Annotation of embedaddon/ipsec-tools/src/libipsec/test-policy.c, revision 1.1
1.1 ! misho 1: /* $NetBSD: test-policy.c,v 1.4 2006/09/09 16:22:09 manu Exp $ */
! 2:
! 3: /* $KAME: test-policy.c,v 1.16 2003/08/26 03:24:08 itojun Exp $ */
! 4:
! 5: /*
! 6: * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
! 7: * All rights reserved.
! 8: *
! 9: * Redistribution and use in source and binary forms, with or without
! 10: * modification, are permitted provided that the following conditions
! 11: * are met:
! 12: * 1. Redistributions of source code must retain the above copyright
! 13: * notice, this list of conditions and the following disclaimer.
! 14: * 2. Redistributions in binary form must reproduce the above copyright
! 15: * notice, this list of conditions and the following disclaimer in the
! 16: * documentation and/or other materials provided with the distribution.
! 17: * 3. Neither the name of the project nor the names of its contributors
! 18: * may be used to endorse or promote products derived from this software
! 19: * without specific prior written permission.
! 20: *
! 21: * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
! 22: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
! 23: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
! 24: * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
! 25: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
! 26: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
! 27: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
! 28: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
! 29: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
! 30: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
! 31: * SUCH DAMAGE.
! 32: */
! 33:
! 34: #include <sys/types.h>
! 35: #include <sys/param.h>
! 36: #include <sys/socket.h>
! 37:
! 38: #include <netinet/in.h>
! 39: #include <net/pfkeyv2.h>
! 40: #include <netinet/ipsec.h>
! 41:
! 42: #include <stdio.h>
! 43: #include <stdlib.h>
! 44: #include <unistd.h>
! 45: #include <string.h>
! 46: #include <errno.h>
! 47: #include <err.h>
! 48:
! 49: #include "libpfkey.h"
! 50:
! 51: struct req_t {
! 52: int result; /* expected result; 0:ok 1:ng */
! 53: char *str;
! 54: } reqs[] = {
! 55: { 0, "out ipsec" },
! 56: { 1, "must_error" },
! 57: { 1, "in ipsec must_error" },
! 58: { 1, "out ipsec esp/must_error" },
! 59: { 1, "out discard" },
! 60: { 1, "out none" },
! 61: { 0, "in entrust" },
! 62: { 0, "out entrust" },
! 63: { 1, "out ipsec esp" },
! 64: { 0, "in ipsec ah/transport" },
! 65: { 1, "in ipsec ah/tunnel" },
! 66: { 0, "out ipsec ah/transport/" },
! 67: { 1, "out ipsec ah/tunnel/" },
! 68: { 0, "in ipsec esp / transport / 10.0.0.1-10.0.0.2" },
! 69: { 0, "in ipsec esp/tunnel/::1-::2" },
! 70: { 1, "in ipsec esp/tunnel/10.0.0.1-::2" },
! 71: { 0, "in ipsec esp/tunnel/::1-::2/require" },
! 72: { 0, "out ipsec ah/transport//use" },
! 73: { 1, "out ipsec ah/transport esp/use" },
! 74: { 1, "in ipsec ah/transport esp/tunnel" },
! 75: { 0, "in ipsec ah/transport esp/tunnel/::1-::1" },
! 76: { 0, "in ipsec
! 77: ah / transport
! 78: esp / tunnel / ::1-::2" },
! 79: { 0, "out ipsec
! 80: ah/transport/::1-::2 esp/tunnel/::3-::4/use ah/transport/::5-::6/require
! 81: ah/transport/::1-::2 esp/tunnel/::3-::4/use ah/transport/::5-::6/require
