source: rtems-libbsd/ipsec-tools/src/libipsec/test-policy.c @ b376ae1

55-freebsd-126-freebsd-12
Last change on this file since b376ae1 was b376ae1, checked in by Christian Mauderer <christian.mauderer@…>, on 05/03/18 at 12:15:11

ipsec-tools: Port libipsec, setkey and racoon.

Note that this replaces the libipsec from FreeBSD with the one provided
by ipsec-tools.
  • Property mode set to 100644
File size: 8.0 KB
Line 
1#include <machine/rtems-bsd-user-space.h>
2
3/*      $NetBSD: test-policy.c,v 1.4 2006/09/09 16:22:09 manu Exp $     */
4
5/*      $KAME: test-policy.c,v 1.16 2003/08/26 03:24:08 itojun Exp $    */
6
7/*
8 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the project nor the names of its contributors
20 *    may be used to endorse or promote products derived from this software
21 *    without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36#include <sys/types.h>
37#include <sys/param.h>
38#include <sys/socket.h>
39
40#include <netinet/in.h>
41#include <net/pfkeyv2.h>
42#include <netinet/ipsec.h>
43
44#include <stdio.h>
45#include <stdlib.h>
46#include <unistd.h>
47#include <string.h>
48#include <errno.h>
49#include <err.h>
50
51#include "libpfkey.h"
52
53struct req_t {
54        int result;     /* expected result; 0:ok 1:ng */
55        char *str;
56#ifndef __rtems__
57} reqs[] = {
58#else /* __rtems__ */
59};
60
61static const struct req_t reqs[] = {
62#endif /* __rtems__ */
63{ 0, "out ipsec" },
64{ 1, "must_error" },
65{ 1, "in ipsec must_error" },
66{ 1, "out ipsec esp/must_error" },
67{ 1, "out discard" },
68{ 1, "out none" },
69{ 0, "in entrust" },
70{ 0, "out entrust" },
71{ 1, "out ipsec esp" },
72{ 0, "in ipsec ah/transport" },
73{ 1, "in ipsec ah/tunnel" },
74{ 0, "out ipsec ah/transport/" },
75{ 1, "out ipsec ah/tunnel/" },
76{ 0, "in ipsec esp / transport / 10.0.0.1-10.0.0.2" },
77{ 0, "in ipsec esp/tunnel/::1-::2" },
78{ 1, "in ipsec esp/tunnel/10.0.0.1-::2" },
79{ 0, "in ipsec esp/tunnel/::1-::2/require" },
80{ 0, "out ipsec ah/transport//use" },
81{ 1, "out ipsec ah/transport esp/use" },
82{ 1, "in ipsec ah/transport esp/tunnel" },
83{ 0, "in ipsec ah/transport esp/tunnel/::1-::1" },
84{ 0, "in ipsec
85        ah / transport
86        esp / tunnel / ::1-::2" },
87{ 0, "out ipsec
88        ah/transport/::1-::2 esp/tunnel/::3-::4/use ah/transport/::5-::6/require
89        ah/transport/::1-::2 esp/tunnel/::3-::4/use ah/transport/::5-::6/require
90        ah/transport/::1-::2 esp/tunnel/::3-::4/use ah/transport/::5-::6/require
91        " },
92{ 0, "out ipsec esp/transport/fec0::10-fec0::11/use" },
93};
94
95int test1 __P((void));
96int test1sub1 __P((struct req_t *));
97int test1sub2 __P((char *, int));
98int test2 __P((void));
99int test2sub __P((int));
100
101int
102main(ac, av)
103        int ac;
104        char **av;
105{
106        test1();
107        test2();
108
109        exit(0);
110}
111
112int
113test1()
114{
115        int i;
116        int result;
117
118        printf("TEST1\n");
119        for (i = 0; i < sizeof(reqs)/sizeof(reqs[0]); i++) {
120                printf("#%d [%s]\n", i + 1, reqs[i].str);
121
122                result = test1sub1(&reqs[i]);
123                if (result == 0 && reqs[i].result == 1) {
124                        warnx("ERROR: expecting failure.");
125                } else if (result == 1 && reqs[i].result == 0) {
126                        warnx("ERROR: expecting success.");
127                }
128        }
129
130        return 0;
131}
132
133int
134test1sub1(req)
135#ifndef __rtems__
136        struct req_t *req;
137#else /* __rtems__ */
138        const struct req_t *req;
139#endif /* __rtems__ */
140{
141        char *buf;
142
143        buf = ipsec_set_policy(req->str, strlen(req->str));
144        if (buf == NULL) {
145                printf("ipsec_set_policy: %s\n", ipsec_strerror());
146                return 1;
147        }
148
149        if (test1sub2(buf, PF_INET) != 0
150         || test1sub2(buf, PF_INET6) != 0) {
151                free(buf);
152                return 1;
153        }
154#if 0
155        kdebug_sadb_x_policy((struct sadb_ext *)buf);
156#endif
157
158        free(buf);
159        return 0;
160}
161
162int
163test1sub2(policy, family)
164        char *policy;
165        int family;
166{
167        int so;
168        int proto = 0, optname = 0;
169        int len;
170        char getbuf[1024];
171
172        switch (family) {
173        case PF_INET:
174                proto = IPPROTO_IP;
175                optname = IP_IPSEC_POLICY;
176                break;
177        case PF_INET6:
178                proto = IPPROTO_IPV6;
179                optname = IPV6_IPSEC_POLICY;
180                break;
181        }
182
183        if ((so = socket(family, SOCK_DGRAM, 0)) < 0)
184                err(1, "socket");
185
186        len = ipsec_get_policylen(policy);
187#if 0
188        printf("\tsetlen:%d\n", len);
189#endif
190
191        if (setsockopt(so, proto, optname, policy, len) < 0) {
192                printf("fail to set sockopt; %s\n", strerror(errno));
