#!/usr/bin/perl # # Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006 # Yokogawa Electric Corporation. # All rights reserved. # # Redistribution and use of this software in source and binary # forms, with or without modification, are permitted provided that # the following conditions and disclaimer are agreed and accepted # by the user: # # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in # the documentation and/or other materials provided with # the distribution. # # 3. Neither the names of the copyrighters, the name of the project # which is related to this software (hereinafter referred to as # "project") nor the names of the contributors may be used to # endorse or promote products derived from this software without # specific prior written permission. # # 4. No merchantable use may be permitted without prior written # notification to the copyrighters. # # 5. The copyrighters, the project and the contributors may prohibit # the use of this software at any time. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHTERS, THE PROJECT AND # CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING # BUT NOT LIMITED THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS # FOR A PARTICULAR PURPOSE, ARE DISCLAIMED. IN NO EVENT SHALL THE # COPYRIGHTERS, THE PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, # INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES # (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, # STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING # IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. # # $TAHI: ct/ike/SGW/SG_I_RFC2408_3_6_1_P1_NP_3.seq,v 1.20.2.3 2005/11/22 10:06:02 ozoe Exp $ # $Id: SG_I_RFC2408_3_6_1_P1_NP_3.seq,v 1.20.2.3 2005/11/22 10:06:02 ozoe Exp $ # ###################################################################### BEGIN { } use V6evalTool; use IKE; use IKE_check; my $IF1 = Link1; my $IF0 = Link0; #====== get sequence arguments ====== foreach (@ARGV) { /^test_type=(\S+)/ && do {$TEST_TYPE=$1; next; }; /^support=(\S+)/ && do {$SUPPORT=$1; next; }; /^app_type=(\S+)/ && do {$IKE::APP_TYPE=$1; next; }; /^test_phase=(\S+)/ && do {$IKE::TEST_PHASE=$1; next; }; ikeExitError("Unknown sequence option '$_'"); } #====== check NUT type ====== ikeCheckNUT(sgw, $TEST_TYPE, $SUPPORT); #====== Test Configuration ====== %ikeConfig = ( 'app_type' => 'ICMP', 'isakmp_src' => "$IKE::IKEAddr{IKE_NUT_NET2_SGW1_ADDR}", 'isakmp_dst' => "$IKE::IKEAddr{IKE_TN_NET3_SGW2_ADDR}", 'isakmp_dport' => '500', 'isakmp_ex_mode' => 'main', 'isakmp_doi' => 'ipsec_doi', 'isakmp_situation' => 'identity_only', 'isakmp_key_id' => "$IKE::IKEAddr{IKE_TN_NET3_SGW2_ADDR}", 'isakmp_key_value' => 'IKE-TEST', 'isakmp_enc_alg' => '3des', 'isakmp_hash_alg' => 'sha1', 'isakmp_auth_method' => 'pre_shared_key', 'isakmp_dh_group' => '2', 'isakmp_lt' => '28800', 'isakmp_lt_unit' => 'seconds', 'isakmp_enc_alg_2' => 'des', 'isakmp_hash_alg_2' => 'md5', 'isakmp_auth_method_2' => 'pre_shared_key', 'isakmp_dh_group_2' => '1', 'isakmp_lt_2' => '28800', 'isakmp_lt_unit_2' => 'seconds', 'isakmp_src_id_type' => 'address', 'isakmp_src_id' => "$IKE::IKEAddr{IKE_NUT_NET2_SGW1_ADDR}", 'isakmp_dst_id_type' => 'address', 'isakmp_dst_id' => "$IKE::IKEAddr{IKE_TN_NET3_SGW2_ADDR}", 'isakmp_num_pro' => '1', 'isakmp_num_trans' => '2', 'ipsec_id_type' => 'address', 'ipsec_src' => "$IKE::IKEAddr{IKE_NET0_ADDR}", 'ipsec_dst' => "$IKE::IKEAddr{IKE_NET4_ADDR}", 'ipsec_src_id' => "$IKE::IKEAddr{IKE_NET0_ADDR}", 'ipsec_dst_id' => "$IKE::IKEAddr{IKE_NET4_ADDR}", 'ipsec_tsrc' => "$IKE::IKEAddr{IKE_NUT_NET2_SGW1_ADDR}", 'ipsec_tdst' => "$IKE::IKEAddr{IKE_TN_NET3_SGW2_ADDR}", 'ipsec_end_src' => "$IKE::IKEAddr{IKE_TN_NET0_HOST1_ADDR}", 'ipsec_end_dst' => "$IKE::IKEAddr{IKE_TN_NET4_HOST2_ADDR}", 'ipsec_supper' => 'any', 'ipsec_dupper' => 'any', 'ipsec_direction' => 'out', 'ipsec_pfs_group' => 'off', 'ipsec_p_num' => '1', 'ipsec_p1_proto' => 'PROTO_IPSEC_ESP', 'ipsec_p1_t_num' => '1', 'ipsec_p1_t1_enc_alg' => 'ESP_3DES', 'ipsec_p1_t1_auth_mtd' => 'HMAC_SHA', 'ipsec_p1_t1_mode' => 'Tunnel', 'ipsec_p1_t1_lt' => '8', 'ipsec_p1_t1_lt_unit' => 'hour', ); #====== set ISAKMP SA, IPSEC SPD #====== vLogHTML("*** Target IKE initialization phase ***
