denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

unit-tests: Test for rekeying if INVALID_KE_PAYLOAD notifies are received

Browse Source
This commit is contained in:
Tobias Brunner
2016-06-17 18:48:03 +02:00
parent 5ef033c53b
commit f97bac5594
1 changed files with 253 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/tests/suites/test_child_rekey.c
+253
View File
@@ -96,6 +96,94 @@ START_TEST(test_regular)
} }
END_TEST END_TEST
/**
* CHILD_SA rekey where the responder does not agree with the DH group selected
* by the initiator, either initiated by the original initiator or responder of
* the IKE_SA.
*/
START_TEST(test_regular_ke_invalid)
{
exchange_test_sa_conf_t conf = {
.initiator = {
.esp = "aes128-sha256-modp2048-modp3072",
},
.responder = {
.esp = "aes128-sha256-modp3072-modp2048",
},
};
ike_sa_t *a, *b;
uint32_t spi_a = _i+1, spi_b = 2-_i;
if (_i)
{ /* responder rekeys the CHILD_SA (SPI 2) */
exchange_test_helper->establish_sa(exchange_test_helper,
&b, &a, &conf);
}
else
{ /* initiator rekeys the CHILD_SA (SPI 1) */
exchange_test_helper->establish_sa(exchange_test_helper,
&a, &b, &conf);
}
initiate_rekey(a, spi_a);
/* this should never get called as this results in a successful rekeying */
assert_hook_not_called(child_updown);
/* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
assert_hook_not_called(child_rekey);
assert_notify(IN, REKEY_SA);
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, spi_b, CHILD_INSTALLED);
assert_child_sa_count(b, 1);
assert_hook();
/* <-- CREATE_CHILD_SA { N(INVAL_KE) } */
assert_hook_not_called(child_rekey);
assert_single_notify(IN, INVALID_KE_PAYLOAD);
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, spi_a, CHILD_REKEYING);
assert_child_sa_count(a, 1);
assert_hook();
/* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
assert_hook_called(child_rekey);
assert_notify(IN, REKEY_SA);
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, spi_b, CHILD_REKEYED);
assert_child_sa_state(b, 6, CHILD_INSTALLED);
assert_hook();
/* <-- CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } */
assert_hook_called(child_rekey);
assert_no_notify(IN, REKEY_SA);
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, spi_a, CHILD_DELETING);
assert_child_sa_state(a, 5, CHILD_INSTALLED);
assert_hook();
/* INFORMATIONAL { D } --> */
assert_hook_not_called(child_rekey);
assert_single_payload(IN, PLV2_DELETE);
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, 6, CHILD_INSTALLED);
assert_child_sa_count(b, 1);
assert_hook();
/* <-- INFORMATIONAL { D } */
assert_hook_not_called(child_rekey);
assert_single_payload(IN, PLV2_DELETE);
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, 5, CHILD_INSTALLED);
assert_child_sa_count(a, 1);
assert_hook();
/* child_updown */
assert_hook();
call_ikesa(a, destroy);
call_ikesa(b, destroy);
}
END_TEST
/** /**
* Both peers initiate the CHILD_SA reekying concurrently and should handle * Both peers initiate the CHILD_SA reekying concurrently and should handle
* the collision properly depending on the nonces. * the collision properly depending on the nonces.
@@ -216,6 +304,169 @@ START_TEST(test_collision)
} }
END_TEST END_TEST
/**
* Both peers initiate the CHILD_SA reekying concurrently but the proposed DH
* groups are not the same after handling the INVALID_KE_PAYLOAD they should
* still handle the collision properly depending on the nonces.
*/
START_TEST(test_collision_ke_invalid)
{
exchange_test_sa_conf_t conf = {
.initiator = {
.esp = "aes128-sha256-modp2048-modp3072",
},
.responder = {
.esp = "aes128-sha256-modp3072-modp2048",
},
};
ike_sa_t *a, *b;
exchange_test_helper->establish_sa(exchange_test_helper,
&a, &b, &conf);
/* Eight nonces and SPIs are needed (SPI 1 and 2 are used for the initial
* CHILD_SA):
* N1/3 -----\ /----- N2/4
* \--/-----> N3/5
* N4/6 <-------/ /---- INVAL_KE
* INVAL_KE -----\ /
* <-----\--/
* N5/7 -----\ \------->
* \ /---- N6/8
* \--/----> N7/9
* N8/10 <--------/ /---- ...
* ... ------\
*
* We test this four times, each time a different nonce is the lowest.
