# $NetBSD: t_ipsec_ah_keys.sh,v 1.4 2023/06/19 08:28:09 knakahara Exp $

# $NetBSD: t_ipsec_ah_keys.sh,v 1.4 2023/06/19 08:28:09 knakahara Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#

SOCK_LOCAL=unix://ipsec_local

DEBUG=${DEBUG:-false}

test_ah_valid_keys_common()
{
local aalgo=$1
local key=
local tmpfile=./tmp
local len=

rump_server_crypto_start $SOCK_LOCAL netipsec

export RUMP_SERVER=$SOCK_LOCAL

for len in $(get_valid_keylengths $aalgo); do
key=$(generate_key $len)
cat > $tmpfile <<-EOF
add 10.0.0.1 10.0.0.2 ah 10000 -A $aalgo $key;
EOF
$DEBUG && cat $tmpfile
atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
atf_check -s exit:0 -o match:'10.0.0.1 10.0.0.2' \
$HIJACKING setkey -D
# TODO: more detail checks

cat > $tmpfile <<-EOF
delete 10.0.0.1 10.0.0.2 ah 10000;
EOF
$DEBUG && cat $tmpfile
atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
atf_check -s exit:0 -o match:'No SAD entries.' \
$HIJACKING setkey -D
done

rm -f $tmpfile
}

add_test_valid_keys()
{
local aalgo=$1
local _aalgo=$(echo $aalgo | sed 's/-//g')
local name= desc=

name="ipsec_ah_${_aalgo}_valid_keys"
desc="Tests AH ($aalgo) valid keys"

atf_test_case ${name} cleanup
eval "
${name}_head() {
atf_set descr \"$desc\"
atf_set require.progs rump_server setkey
}
${name}_body() {
test_ah_valid_keys_common $aalgo
}
${name}_cleanup() {
\$DEBUG && dump
cleanup
}
"
atf_add_test_case ${name}
}

test_ah_invalid_keys_common()
{
local aalgo=$1
local key=
local tmpfile=./tmp
local len=

rump_server_crypto_start $SOCK_LOCAL netipsec

export RUMP_SERVER=$SOCK_LOCAL

for len in $(get_invalid_keylengths $aalgo); do
key=$(generate_key $len)
cat > $tmpfile <<-EOF
add 10.0.0.1 10.0.0.2 ah 10000 -A $aalgo $key;
EOF
$DEBUG && cat $tmpfile
if [ $aalgo = null ]; then
# null doesn't accept any keys
atf_check -s exit:0 \
-o match:'syntax error' -e ignore \
$HIJACKING setkey -c < $tmpfile
else
atf_check -s exit:0 \
-o match:'Invalid (key length|argument)' -e ignore \
$HIJACKING setkey -c < $tmpfile
fi
atf_check -s exit:0 -o match:'No SAD entries.' \
$HIJACKING setkey -D
done

rm -f $tmpfile
}

add_test_invalid_keys()
{
local aalgo=$1
local _aalgo=$(echo $aalgo | sed 's/-//g')
local name= desc=

name="ipsec_ah_${_aalgo}_invalid_keys"
desc="Tests AH ($aalgo) invalid keys"

atf_test_case ${name} cleanup
eval " \
${name}_head() { \
atf_set \"descr\" \"$desc\"; \
atf_set \"require.progs\" \"rump_server\" \"setkey\"; \
}; \
${name}_body() { \
test_ah_invalid_keys_common $aalgo; \
}; \
${name}_cleanup() { \
$DEBUG && dump; \
cleanup; \
} \
"
atf_add_test_case ${name}
}

atf_init_test_cases()
{

for aalgo in $AH_AUTHENTICATION_ALGORITHMS; do
add_test_valid_keys $aalgo
add_test_invalid_keys $aalgo
done
}