"); ikeInit(%ikeConfig); #====== set Address of NUT ====== vLogHTML("*** Target initialization phase ***
"); vCapture($IF0); vCapture($IF1); ikeSetAddr($IF0,$IF1,$IKE::address_debug); #====== set ISAKMP SA packet frame, parameter #====== my $cpp = undef; my @ike = (); #====================================================================== vLogHTML("*** Target testing phase ***
"); vClear($IF1); vClear($IF0); #------------------------------------------------------------------- vLogHTML("*** Phase-1 1st message recv ***
"); #------------------------------------------------------------------- $IKE::pktdesc{'echo_request_send_net0host1_net4host2'} = 'Send Echo Request from Host-1(TN) to Host-2(TN) via SGW1(NUT)'; my $ret0 = packetSendOnly($IF1, 'echo_request_send_net0host1_net4host2'); if($ret0 == $IKE::FAIL) { ikeReset(); exit($V6evalTool::exitFail); } my @CHECK_FLAG = undef; $CHECK_FLAG[0] = shiftFlag(3); #Transform my $OPTION_FLAG = $IKE_check::optionHash{'monotonicNumberCheck'}; my %ret1 = ikePh1Recv('Link0', 10, 0, 0, $cpp, \@ike, \%ikeConfig,\@CHECK_FLAG,$OPTION_FLAG); my $saKey = 'Frame_Ether.Packet_IPv6.Upp_UDP.Udp_ISAKMP.Pld_ISAKMP_SA_IPsec_IDonly'; my @proposals = grep(/Pld_ISAKMP_P/,split(' ',$ret1{$saKey})); foreach $plproposal (@proposals){ my $proKey = $saKey . "." . $plproposal; my @transforms = grep(/Pld_ISAKMP_T/,split(' ',$ret1{$proKey})); my $NumberOfTransformRecv1=@transforms; my $NumberOfTransformConfig=$ikeConfig{'isakmp_num_trans'}; if($NumberOfTransformRecv1 != $NumberOfTransformConfig){ vLogHTML(''); vLogHTML("**NG Number of isakmp transform does not match M:E=$NumberOfTransformRecv1:$NumberOfTransformConfig
"); vLogHTML(''); $ret{'status'} = $IKE::FAIL; }else{ if($IKE::payload_check_debug > 0){ vLogHTML(''); vLogHTML("**OK Number of isakmp transform match M:E=$NumberOfTransformRecv1:$NumberOfTransformConfig
"); vLogHTML(''); } } } #proposal if($ret1{'status'} == $IKE::FAIL) { ikeReset(); exit($V6evalTool::exitFail); } vLogHTML("Transform Payload Format(Multiple Transform) is correct
"); vLogHTML("*** Target test finish ***
"); vStop($IF1); vStop($IF0); ikeReset(); ikeExitPass(); #NOTREACHED ###################################################################### __END__ =head1 NAME SG_I_RFC2408_3_6_1_P1_NP_3 - [Initiator Test] Transform Payload format check(Multiple Transform Payload) =head1 TARGET SGW =head1 SYNOPSIS =begin html 
  SG_I_RFC2408_3_6_1_P1_NP_3.seq [-tooloption ...] -pkt SG_I_RFC2408_3_6_1_P1_NP_3.def -tooloption : v6eval tool option
  See also ike_common.def and ike_ipsec.def and ike_addr.def and ike_pkt_ph1_recv.def and ike_pkt_ph2_recv.def
=end html =head1 INITIALIZATION =begin html
  • Network Topology
    •                                  HOST-2(TN)
                                   |3ffe:501:ffff:104::11
                                   |
Net-v   --+------------------------+-------- 3ffe:501:ffff:104::/64
          |
          |
         SGW-2(TN):responder
          |3ffe:501:ffff:103::11
          |                     
Net-w   --+--------+------------------------ 3ffe:501:ffff:103::/64
                   |
                   |
                  ROUTER-2(TN)
                   | 3ffe:501:ffff:102::11
                   |
Net-x   --+--------+------------------------ 3ffe:501:ffff:102::/64
          |
          |3ffe:501:ffff:102::1
         SGW-1(NUT):initiator
          |3ffe:501:ffff:101::1
          |
Net-y   --+--------+------------------------ 3ffe:501:ffff:101::/64
                   |
                   | 3ffe:501:ffff:101::11
                  ROUTER-1(TN)
                   |
                   |
Net-z   -----------+---------------+-------- 3ffe:501:ffff:100::/64
                                   |
                                   |3ffe:501:ffff:100::13
                                 HOST-1(TN)