*/
struct {
/* Nonces used at each point */
u_char nonces[4];
/* SPIs of the deleted CHILD_SA (either redundant or replaced) */
uint32_t spi_del_a, spi_del_b;
/* SPIs of the kept CHILD_SA */
uint32_t spi_a, spi_b;
} data[] = {
{ { 0x00, 0xFF, 0xFF, 0xFF }, 7, 2,10, 8 },
{ { 0xFF, 0x00, 0xFF, 0xFF }, 1, 8, 7, 9 },
{ { 0xFF, 0xFF, 0x00, 0xFF }, 7, 2,10, 8 },
{ { 0xFF, 0xFF, 0xFF, 0x00 }, 1, 8, 7, 9 },
};
initiate_rekey(a, 1);
initiate_rekey(b, 2);
/* this should never get called as this results in a successful rekeying */
assert_hook_not_called(child_updown);
/* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
assert_hook_not_called(child_rekey);
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, 2, CHILD_REKEYING);
assert_child_sa_count(b, 1);
assert_hook();
/* <-- CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } */
assert_hook_not_called(child_rekey);
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, 1, CHILD_REKEYING);
assert_child_sa_count(a, 1);
assert_hook();
/* <-- CREATE_CHILD_SA { N(INVAL_KE) } */
exchange_test_helper->nonce_first_byte = data[_i].nonces[0];
assert_hook_not_called(child_rekey);
assert_single_notify(IN, INVALID_KE_PAYLOAD);
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, 1, CHILD_REKEYING);
assert_child_sa_count(a, 1);
assert_hook();
/* CREATE_CHILD_SA { N(INVAL_KE) } --> */
exchange_test_helper->nonce_first_byte = data[_i].nonces[1];
assert_hook_not_called(child_rekey);
assert_single_notify(IN, INVALID_KE_PAYLOAD);
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, 2, CHILD_REKEYING);
assert_child_sa_count(b, 1);
assert_hook();
/* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
exchange_test_helper->nonce_first_byte = data[_i].nonces[2];
assert_hook_rekey(child_rekey, 2, 9);
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, 2, CHILD_REKEYED);
assert_child_sa_state(b, 9, CHILD_INSTALLED);
assert_hook();
/* <-- CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } */
exchange_test_helper->nonce_first_byte = data[_i].nonces[3];
assert_hook_rekey(child_rekey, 1, 10);
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, 1, CHILD_REKEYED);
assert_child_sa_state(a,10, CHILD_INSTALLED);
assert_hook();
/* <-- CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } */
if (data[_i].spi_del_a == 1)
{ /* currently we call this again if we keep our own replacement as we
* already called it above */
assert_hook_rekey(child_rekey, 1, data[_i].spi_a);
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_hook();
}
else
{
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
}
assert_child_sa_state(a, data[_i].spi_del_a, CHILD_DELETING);
assert_child_sa_state(a, data[_i].spi_del_b, CHILD_REKEYED);
assert_child_sa_state(a, data[_i].spi_a, CHILD_INSTALLED);
/* CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } --> */
if (data[_i].spi_del_b == 2)
{
assert_hook_rekey(child_rekey, 2, data[_i].spi_b);
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_hook();
}
else
{
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
}
assert_child_sa_state(b, data[_i].spi_del_b, CHILD_DELETING);
assert_child_sa_state(b, data[_i].spi_del_a, CHILD_REKEYED);
assert_child_sa_state(b, data[_i].spi_b, CHILD_INSTALLED);
/* we don't expect this hook to get called anymore */
assert_hook_not_called(child_rekey);
/* INFORMATIONAL { D } --> */
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, data[_i].spi_del_b, CHILD_DELETING);
assert_child_sa_state(b, data[_i].spi_b, CHILD_INSTALLED);
assert_child_sa_count(b, 2);
/* <-- INFORMATIONAL { D } */
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, data[_i].spi_del_a, CHILD_DELETING);
assert_child_sa_state(a, data[_i].spi_a, CHILD_INSTALLED);
assert_child_sa_count(a, 2);
/* <-- INFORMATIONAL { D } */
exchange_test_helper->process_message(exchange_test_helper, a, NULL);
assert_child_sa_state(a, data[_i].spi_a, CHILD_INSTALLED);
assert_child_sa_count(a, 1);
/* INFORMATIONAL { D } --> */
exchange_test_helper->process_message(exchange_test_helper, b, NULL);
assert_child_sa_state(b, data[_i].spi_b, CHILD_INSTALLED);
assert_child_sa_count(b, 1);
/* child_rekey/child_updown */
assert_hook();
assert_hook();
assert_sa_idle(a);
assert_sa_idle(b);
call_ikesa(a, destroy);
call_ikesa(b, destroy);
}
END_TEST
/** /**
* One of the hosts initiates a DELETE of the CHILD_SA the other peer is * One of the hosts initiates a DELETE of the CHILD_SA the other peer is
* concurrently trying to rekey. * concurrently trying to rekey.
@@ -505,10 +756,12 @@ Suite *child_rekey_suite_create()
tc = tcase_create("regular"); tc = tcase_create("regular");
tcase_add_loop_test(tc, test_regular, 0, 2); tcase_add_loop_test(tc, test_regular, 0, 2);
tcase_add_loop_test(tc, test_regular_ke_invalid, 0, 2);
suite_add_tcase(s, tc); suite_add_tcase(s, tc);
tc = tcase_create("collisions rekey"); tc = tcase_create("collisions rekey");
tcase_add_loop_test(tc, test_collision, 0, 4); tcase_add_loop_test(tc, test_collision, 0, 4);
tcase_add_loop_test(tc, test_collision_ke_invalid, 0, 4);
suite_add_tcase(s, tc); suite_add_tcase(s, tc);
tc = tcase_create("collisions delete"); tc = tcase_create("collisions delete");