proposal3->add_algorithm(proposal3, ESP, ENCRYPTION_ALGORITHM, ENCR_3DES, 16);
  74         proposal3->add_algorithm(proposal3, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
  75
  76
  77         sa_config->add_proposal(sa_config, proposal1);
  78         sa_config->add_proposal(sa_config, proposal2);
  79         sa_config->add_proposal(sa_config, proposal3);
  80
  81
  82         proposals_list = sa_config->get_proposals(sa_config);
  83         tester->assert_true(tester, (proposals_list->get_count(proposals_list) == 3), "proposal count");
  84
  85
  86         proposals_list = linked_list_create();
  87         proposal1 = proposal_create(1);
  88         proposal1->add_algorithm(proposal1, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 32);
  89         proposal2 = proposal_create(2);
  90         proposal2->add_algorithm(proposal2, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
  91         proposal2->add_algorithm(proposal2, ESP, ENCRYPTION_ALGORITHM, ENCR_3DES, 16);
  92         proposal2->add_algorithm(proposal2, ESP, ENCRYPTION_ALGORITHM, ENCR_BLOWFISH, 0);
  93         proposal2->add_algorithm(proposal2, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
  94         proposal2->add_algorithm(proposal2, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
  95
  96         proposals_list->insert_last(proposals_list, proposal1);
  97         proposals_list->insert_last(proposals_list, proposal2);
  98
  99         proposal_sel = sa_config->select_proposal(sa_config, proposals_list);
 100         tester->assert_false(tester, proposal_sel == NULL, "proposal select");
 101         /* check ESP encryption algo */
 102         iterator = proposal_sel->create_algorithm_iterator(proposal_sel, ESP, ENCRYPTION_ALGORITHM);
 103         tester->assert_false(tester, iterator == NULL, "algorithm select ESP");
 104         while (iterator->has_next(iterator))
 105         {
 106                 algorithm_t *algo;
 107                 iterator->current(iterator, (void**)&algo);
 108                 tester->assert_true(tester, algo->algorithm == ENCR_3DES, "ESP encryption algo");
 109                 tester->assert_true(tester, algo->key_size == 16, "ESP encryption keysize");
 110         }
 111         iterator->destroy(iterator);
 112         iterator = proposal_sel->create_algorithm_iterator(proposal_sel, AH, INTEGRITY_ALGORITHM);
 113         /* check AH integrity algo */
 114         tester->assert_false(tester, iterator == NULL, "algorithm select AH");
 115         while (iterator->has_next(iterator))
 116         {
 117                 algorithm_t *algo;
 118                 iterator->current(iterator, (void**)&algo);
 119                 tester->assert_true(tester, algo->algorithm == AUTH_HMAC_MD5_96, "ESP encryption algo");
 120                 tester->assert_true(tester, algo->key_size == 20, "ESP encryption keysize");
 121         }
 122         iterator->destroy(iterator);
 123
 124         proposal_sel->destroy(proposal_sel);
 125
 126         /* cleanup */
 127         proposal1->destroy(proposal1);
 128         proposal1->destroy(proposal2);
 129         proposals_list->destroy(proposals_list);
 130
 131         /*
 132          * test traffic selection getting and matching
 133          *
 134          */
 135
 136         /* define policies */
 137
 138         /* allow any tcp */
 139         ts_policy[0] = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
 140
 141         /* allow udp on port 123 to ".122" */
 142         ts_policy[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123);
 143
 144         /* allow udp on ports > 2000 in subnet ... */
 145         ts_policy[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 65535);
 146
 147
 148
 149         /* define request and result */
 150
 151         /* udp on subnet:123, should be reduced to ".122"  */
 152         ts_request[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 123, "152.96.193.255", 123);
 153         ts_reference[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123);
 154
 155         /* should be granted. */
 156         ts_request[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000);
 157         ts_reference[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000);
 158
 159         /* should be reduced to port 2000 - 3000. and range ".193.*" */