  • Verification Points

      Transform Payload Format
       
    • Next Payload field
      • 
       This field MUST only contain the value "3" or "0".
       Place the value of the Next Payload in the Next Payload field.
       (In this test, this field only contain the value "3" and "0"). 
       
    • RESERVED Fields
      • 
       All RESERVED fields in the ISAKMP protocol MUST be set to zero (0).
       Place the value zero (0) in the RESERVED field.
       
    • Payload Length field
      • 
       Place the length (in octets) of the payload in the Payload Length
       field.
       
    • Transform Number field
      • 
       Identifies the Transform number for the current payload.
       (In this test, this field is set as "1" and "2".) 
	   
    • Transform-ID field
      •  
       All implementations within the IPSEC DOI MUST support KEY_IKE.
       (In Phase I, this field only contain "1"(KEY_IKE))

      
       
    • If multiple offers are being made for phase 1 exchanges 
(Main Mode and Aggressive Mode)they MUST take the form of 
multiple Transform Payloads for a single Proposal Payload in 
a single SA payload.To put it another way, for phase 1 exchanges 
there MUST NOT be multiple Proposal Payloads for a single SA payload 
and there MUST NOT be multiple SA payloads.
      • 
       
    • The multiple transforms MUST be presented with monotonically 
increasing numbers in the initiator's preference order.
      •

  • Configuration

      •        
    • Initiator and Responder IKE parameter
      • 
Any attribute is acceptable as proposal.
          
