- identification_t supports now almost all id types
[strongswan.git] / Source / testing / policy_test.c
1 /**
2 * @file policy_test.c
3 *
4 * @brief Tests for the policy_t class.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "policy_test.h"
24
25 #include <daemon.h>
26 #include <config/policy.h>
27 #include <config/traffic_selector.h>
28 #include <utils/logger.h>
29 #include <encoding/payloads/ts_payload.h>
30
31
32 /**
33 * Described in header.
34 */
35 void test_policy(protected_tester_t *tester)
36 {
37 policy_t *policy;
38 // traffic_selector_t *ts;
39 // linked_list_t *ts_stored, *ts_supplied, *ts_selected, *ts_expected;
40 proposal_t *proposal1, *proposal2, *proposal3, *proposal_sel;
41 linked_list_t *proposals_list;
42 iterator_t *iterator;
43 logger_t *logger;
44 identification_t *alice, *bob;
45
46 logger = logger_manager->get_logger(logger_manager, TESTER);
47 logger->disable_level(logger, FULL);
48
49 alice = identification_create_from_string("152.96.193.131");
50 bob = identification_create_from_string("152.96.193.130");
51 policy = policy_create(alice, bob);
52
53 tester->assert_true(tester, (policy != NULL), "policy construction");
54
55
56 /*
57 * test proposal getting and selection
58 *
59 */
60
61 /* esp only prop */
62 proposal1 = proposal_create(1);
63 proposal1->add_algorithm(proposal1, PROTO_ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
64
65 /* ah only prop */
66 proposal2 = proposal_create(2);
67 proposal2->add_algorithm(proposal2, PROTO_AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
68
69 /* ah and esp prop */
70 proposal3 = proposal_create(3);
71 proposal3->add_algorithm(proposal3, PROTO_ESP, ENCRYPTION_ALGORITHM, ENCR_3DES, 16);
72 proposal3->add_algorithm(proposal3, PROTO_AH, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
73
74
75 policy->add_proposal(policy, proposal1);
76 policy->add_proposal(policy, proposal2);
77 policy->add_proposal(policy, proposal3);
78
79
80 proposals_list = policy->get_proposals(policy);
81 tester->assert_true(tester, (proposals_list->get_count(proposals_list) == 3), "proposal count");
82
83
84 proposals_list = linked_list_create();
85 proposal1 = proposal_create(1);
86 proposal1->add_algorithm(proposal1, PROTO_ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 32);
87 proposal2 = proposal_create(2);
88 proposal2->add_algorithm(proposal2, PROTO_ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
89 proposal2->add_algorithm(proposal2, PROTO_ESP, ENCRYPTION_ALGORITHM, ENCR_3DES, 16);
90 proposal2->add_algorithm(proposal2, PROTO_ESP, ENCRYPTION_ALGORITHM, ENCR_BLOWFISH, 0);
91 proposal2->add_algorithm(proposal2, PROTO_AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
92 proposal2->add_algorithm(proposal2, PROTO_AH, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
93
94 proposals_list->insert_last(proposals_list, proposal1);
95 proposals_list->insert_last(proposals_list, proposal2);
96
97 proposal_sel = policy->select_proposal(policy, proposals_list);
98 tester->assert_false(tester, proposal_sel == NULL, "proposal select");
99 /* check ESP encryption algo */
100 iterator = proposal_sel->create_algorithm_iterator(proposal_sel, PROTO_ESP, ENCRYPTION_ALGORITHM);
101 tester->assert_false(tester, iterator == NULL, "algorithm select ESP");
102 while (iterator->has_next(iterator))
103 {
104 algorithm_t *algo;
105 iterator->current(iterator, (void**)&algo);
106 tester->assert_true(tester, algo->algorithm == ENCR_3DES, "ESP encryption algo");
107 tester->assert_true(tester, algo->key_size == 16, "ESP encryption keysize");
108 }
109 iterator->destroy(iterator);
110 iterator = proposal_sel->create_algorithm_iterator(proposal_sel, PROTO_AH, INTEGRITY_ALGORITHM);
111 /* check AH integrity algo */
112 tester->assert_false(tester, iterator == NULL, "algorithm select AH");
113 while (iterator->has_next(iterator))
114 {
115 algorithm_t *algo;
116 iterator->current(iterator, (void**)&algo);
117 tester->assert_true(tester, algo->algorithm == AUTH_HMAC_MD5_96, "ESP encryption algo");
118 tester->assert_true(tester, algo->key_size == 20, "ESP encryption keysize");
119 }
120 iterator->destroy(iterator);
121
122 proposal_sel->destroy(proposal_sel);
123
124 /* cleanup */
125 proposal1->destroy(proposal1);
126 proposal1->destroy(proposal2);
127 proposals_list->destroy(proposals_list);
128
129 // /*
130 // * test traffic selection getting and matching
131 // *
132 // */
133 //
134 // ts_stored = linked_list_create();
135 //
136 // /* allow any tcp */
137 // ts = traffic_selector_create_from_string(6, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
138 // ts_stored->insert_last(ts_stored, (void*)ts);
139 // /* allow udp on port 123 to ".122" */
140 // ts = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123);
