- added ts for both initator and responder
[strongswan.git] / Source / charon / testcases / sa_config_test.c
1 /**
2 * @file sa_config_test.c
3 *
4 * @brief Tests for the sa_config_t class.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "sa_config_test.h"
24
25 #include <daemon.h>
26 #include <config/sa_config.h>
27 #include <config/traffic_selector.h>
28 #include <utils/allocator.h>
29 #include <utils/logger.h>
30 #include <encoding/payloads/ts_payload.h>
31
32
33 /**
34 * Described in header.
35 */
36 void test_sa_config(tester_t *tester)
37 {
38 sa_config_t *sa_config;
39 traffic_selector_t *ts_policy[3], *ts_request[4], *ts_reference[3], **ts_result;
40 child_proposal_t prop[3], *prop_result;
41 size_t count;
42 logger_t *logger;
43 ts_payload_t *ts_payload;
44
45 u_int8_t spi[4] = {0x01,0x02,0x03,0x04};
46
47 logger = charon->logger_manager->create_logger(charon->logger_manager, TESTER, NULL);
48 logger->disable_level(logger, FULL);
49
50 sa_config = sa_config_create(ID_IPV4_ADDR, "152.96.193.130",
51 ID_IPV4_ADDR, "152.96.193.131",
52 RSA_DIGITAL_SIGNATURE);
53
54 tester->assert_true(tester, (sa_config != NULL), "sa_config construction");
55
56
57 /*
58 * test proposal getting and selection
59 *
60 */
61
62 /* esp only prop */
63 prop[0].ah.is_set = FALSE;
64 prop[0].esp.is_set = TRUE;
65 prop[0].esp.encryption_algorithm = ENCR_AES_CBC;
66 prop[0].esp.encryption_algorithm_key_size = 16;
67
68 /* ah only prop */
69 prop[1].esp.is_set = FALSE;
70 prop[1].ah.is_set = TRUE;
71 prop[1].ah.integrity_algorithm = AUTH_HMAC_SHA1_96;
72 prop[1].ah.integrity_algorithm_key_size = 20;
73
74 /* ah and esp prop */
75 prop[2].esp.is_set = TRUE;
76 prop[2].esp.encryption_algorithm = ENCR_3DES;
77 prop[2].esp.encryption_algorithm_key_size = 16;
78 prop[2].ah.is_set = TRUE;
79 prop[2].ah.integrity_algorithm = AUTH_HMAC_MD5_96;
80 prop[2].ah.integrity_algorithm_key_size = 20;
81
82
83 sa_config->add_proposal(sa_config, &prop[0]);
84 sa_config->add_proposal(sa_config, &prop[1]);
85 sa_config->add_proposal(sa_config, &prop[2]);
86
87
88 count = sa_config->get_proposals(sa_config, spi, spi, &prop_result);
89 tester->assert_true(tester, (count == 3), "proposal count");
90 allocator_free(prop_result);
91
92
93
94 prop_result = sa_config->select_proposal(sa_config, spi, spi, &prop[1], 2);
95 tester->assert_true(tester, prop_result->esp.is_set == prop[1].esp.is_set, "esp.is_set");
96 tester->assert_true(tester, prop_result->ah.integrity_algorithm == prop[1].ah.integrity_algorithm, "ah.integrity_algorithm");
97 tester->assert_true(tester, prop_result->ah.integrity_algorithm_key_size == prop[1].ah.integrity_algorithm_key_size, "ah.integrity_algorithm_key_size");
98 tester->assert_true(tester, memcmp(prop_result->ah.spi, spi, 4) == 0, "spi");
99 allocator_free(prop_result);
100
101
102 /*
103 * test traffic selection getting and matching
104 *
105 */
106
107 /* define policies */
108
109 /* allow any tcp */
110 ts_policy[0] = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
111
112 /* allow udp on port 123 to ".122" */
113 ts_policy[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123);
114
115 /* allow udp on ports > 2000 in subnet ... */
116 ts_policy[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 65535);
117
118
119
120 /* define request and result */
121
122 /* udp on subnet:123, should be reduced to ".122" */
123 ts_request[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 123, "152.96.193.255", 123);
124 ts_reference[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123);
125
126 /* should be granted. */
127 ts_request[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000);
128 ts_reference[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000);