      
          
          
      
            Machine              
            Src              
            Dest              
            Phase I             
            Phase II
          
                   
          
                   
            Ex mode
            Key Value 
            Trans #
            Enc Alg
            Hash Alg           
            Auth Method           
            DH Group           
            PH1 Lt
            IDx
      		
            Proto ID
            Trans ID
            Mode
            Auth Alg
            PH2 Lt
            IDci
            IDcr
            Upper
          
      
          
      
            SGW-1           
            SGW-1 addr           
            SGW-2 addr           
            Main  
            IKE-TEST 
            1                              
            3DES           
            SHA           
            pre-shared key           
            2           
            8 Hour            
            SGW-1 addr              
            PROTO_IPSEC_ESP    
            ESP_3DES             
            Tunnel           
            HMAC-SHA  
            8 Hour            
            Net-z addr          
            Net-v addr   
            any            
          
      
             
      
                       
                       
                       
             
             
            2                              
            DES           
            MD5           
            pre-shared key           
            1           
            8 Hour            
                          
                
                         
                       
             
                       
                       
          
         
          
         
            SGW-2
            SGW-2 addr
            SGW-1 addr
            Main
            IKE-TEST          
                  
            3DES
            SHA
            pre-shared key           
            2           
            8 Hour
            SGW-2 addr    
            PROTO_IPSEC_ESP
            ESP_3DES     
            Tunnel
            HMAC-SHA
            8 Hour  
            Net-z addr          
            Net-v addr   
            any
          
      
                
        
      
          *Ex Mode = Exchange mode
          *Trans # = Transform number
          *IDx = identity payload(FQDN or user FQDN  can also be chosen as IDx)
          *IDci = identity payload
          *IDcr = identity payload
          *Enc Alg = IKE Encryption Algorithm
          *Hash Alg = IKE Authentication Algorithm
          *Key Value = pre-shared key value
          *PH1 Lt = Phase-1 Lifetime
          *PH2 Lt = Phase-2 Lifetime
          *Proto ID = Protocol Identifier
          *Trans ID = Transform Identifier
          *Mode = Encapsulation Mode
          *Auth Alg = Authentication Algorithm
          *Auth Method = Authentication Method
          *DH Group = Diffie-Hellman Group
          *Upper = Upper Layer Protocol
          *SGW-1 addr = SGW-1 address
          *SGW-2 addr = SGW-2 address
          *Net-z = Net-z network address
          *Net-v = Net-v network address

  • Pre-Sequence
    •        In order to start the negotiation of IKE, 
       TN(HOST-1) transmits Echo Request to TN(HOST-2).
=end html =head1 TEST PROCEDURE =begin html 
  This test check is following.


           IDENTITY PROTECTION EXCHANGE


 #   Initiator(NUT)   Direction    Responder(TN)
(1)  HDR; SA         ========>
                Judgement (Check *1)


   1. Receive the first message from NUT
      In the first message (1), the initiator generates a proposal it
      considers adequate to protect traffic for the given situation.  The
      Security Association, Proposal, and Transform payloads are included
      in the Security Association payload (for notation purposes).
=end html =head1 JUDGEMENT The first message's Transform Payload Payload Format must be base on description of RFC(see above Verification Points). =head1 TERMINATION Clean up SAD and SPD =head1 REFERENCE =begin html 
  RFC2407
  4.4.2.1 KEY_IKE


   The KEY_IKE type specifies the hybrid ISAKMP/Oakley Diffie-Hellman
   key exchange (IKE) as defined in the [IKE] document.  All
   implementations within the IPSEC DOI MUST support KEY_IKE.



 
  RFC2408


  2.5.2 RESERVED Fields


   The existence of RESERVED fields within ISAKMP payloads are used
   strictly to preserve byte alignment.  All RESERVED fields in the
   ISAKMP protocol MUST be set to zero (0) when a packet is issued.  The
   receiver SHOULD check the RESERVED fields for a zero (0) value and
   discard the packet if other values are found.


  (omit)


  3.6 Transform Payload


  (omit)


                          1                   2                   3
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     ! Next Payload  !   RESERVED    !         Payload Length        !
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     !  Transform #  !  Transform-Id !           RESERVED2           !
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     !                                                               !
     ~                        SA Attributes                          ~
     !                                                               !
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


  (omit)


    o  Next Payload (1 octet) - Identifier for the payload type of the
       next payload in the message.  This field MUST only contain the
       value "3" or "0".  If there are additional Transform payloads in
       the proposal, then this field will be 3.  If the current
       Transform payload is the last within the proposal, then this
       field will be 0.