193                close(so);
194                return 1;
195        }
196
197        memset(getbuf, 0, sizeof(getbuf));
198        memcpy(getbuf, policy, sizeof(struct sadb_x_policy));
199        if (getsockopt(so, proto, optname, getbuf, &len) < 0) {
200                printf("fail to get sockopt; %s\n", strerror(errno));
201                close(so);
202                return 1;
203        }
204
205    {
206        char *buf = NULL;
207
208#if 0
209        printf("\tgetlen:%d\n", len);
210#endif
211
212        if ((buf = ipsec_dump_policy(getbuf, NULL)) == NULL) {
213                printf("%s\n", ipsec_strerror());
214                close(so);
215                return 1;
216        }
217#if 0
218        printf("\t[%s]\n", buf);
219#endif
220        free(buf);
221    }
222
223        close (so);
224        return 0;
225}
226
227char addr[] = {
228        28, 28, 0, 0,
229        0, 0, 0, 0,
230        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1,
231        0, 0, 0, 0,
232};
233
234int
235test2()
236{
237        int so;
238        char *pol1 = "out ipsec";
239        char *pol2 = "out ipsec ah/transport//use";
240        char *sp1, *sp2;
241        int splen1, splen2;
242        int spid;
243        struct sadb_msg *m;
244
245        printf("TEST2\n");
246        if (getuid() != 0)
247                errx(1, "root privilege required.");
248
249        sp1 = ipsec_set_policy(pol1, strlen(pol1));
250        splen1 = ipsec_get_policylen(sp1);
251        sp2 = ipsec_set_policy(pol2, strlen(pol2));
252        splen2 = ipsec_get_policylen(sp2);
253
254        if ((so = pfkey_open()) < 0)
255                errx(1, "ERROR: %s", ipsec_strerror());
256
257        printf("spdflush()\n");
258        if (pfkey_send_spdflush(so) < 0)
259                errx(1, "ERROR: %s", ipsec_strerror());
260        m = pfkey_recv(so);
261        free(m);
262
263        printf("spdsetidx()\n");
264        if (pfkey_send_spdsetidx(so, (struct sockaddr *)addr, 128,
265                                (struct sockaddr *)addr, 128,
266                                255, sp1, splen1, 0) < 0)
267                errx(1, "ERROR: %s", ipsec_strerror());
268        m = pfkey_recv(so);
269        free(m);
270       
271        printf("spdupdate()\n");
272        if (pfkey_send_spdupdate(so, (struct sockaddr *)addr, 128,
273                                (struct sockaddr *)addr, 128,
274                                255, sp2, splen2, 0) < 0)
275                errx(1, "ERROR: %s", ipsec_strerror());
276        m = pfkey_recv(so);
277        free(m);
278
279        printf("sleep(4)\n");
280        sleep(4);
281
282        printf("spddelete()\n");
283        if (pfkey_send_spddelete(so, (struct sockaddr *)addr, 128,
284                                (struct sockaddr *)addr, 128,
285                                255, sp1, splen1, 0) < 0)
286                errx(1, "ERROR: %s", ipsec_strerror());
287        m = pfkey_recv(so);
288        free(m);
289
290        printf("spdadd()\n");
291        if (pfkey_send_spdadd(so, (struct sockaddr *)addr, 128,
292                                (struct sockaddr *)addr, 128,
293                                255, sp2, splen2, 0) < 0)
294                errx(1, "ERROR: %s", ipsec_strerror());
295        spid = test2sub(so);
296
297        printf("spdget(%u)\n", spid);
298        if (pfkey_send_spdget(so, spid) < 0)
299                errx(1, "ERROR: %s", ipsec_strerror());
300        m = pfkey_recv(so);
301        free(m);
302
303        printf("sleep(4)\n");
304        sleep(4);
305
306        printf("spddelete2()\n");
307        if (pfkey_send_spddelete2(so, spid) < 0)
308                errx(1, "ERROR: %s", ipsec_strerror());
309        m = pfkey_recv(so);
310        free(m);
311
312        printf("spdadd() with lifetime's 10(s)\n");
313        if (pfkey_send_spdadd2(so, (struct sockaddr *)addr, 128,
314                                (struct sockaddr *)addr, 128,
315                                255, 0, 10, sp2, splen2, 0) < 0)
316                errx(1, "ERROR: %s", ipsec_strerror());
317        spid = test2sub(so);
318
319        /* expecting failure */
320        printf("spdupdate()\n");
321        if (pfkey_send_spdupdate(so, (struct sockaddr *)addr, 128,
322                                (struct sockaddr *)addr, 128,
323                                255, sp2, splen2, 0) == 0) {
324                warnx("ERROR: expecting failure.");
325        }
326
327        return 0;
328}
329
330int
331test2sub(so)
332        int so;
333{
334        struct sadb_msg *msg;
335        caddr_t mhp[SADB_EXT_MAX + 1];
336
337        if ((msg = pfkey_recv(so)) == NULL)
338                errx(1, "ERROR: pfkey_recv failure.");
339        if (pfkey_align(msg, mhp) < 0)
340                errx(1, "ERROR: pfkey_align failure.");
341
342        return ((struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY])->sadb_x_policy_id;
343}
344
Note: See TracBrowser for help on using the repository browser.