 160         ts_request[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.191.0", 1000, "152.96.194.255", 3000);
 161         ts_reference[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 3000);
 162
 163         /* icmp request, should be discarded */
 164         ts_request[3] = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
 165
 166         sa_config->add_my_traffic_selector(sa_config, ts_policy[0]);
 167         sa_config->add_my_traffic_selector(sa_config, ts_policy[1]);
 168         sa_config->add_my_traffic_selector(sa_config, ts_policy[2]);
 169
 170         count = sa_config->get_my_traffic_selectors(sa_config, &ts_result);
 171         tester->assert_true(tester, (count == 3), "ts get count");
 172         ts_result[0]->destroy(ts_result[0]);
 173         ts_result[0]->destroy(ts_result[1]);
 174         ts_result[0]->destroy(ts_result[2]);
 175         allocator_free(ts_result);
 176
 177         count = sa_config->select_my_traffic_selectors(sa_config, &ts_request[0], 4, &ts_result);
 178         tester->assert_true(tester, (count == 3), "ts select count");
 179
 180
 181         /* store and restore into ts payload, tricky tricky */
 182         ts_payload = ts_payload_create_from_traffic_selectors(TRUE, ts_result, count);
 183
 184         /* destroy */
 185         ts_result[0]->destroy(ts_result[0]);
 186         ts_result[0]->destroy(ts_result[1]);
 187         ts_result[0]->destroy(ts_result[2]);
 188         allocator_free(ts_result);
 189
 190         /* get them again out of the payload */
 191         count = ts_payload->get_traffic_selectors(ts_payload, &ts_result);
 192         ts_payload->destroy(ts_payload);
 193
 194
 195
 196         int i;
 197         for (i = 0; i<count; i++)
 198         {
 199                 chunk_t fa_res = ts_result[i]->get_from_address(ts_result[i]);
 200                 chunk_t fa_ref = ts_reference[i]->get_from_address(ts_reference[i]);
 201                 chunk_t ta_res = ts_result[i]->get_to_address(ts_result[i]);
 202                 chunk_t ta_ref = ts_reference[i]->get_to_address(ts_reference[i]);
 203                 u_int16_t fp_res = ts_result[i]->get_from_port(ts_result[i]);
 204                 u_int16_t fp_ref = ts_reference[i]->get_from_port(ts_reference[i]);
 205                 u_int16_t tp_res = ts_result[i]->get_to_port(ts_result[i]);
 206                 u_int16_t tp_ref = ts_reference[i]->get_to_port(ts_reference[i]);
 207
 208
 209                 logger->log_chunk(logger, RAW, "from address result", &fa_res);
 210                 logger->log_chunk(logger, RAW, "from address reference", &fa_ref);
 211                 logger->log_chunk(logger, RAW, "to address result", &ta_res);
 212                 logger->log_chunk(logger, RAW, "to address reference", &ta_ref);
 213                 tester->assert_true(tester, fa_res.len == fa_ref.len, "from address len");
 214                 tester->assert_false(tester, memcmp(fa_res.ptr, fa_ref.ptr,fa_res.len), "from address value");
 215                 tester->assert_true(tester, ta_res.len == ta_ref.len, "to address len");
 216                 tester->assert_false(tester, memcmp(ta_res.ptr, ta_ref.ptr,ta_res.len), "to address value");
 217
 218                 tester->assert_true(tester, fp_res == fp_ref, "from port");
 219                 tester->assert_true(tester, tp_res == tp_ref, "to port");
 220
 221                 allocator_free(fa_res.ptr);
 222                 allocator_free(fa_ref.ptr);
 223                 allocator_free(ta_res.ptr);
 224                 allocator_free(ta_ref.ptr);
 225         }
 226
 227
 228         /* destroy */
 229         ts_result[0]->destroy(ts_result[0]);
 230         ts_result[0]->destroy(ts_result[1]);
 231         ts_result[0]->destroy(ts_result[2]);
 232         allocator_free(ts_result);
 233
 234         ts_policy[0]->destroy(ts_policy[0]);
 235         ts_policy[1]->destroy(ts_policy[1]);
 236         ts_policy[2]->destroy(ts_policy[2]);
 237         ts_request[0]->destroy(ts_request[0]);
 238         ts_reference[0]->destroy(ts_reference[0]);
 239         ts_request[1]->destroy(ts_request[1]);
 240         ts_reference[1]->destroy(ts_reference[1]);
 241         ts_request[2]->destroy(ts_request[2]);
 242         ts_reference[2]->destroy(ts_reference[2]);
 243         ts_request[3]->destroy(ts_request[3]);
 244
 245         sa_config->destroy(sa_config);
 246 }