    o  RESERVED (1 octet) - Unused, set to 0.


    o  Payload Length (2 octets) - Length in octets of the current
       payload, including the generic payload header, Transform values,
       and all SA Attributes.


    o  Transform # (1 octet) - Identifies the Transform number for the
       current payload.  If there is more than one transform proposed
       for a specific protocol within the Proposal payload, then each
       Transform payload has a unique Transform number.  A description
       of the use of this field is found in section 4.2.


    o  Transform-Id (1 octet) - Specifies the Transform identifier for
       the protocol within the current proposal.  These transforms are
       defined by the DOI and are dependent on the protocol being
       negotiated.


    o  RESERVED2 (2 octets) - Unused, set to 0.


    o  SA Attributes (variable length) - This field contains the
       security association attributes as defined for the transform
       given in the Transform-Id field.  The SA Attributes SHOULD be
       represented using the Data Attributes format described in section
       3.3.  If the SA Attributes are not aligned on 4-byte boundaries,
       then subsequent payloads will not be aligned and any padding will
       be added at the end of the message to make the message 4-octet
       aligned.


  (omit)


  4.2 Security Association Establishment


   (omit)


   The Transform payload provides the initiating entity with the
   capability to present to the responding entity multiple mechanisms,
   or transforms, for a given protocol.  The Proposal payload identifies
   a Protocol for which services and mechanisms are being negotiated.
   The Transform payload allows the initiating entity to present several
   possible supported transforms for that proposed protocol.  There may
   be several transforms associated with a specific Proposal payload
   each identified in a separate Transform payload.  The multiple
   transforms MUST be presented with monotonically increasing numbers in
   the initiator's preference order.  The receiving entity MUST select a
   single transform for each protocol in a proposal or reject the entire
   proposal.  The use of the Transform number in multiple Transform
   payloads provides a second level OR operation, i.e.  Transform 1 OR
   Transform 2 OR Transform 3.  Example 1 below shows two possible
   transforms for ESP and a single transform for AH. Example 2 below
   shows one transform for AH AND one transform for ESP OR two
   transforms for ESP alone.  Note that the Next Payload field of the
   Transform payload points to another Transform payload or 0.  The
   Proposal payload delineates the different proposals.


   (omit)


  5.3 Generic Payload Header Processing


   When creating any of the ISAKMP Payloads described in sections 3.4
   through 3.15 a Generic Payload Header is placed at the beginning of
   these payloads.  When creating the Generic Payload Header, the
   transmitting entity (initiator or responder) MUST do the following:


   1.  Place the value of the Next Payload in the Next Payload field.
       These values are described in section 3.1.


   2.  Place the value zero (0) in the RESERVED field.


   3.  Place the length (in octets) of the payload in the Payload Length
       field.


   4.  Construct the payloads as defined in the remainder of this
       section.


  (omit)


5.6 Transform Payload Processing


   When creating a Transform Payload, the transmitting entity (initiator
   or responder) MUST do the following:


   1.  Determine the Transform # for this transform.


   2.  Determine the number of transforms to be offered for this
       proposal.  Transforms are described in sections 3.6.


   3.  Construct a Transform payload.


  (omit)


  RFC2409


  5. Exchanges


  (omit)


   Main Mode, Aggressive Mode, and Quick Mode do security association
   negotiation. Security Association offers take the form of Transform
   Payload(s) encapsulated in Proposal Payload(s) encapsulated in
   Security Association (SA) payload(s). If multiple offers are being
   made for phase 1 exchanges (Main Mode and Aggressive Mode) they MUST
   take the form of multiple Transform Payloads for a single Proposal
   Payload in a single SA payload. To put it another way, for phase 1
   exchanges there MUST NOT be multiple Proposal Payloads for a single
   SA payload and there MUST NOT be multiple SA payloads. This document
   does not proscribe such behavior on offers in phase 2 exchanges.


  (omit)
=end html =head1 SEE ALSO perldoc V6evalTool =begin html 
  IKE.html IKE Test Common Utility
=end html =cut