unit-tests: Add tests for CHILD_SA rekeying/deletion collisions
authorTobias Brunner <tobias@strongswan.org>
Sat, 21 May 2016 10:22:06 +0000 (12:22 +0200)
committerTobias Brunner <tobias@strongswan.org>
Fri, 17 Jun 2016 16:48:03 +0000 (18:48 +0200)
src/libcharon/tests/suites/test_child_rekey.c

index 2ed1f89..4fd4807 100644 (file)
@@ -18,6 +18,7 @@
 #include <daemon.h>
 #include <tests/utils/exchange_test_helper.h>
 #include <tests/utils/exchange_test_asserts.h>
+#include <tests/utils/job_asserts.h>
 #include <tests/utils/sa_asserts.h>
 
 /**
@@ -215,6 +216,286 @@ START_TEST(test_collision)
 }
 END_TEST
 
+/**
+ * One of the hosts initiates a DELETE of the CHILD_SA the other peer is
+ * concurrently trying to rekey.
+ *
+ *            rekey ----\       /---- delete
+ *                       \-----/----> detect collision
+ * detect collision <---------/ /---- TEMP_FAIL
+ *           delete ----\      /
+ *                       \----/----->
+ *  aborts rekeying <--------/
+ */
+START_TEST(test_collision_delete)
+{
+       ike_sa_t *a, *b;
+       uint32_t spi_a = _i+1, spi_b = 2-_i;
+
+       if (_i)
+       {       /* responder rekeys the CHILD_SA (SPI 2) */
+               exchange_test_helper->establish_sa(exchange_test_helper,
+                                                                                  &b, &a);
+       }
+       else
+       {       /* initiator rekeys the CHILD_SA (SPI 1) */
+               exchange_test_helper->establish_sa(exchange_test_helper,
+                                                                                  &a, &b);
+       }
+       initiate_rekey(a, spi_a);
+       call_ikesa(b, delete_child_sa, PROTO_ESP, spi_b, FALSE);
+       assert_child_sa_state(b, spi_b, CHILD_DELETING);
+
+       /* this should never get called as there is no successful rekeying on
+        * either side */
+       assert_hook_not_called(child_rekey);
+
+       /* RFC 7296, 2.25.1: If a peer receives a request to rekey a CHILD_SA that
+        * it is currently trying to close, it SHOULD reply with TEMPORARY_FAILURE.
+        */
+
+       /* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
+       assert_hook_not_called(child_updown);
+       assert_notify(IN, REKEY_SA);
+       assert_single_notify(OUT, TEMPORARY_FAILURE);
+       exchange_test_helper->process_message(exchange_test_helper, b, NULL);
+       assert_child_sa_state(b, spi_b, CHILD_DELETING);
+       assert_hook();
+
+       /* RFC 7296, 2.25.1: If a peer receives a request to delete a CHILD_SA that
+        * it is currently trying to rekey, it SHOULD reply as usual, with a DELETE
+        * payload.
+        */
+
+       /* <-- INFORMATIONAL { D } */
+       assert_hook_updown(child_updown, FALSE);
+       assert_single_payload(IN, PLV2_DELETE);
+       assert_single_payload(OUT, PLV2_DELETE);
+       exchange_test_helper->process_message(exchange_test_helper, a, NULL);
+       assert_child_sa_count(a, 0);
+       assert_hook();
+
+       /* <-- CREATE_CHILD_SA { N(TEMP_FAIL) } */
+       assert_hook_not_called(child_updown);
+       /* we don't expect a job to retry the rekeying */
+       assert_no_jobs_scheduled();
+       exchange_test_helper->process_message(exchange_test_helper, a, NULL);
+       assert_scheduler();
+       assert_hook();
+
+       /* INFORMATIONAL { D } --> */
+       assert_hook_updown(child_updown, FALSE);
+       exchange_test_helper->process_message(exchange_test_helper, b, NULL);
+       assert_child_sa_count(b, 0);
+       assert_hook();
+
+       /* child_rekey */
+       assert_hook();
+
+       assert_sa_idle(a);
+       assert_sa_idle(b);
+
+       call_ikesa(a, destroy);
+       call_ikesa(b, destroy);
+}
+END_TEST
+
+/**
+ * One of the hosts initiates a DELETE of the CHILD_SA the other peer is
+ * concurrently trying to rekey.  However, the delete request is delayed or
+ * dropped, so the peer doing the rekeying is unaware of the collision.