! 82: ah/transport/::1-::2 esp/tunnel/::3-::4/use ah/transport/::5-::6/require
! 83: " },
! 84: { 0, "out ipsec esp/transport/fec0::10-fec0::11/use" },
! 85: };
! 86:
! 87: int test1 __P((void));
! 88: int test1sub1 __P((struct req_t *));
! 89: int test1sub2 __P((char *, int));
! 90: int test2 __P((void));
! 91: int test2sub __P((int));
! 92:
! 93: int
! 94: main(ac, av)
! 95: int ac;
! 96: char **av;
! 97: {
! 98: test1();
! 99: test2();
! 100:
! 101: exit(0);
! 102: }
! 103:
! 104: int
! 105: test1()
! 106: {
! 107: int i;
! 108: int result;
! 109:
! 110: printf("TEST1\n");
! 111: for (i = 0; i < sizeof(reqs)/sizeof(reqs[0]); i++) {
! 112: printf("#%d [%s]\n", i + 1, reqs[i].str);
! 113:
! 114: result = test1sub1(&reqs[i]);
! 115: if (result == 0 && reqs[i].result == 1) {
! 116: warnx("ERROR: expecting failure.");
! 117: } else if (result == 1 && reqs[i].result == 0) {
! 118: warnx("ERROR: expecting success.");
! 119: }
! 120: }
! 121:
! 122: return 0;
! 123: }
! 124:
! 125: int
! 126: test1sub1(req)
! 127: struct req_t *req;
! 128: {
! 129: char *buf;
! 130:
! 131: buf = ipsec_set_policy(req->str, strlen(req->str));
! 132: if (buf == NULL) {
! 133: printf("ipsec_set_policy: %s\n", ipsec_strerror());
! 134: return 1;
! 135: }
! 136:
! 137: if (test1sub2(buf, PF_INET) != 0
! 138: || test1sub2(buf, PF_INET6) != 0) {
! 139: free(buf);
! 140: return 1;
! 141: }
! 142: #if 0
! 143: kdebug_sadb_x_policy((struct sadb_ext *)buf);
! 144: #endif
! 145:
! 146: free(buf);
! 147: return 0;
! 148: }
! 149:
! 150: int
! 151: test1sub2(policy, family)
! 152: char *policy;
! 153: int family;
! 154: {
! 155: int so;
! 156: int proto = 0, optname = 0;
! 157: int len;
! 158: char getbuf[1024];
! 159:
! 160: switch (family) {
! 161: case PF_INET:
! 162: proto = IPPROTO_IP;
! 163: optname = IP_IPSEC_POLICY;
! 164: break;
! 165: case PF_INET6:
! 166: proto = IPPROTO_IPV6;
! 167: optname = IPV6_IPSEC_POLICY;
! 168: break;
! 169: }
! 170:
! 171: if ((so = socket(family, SOCK_DGRAM, 0)) < 0)
! 172: err(1, "socket");
! 173:
! 174: len = ipsec_get_policylen(policy);
! 175: #if 0
! 176: printf("\tsetlen:%d\n", len);
! 177: #endif
! 178:
! 179: if (setsockopt(so, proto, optname, policy, len) < 0) {
! 180: printf("fail to set sockopt; %s\n", strerror(errno));
! 181: close(so);
! 182: return 1;
! 183: }
! 184:
! 185: memset(getbuf, 0, sizeof(getbuf));
! 186: memcpy(getbuf, policy, sizeof(struct sadb_x_policy));
! 187: if (getsockopt(so, proto, optname, getbuf, &len) < 0) {
! 188: printf("fail to get sockopt; %s\n", strerror(errno));
! 189: close(so);
! 190: return 1;
! 191: }
! 192:
! 193: {
! 194: char *buf = NULL;
! 195:
! 196: #if 0
! 197: printf("\tgetlen:%d\n", len);
! 198: #endif
! 199:
! 200: if ((buf = ipsec_dump_policy(getbuf, NULL)) == NULL) {
! 201: printf("%s\n", ipsec_strerror());
! 202: close(so);
! 203: return 1;
! 204: }
! 205: #if 0
! 206: printf("\t[%s]\n", buf);
! 207: #endif
! 208: free(buf);
! 209: }
! 210:
! 211: close (so);
! 212: return 0;
! 213: }
! 214:
! 215: char addr[] = {
! 216: 28, 28, 0, 0,
! 217: 0, 0, 0, 0,
! 218: 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1,
! 219: 0, 0, 0, 0,
! 220: };
! 221:
! 222: int
! 223: test2()
! 224: {
! 225: int so;
! 226: char *pol1 = "out ipsec";
! 227: char *pol2 = "out ipsec ah/transport//use";