141 // ts_stored->insert_last(ts_stored, (void*)ts);
142 // /* allow udp on ports > 2000 in subnet ... */
143 // ts = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 65535);
144 // ts_stored->insert_last(ts_stored, (void*)ts);
145 //
146 //
147 //
148 // /* define request and result */
149 //
150 // /* udp on subnet:123, should be reduced to ".122" */
151 // ts = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 123, "152.96.193.255", 123);
152 // ts_supplied->insert_last(ts_supplied, (void*)ts);
153 // ts_reference[0] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.122", 123, "152.96.193.122", 123);
154 //
155 // /* should be granted. */
156 // ts_request[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000);
157 // ts_reference[1] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 2000);
158 //
159 // /* should be reduced to port 2000 - 3000. and range ".193.*" */
160 // ts_request[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.191.0", 1000, "152.96.194.255", 3000);
161 // ts_reference[2] = traffic_selector_create_from_string(7, TS_IPV4_ADDR_RANGE, "152.96.193.0", 2000, "152.96.193.255", 3000);
162 //
163 // /* icmp request, should be discarded */
164 // ts_request[3] = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
165 //
166 // policy->add_my_traffic_selector(policy, ts_policy[0]);
167 // policy->add_my_traffic_selector(policy, ts_policy[1]);
168 // policy->add_my_traffic_selector(policy, ts_policy[2]);
169 //
170 // count = policy->get_my_traffic_selectors(policy, &ts_result);
171 // tester->assert_true(tester, (count == 3), "ts get count");
172 // ts_result[0]->destroy(ts_result[0]);
173 // ts_result[0]->destroy(ts_result[1]);
174 // ts_result[0]->destroy(ts_result[2]);
175 // free(ts_result);
176 //
177 // count = policy->select_my_traffic_selectors(policy, &ts_request[0], 4, &ts_result);
178 // tester->assert_true(tester, (count == 3), "ts select count");
179 //
180 //
181 // /* store and restore into ts payload, tricky tricky */
182 // ts_payload = ts_payload_create_from_traffic_selectors(TRUE, ts_result, count);
183 //
184 // /* destroy */
185 // ts_result[0]->destroy(ts_result[0]);
186 // ts_result[0]->destroy(ts_result[1]);
187 // ts_result[0]->destroy(ts_result[2]);
188 // free(ts_result);
189 //
190 // /* get them again out of the payload */
191 // count = ts_payload->get_traffic_selectors(ts_payload, &ts_result);
192 // ts_payload->destroy(ts_payload);
193 //
194 //
195 //
196 // int i;
197 // for (i = 0; i<count; i++)
198 // {
199 // chunk_t fa_res = ts_result[i]->get_from_address(ts_result[i]);
200 // chunk_t fa_ref = ts_reference[i]->get_from_address(ts_reference[i]);
201 // chunk_t ta_res = ts_result[i]->get_to_address(ts_result[i]);
202 // chunk_t ta_ref = ts_reference[i]->get_to_address(ts_reference[i]);
203 // u_int16_t fp_res = ts_result[i]->get_from_port(ts_result[i]);
204 // u_int16_t fp_ref = ts_reference[i]->get_from_port(ts_reference[i]);
205 // u_int16_t tp_res = ts_result[i]->get_to_port(ts_result[i]);
206 // u_int16_t tp_ref = ts_reference[i]->get_to_port(ts_reference[i]);
207 //
208 //
209 // logger->log_chunk(logger, RAW, "from address result", fa_res);
210 // logger->log_chunk(logger, RAW, "from address reference", fa_ref);
211 // logger->log_chunk(logger, RAW, "to address result", ta_res);
212 // logger->log_chunk(logger, RAW, "to address reference", ta_ref);
213 // tester->assert_true(tester, fa_res.len == fa_ref.len, "from address len");
214 // tester->assert_false(tester, memcmp(fa_res.ptr, fa_ref.ptr,fa_res.len), "from address value");
215 // tester->assert_true(tester, ta_res.len == ta_ref.len, "to address len");
216 // tester->assert_false(tester, memcmp(ta_res.ptr, ta_ref.ptr,ta_res.len), "to address value");
217 //
218 // tester->assert_true(tester, fp_res == fp_ref, "from port");
219 // tester->assert_true(tester, tp_res == tp_ref, "to port");
220 //
221 // free(fa_res.ptr);
222 // free(fa_ref.ptr);
223 // free(ta_res.ptr);
224 // free(ta_ref.ptr);
225 // }
226 //
227 //
228 // /* destroy */
229 // ts_result[0]->destroy(ts_result[0]);
230 // ts_result[0]->destroy(ts_result[1]);
231 // ts_result[0]->destroy(ts_result[2]);
232 // free(ts_result);
233 //
234 // ts_policy[0]->destroy(ts_policy[0]);
235 // ts_policy[1]->destroy(ts_policy[1]);
236 // ts_policy[2]->destroy(ts_policy[2]);
237 // ts_request[0]->destroy(ts_request[0]);
238 // ts_reference[0]->destroy(ts_reference[0]);
239 // ts_request[1]->destroy(ts_request[1]);
240 // ts_reference[1]->destroy(ts_reference[1]);
241 // ts_request[2]->destroy(ts_request[2]);
242 // ts_reference[2]->destroy(ts_reference[2]);
243 // ts_request[3]->destroy(ts_request[3]);
244
245 policy->destroy(policy);
246 }