+ *
+ *            rekey ----\       /---- delete
+ *                       \-----/----> detect collision
+ *       reschedule <---------/------ TEMP_FAIL
+ *                  <--------/
+ *           delete ---------------->
+ *
+ * The job will not find the SA to retry rekeying.
+ */
+START_TEST(test_collision_delete_drop_delete)
+{
+       ike_sa_t *a, *b;
+       message_t *msg;
+       uint32_t spi_a = _i+1, spi_b = 2-_i;
+
+       if (_i)
+       {       /* responder rekeys the CHILD_SA (SPI 2) */
+               exchange_test_helper->establish_sa(exchange_test_helper,
+                                                                                  &b, &a);
+       }
+       else
+       {       /* initiator rekeys the CHILD_SA (SPI 1) */
+               exchange_test_helper->establish_sa(exchange_test_helper,
+                                                                                  &a, &b);
+       }
+       initiate_rekey(a, spi_a);
+       call_ikesa(b, delete_child_sa, PROTO_ESP, spi_b, FALSE);
+       assert_child_sa_state(b, spi_b, CHILD_DELETING);
+
+       /* this should never get called as there is no successful rekeying on
+        * either side */
+       assert_hook_not_called(child_rekey);
+
+       /* RFC 7296, 2.25.1: If a peer receives a request to rekey a CHILD_SA that
+        * it is currently trying to close, it SHOULD reply with TEMPORARY_FAILURE.
+        */
+
+       /* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
+       assert_hook_not_called(child_updown);
+       assert_notify(IN, REKEY_SA);
+       assert_single_notify(OUT, TEMPORARY_FAILURE);
+       exchange_test_helper->process_message(exchange_test_helper, b, NULL);
+       assert_child_sa_state(b, spi_b, CHILD_DELETING);
+       assert_hook();
+
+       /* delay the DELETE request */
+       msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender);
+
+       /* <-- CREATE_CHILD_SA { N(TEMP_FAIL) } */
+       assert_hook_not_called(child_updown);
+       /* we expect a job to retry the rekeying is scheduled */
+       assert_jobs_scheduled(1);
+       exchange_test_helper->process_message(exchange_test_helper, a, NULL);
+       assert_child_sa_state(a, spi_a, CHILD_INSTALLED);
+       assert_scheduler();
+       assert_hook();
+
+       /* <-- INFORMATIONAL { D } (delayed) */
+       assert_hook_updown(child_updown, FALSE);
+       assert_single_payload(IN, PLV2_DELETE);
+       assert_single_payload(OUT, PLV2_DELETE);
+       exchange_test_helper->process_message(exchange_test_helper, a, msg);
+       assert_child_sa_count(a, 0);
+       assert_hook();
+
+       /* INFORMATIONAL { D } --> */
+       assert_hook_updown(child_updown, FALSE);
+       exchange_test_helper->process_message(exchange_test_helper, b, NULL);
+       assert_child_sa_count(b, 0);
+       assert_hook();
+
+       /* child_rekey */
+       assert_hook();
+
+       assert_sa_idle(a);
+       assert_sa_idle(b);
+
+       call_ikesa(a, destroy);
+       call_ikesa(b, destroy);
+}
+END_TEST
+
+/**
+ * One of the hosts initiates a DELETE of the CHILD_SA the other peer is
+ * concurrently trying to rekey.  However, the rekey request is delayed or
+ * dropped, so the peer doing the deleting is unaware of the collision.
+ *
+ *            rekey ----\       /---- delete
+ * detect collision <----\-----/
+ *           delete ------\--------->
+ *                         \-------->
+ *                              /---- CHILD_SA_NOT_FOUND
+ *  aborts rekeying <----------/
+ */
+ START_TEST(test_collision_delete_drop_rekey)
+{
+       ike_sa_t *a, *b;
+       message_t *msg;
+       uint32_t spi_a = _i+1, spi_b = 2-_i;
+
+       if (_i)
+       {       /* responder rekeys the CHILD_SA (SPI 2) */
+               exchange_test_helper->establish_sa(exchange_test_helper,
+                                                                                  &b, &a);
+       }