! 228: char *sp1, *sp2;
! 229: int splen1, splen2;
! 230: int spid;
! 231: struct sadb_msg *m;
! 232:
! 233: printf("TEST2\n");
! 234: if (getuid() != 0)
! 235: errx(1, "root privilege required.");
! 236:
! 237: sp1 = ipsec_set_policy(pol1, strlen(pol1));
! 238: splen1 = ipsec_get_policylen(sp1);
! 239: sp2 = ipsec_set_policy(pol2, strlen(pol2));
! 240: splen2 = ipsec_get_policylen(sp2);
! 241:
! 242: if ((so = pfkey_open()) < 0)
! 243: errx(1, "ERROR: %s", ipsec_strerror());
! 244:
! 245: printf("spdflush()\n");
! 246: if (pfkey_send_spdflush(so) < 0)
! 247: errx(1, "ERROR: %s", ipsec_strerror());
! 248: m = pfkey_recv(so);
! 249: free(m);
! 250:
! 251: printf("spdsetidx()\n");
! 252: if (pfkey_send_spdsetidx(so, (struct sockaddr *)addr, 128,
! 253: (struct sockaddr *)addr, 128,
! 254: 255, sp1, splen1, 0) < 0)
! 255: errx(1, "ERROR: %s", ipsec_strerror());
! 256: m = pfkey_recv(so);
! 257: free(m);
! 258:
! 259: printf("spdupdate()\n");
! 260: if (pfkey_send_spdupdate(so, (struct sockaddr *)addr, 128,
! 261: (struct sockaddr *)addr, 128,
! 262: 255, sp2, splen2, 0) < 0)
! 263: errx(1, "ERROR: %s", ipsec_strerror());
! 264: m = pfkey_recv(so);
! 265: free(m);
! 266:
! 267: printf("sleep(4)\n");
! 268: sleep(4);
! 269:
! 270: printf("spddelete()\n");
! 271: if (pfkey_send_spddelete(so, (struct sockaddr *)addr, 128,
! 272: (struct sockaddr *)addr, 128,
! 273: 255, sp1, splen1, 0) < 0)
! 274: errx(1, "ERROR: %s", ipsec_strerror());
! 275: m = pfkey_recv(so);
! 276: free(m);
! 277:
! 278: printf("spdadd()\n");
! 279: if (pfkey_send_spdadd(so, (struct sockaddr *)addr, 128,
! 280: (struct sockaddr *)addr, 128,
! 281: 255, sp2, splen2, 0) < 0)
! 282: errx(1, "ERROR: %s", ipsec_strerror());
! 283: spid = test2sub(so);
! 284:
! 285: printf("spdget(%u)\n", spid);
! 286: if (pfkey_send_spdget(so, spid) < 0)
! 287: errx(1, "ERROR: %s", ipsec_strerror());
! 288: m = pfkey_recv(so);
! 289: free(m);
! 290:
! 291: printf("sleep(4)\n");
! 292: sleep(4);
! 293:
! 294: printf("spddelete2()\n");
! 295: if (pfkey_send_spddelete2(so, spid) < 0)
! 296: errx(1, "ERROR: %s", ipsec_strerror());
! 297: m = pfkey_recv(so);
! 298: free(m);
! 299:
! 300: printf("spdadd() with lifetime's 10(s)\n");
! 301: if (pfkey_send_spdadd2(so, (struct sockaddr *)addr, 128,
! 302: (struct sockaddr *)addr, 128,
! 303: 255, 0, 10, sp2, splen2, 0) < 0)
! 304: errx(1, "ERROR: %s", ipsec_strerror());
! 305: spid = test2sub(so);
! 306:
! 307: /* expecting failure */
! 308: printf("spdupdate()\n");
! 309: if (pfkey_send_spdupdate(so, (struct sockaddr *)addr, 128,
! 310: (struct sockaddr *)addr, 128,
! 311: 255, sp2, splen2, 0) == 0) {
! 312: warnx("ERROR: expecting failure.");
! 313: }
! 314:
! 315: return 0;
! 316: }
! 317:
! 318: int
! 319: test2sub(so)
! 320: int so;
! 321: {
! 322: struct sadb_msg *msg;
! 323: caddr_t mhp[SADB_EXT_MAX + 1];
! 324:
! 325: if ((msg = pfkey_recv(so)) == NULL)
! 326: errx(1, "ERROR: pfkey_recv failure.");
! 327: if (pfkey_align(msg, mhp) < 0)
! 328: errx(1, "ERROR: pfkey_align failure.");
! 329:
! 330: return ((struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY])->sadb_x_policy_id;
! 331: }
! 332:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to test-policy.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / libipsec