129
130 /* should be reduced to port 2000 - 3000. and range ".193.*" */
131 ts_request[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.191.0", 1000, "152.96.194.255", 3000);
132 ts_reference[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 3000);
133
134 /* icmp request, should be discarded */
135 ts_request[3] = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
136
137 sa_config->add_traffic_selector_initiator(sa_config, ts_policy[0]);
138 sa_config->add_traffic_selector_initiator(sa_config, ts_policy[1]);
139 sa_config->add_traffic_selector_initiator(sa_config, ts_policy[2]);
140
141 count = sa_config->get_traffic_selectors_initiator(sa_config, &ts_result);
142 tester->assert_true(tester, (count == 3), "ts get count");
143 ts_result[0]->destroy(ts_result[0]);
144 ts_result[0]->destroy(ts_result[1]);
145 ts_result[0]->destroy(ts_result[2]);
146 allocator_free(ts_result);
147
148 count = sa_config->select_traffic_selectors_initiator(sa_config, &ts_request[0], 4, &ts_result);
149 tester->assert_true(tester, (count == 3), "ts select count");
150
151
152 /* store and restore into ts payload, tricky tricky */
153 ts_payload = ts_payload_create_from_traffic_selectors(TRUE, ts_result, count);
154
155 /* destroy */
156 ts_result[0]->destroy(ts_result[0]);
157 ts_result[0]->destroy(ts_result[1]);
158 ts_result[0]->destroy(ts_result[2]);
159 allocator_free(ts_result);
160
161 /* get them again out of the payload */
162 count = ts_payload->get_traffic_selectors(ts_payload, &ts_result);
163 ts_payload->destroy(ts_payload);
164
165
166
167 int i;
168 for (i = 0; i<count; i++)
169 {
170 chunk_t fa_res = ts_result[i]->get_from_address(ts_result[i]);
171 chunk_t fa_ref = ts_reference[i]->get_from_address(ts_reference[i]);
172 chunk_t ta_res = ts_result[i]->get_to_address(ts_result[i]);
173 chunk_t ta_ref = ts_reference[i]->get_to_address(ts_reference[i]);
174 u_int16_t fp_res = ts_result[i]->get_from_port(ts_result[i]);
175 u_int16_t fp_ref = ts_reference[i]->get_from_port(ts_reference[i]);
176 u_int16_t tp_res = ts_result[i]->get_to_port(ts_result[i]);
177 u_int16_t tp_ref = ts_reference[i]->get_to_port(ts_reference[i]);
178
179
180 logger->log_chunk(logger, RAW, "from address result", &fa_res);
181 logger->log_chunk(logger, RAW, "from address reference", &fa_ref);
182 logger->log_chunk(logger, RAW, "to address result", &ta_res);
183 logger->log_chunk(logger, RAW, "to address reference", &ta_ref);
184 tester->assert_true(tester, fa_res.len == fa_ref.len, "from address len");
185 tester->assert_false(tester, memcmp(fa_res.ptr, fa_ref.ptr,fa_res.len), "from address value");
186 tester->assert_true(tester, ta_res.len == ta_ref.len, "to address len");
187 tester->assert_false(tester, memcmp(ta_res.ptr, ta_ref.ptr,ta_res.len), "to address value");
188
189 tester->assert_true(tester, fp_res == fp_ref, "from port");
190 tester->assert_true(tester, tp_res == tp_ref, "to port");
191
192 allocator_free(fa_res.ptr);
193 allocator_free(fa_ref.ptr);
194 allocator_free(ta_res.ptr);
195 allocator_free(ta_ref.ptr);
196 }
197
198
199 /* destroy */
200 ts_result[0]->destroy(ts_result[0]);
201 ts_result[0]->destroy(ts_result[1]);
202 ts_result[0]->destroy(ts_result[2]);
203 allocator_free(ts_result);
204
205 ts_policy[0]->destroy(ts_policy[0]);
206 ts_policy[1]->destroy(ts_policy[1]);
207 ts_policy[2]->destroy(ts_policy[2]);
208 ts_request[0]->destroy(ts_request[0]);
209 ts_reference[0]->destroy(ts_reference[0]);
210 ts_request[1]->destroy(ts_request[1]);
211 ts_reference[1]->destroy(ts_reference[1]);
212 ts_request[2]->destroy(ts_request[2]);
213 ts_reference[2]->destroy(ts_reference[2]);
214 ts_request[3]->destroy(ts_request[3]);
215
216 sa_config->destroy(sa_config);
217 }