+       else
+       {       /* initiator rekeys the CHILD_SA (SPI 1) */
+               exchange_test_helper->establish_sa(exchange_test_helper,
+                                                                                  &a, &b);
+       }
+       initiate_rekey(a, spi_a);
+       call_ikesa(b, delete_child_sa, PROTO_ESP, spi_b, FALSE);
+       assert_child_sa_state(b, spi_b, CHILD_DELETING);
+
+       /* this should never get called as there is no successful rekeying on
+        * either side */
+       assert_hook_not_called(child_rekey);
+
+       /* delay the CREAE_CHILD_SA request */
+       msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender);
+
+       /* RFC 7296, 2.25.1: If a peer receives a request to delete a CHILD_SA that
+        * it is currently trying to rekey, it SHOULD reply as usual, with a DELETE
+        * payload.
+        */
+
+       /* <-- INFORMATIONAL { D } */
+       assert_hook_updown(child_updown, FALSE);
+       assert_single_payload(IN, PLV2_DELETE);
+       assert_single_payload(OUT, PLV2_DELETE);
+       exchange_test_helper->process_message(exchange_test_helper, a, NULL);
+       assert_child_sa_count(a, 0);
+       assert_hook();
+
+       /* INFORMATIONAL { D } --> */
+       assert_hook_updown(child_updown, FALSE);
+       exchange_test_helper->process_message(exchange_test_helper, b, NULL);
+       assert_child_sa_count(b, 0);
+       assert_hook();
+
+       /* RFC 7296, 2.25.1: If a peer receives a to rekey a Child SA that does not
+        * exist, it SHOULD reply with CHILD_SA_NOT_FOUND.
+        */
+
+       /* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> (delayed) */
+       assert_hook_not_called(child_updown);
+       assert_notify(IN, REKEY_SA);
+       assert_single_notify(OUT, CHILD_SA_NOT_FOUND);
+       exchange_test_helper->process_message(exchange_test_helper, b, msg);
+       assert_hook();
+
+       /* <-- CREATE_CHILD_SA { N(NO_CHILD_SA) } */
+       assert_hook_not_called(child_updown);
+       /* no jobs or tasks should get scheduled/queued */
+       assert_no_jobs_scheduled();
+       exchange_test_helper->process_message(exchange_test_helper, a, NULL);
+       assert_scheduler();
+       assert_hook();
+
+       /* child_rekey */
+       assert_hook();
+
+       assert_sa_idle(a);
+       assert_sa_idle(b);
+
+       call_ikesa(a, destroy);
+       call_ikesa(b, destroy);
+}
+END_TEST
+
+/**
+ * FIXME: Not sure what we can do about the following:
+ *
+ * One of the hosts initiates a rekeying of a CHILD_SA and after responding to
+ * it the other peer deletes the new SA.  However, the rekey response is
+ * delayed or dropped, so the peer doing the rekeying receives a delete for an
+ * unknown CHILD_SA and then has a rekeyed CHILD_SA that should not exist.
+ *
+ *            rekey ---------------->
+ *                              /---- rekey
+ *       unknown SA <----------/----- delete new SA
+ *                  ----------/----->
+ *                  <--------/
+ *
+ * The peers' states are now out of sync.
+ *
+ * Perhaps the rekey initiator could keep track of deletes for non-existing SAs
+ * while rekeying and then check against the SPIs when handling the
+ * CREATE_CHILD_SA response.
+ */
+
+
 Suite *child_rekey_suite_create()
 {
        Suite *s;
@@ -226,9 +507,15 @@ Suite *child_rekey_suite_create()
        tcase_add_loop_test(tc, test_regular, 0, 2);
        suite_add_tcase(s, tc);
 
-       tc = tcase_create("collisions");
+       tc = tcase_create("collisions rekey");
        tcase_add_loop_test(tc, test_collision, 0, 4);
        suite_add_tcase(s, tc);
 
+       tc = tcase_create("collisions delete");
+       tcase_add_loop_test(tc, test_collision_delete, 0, 2);
+       tcase_add_loop_test(tc, test_collision_delete_drop_delete, 0, 2);
+       tcase_add_loop_test(tc, test_collision_delete_drop_rekey, 0, 2);
+       suite_add_tcase(s, tc);
+
        return s;
 }