GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 00:37:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

tests: added unit tests for AES-128-GCM and AES-256-GCM

Browse Source 
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
This commit is contained in:
Nikos Mavrogiannopoulos
2018-07-20 22:06:11 +02:00
parent 579cfc0ead
commit 3a330b8d85
6 changed files with 218 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
tests/Makefile.am
View File

@@ -28,7 +28,8 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem
data/vhost.hosts data/multiple-routes.config data/haproxy-auth.cfg data/test-haproxy-auth.config \ data/vhost.hosts data/multiple-routes.config data/haproxy-auth.cfg data/test-haproxy-auth.config \
data/haproxy-connect.cfg data/test-haproxy-connect.config scripts/vpnc-script \ data/haproxy-connect.cfg data/test-haproxy-connect.config scripts/vpnc-script \
data/test-traffic.config data/test-compression-lzs.config data/test-compression-lz4.config \ data/test-traffic.config data/test-compression-lzs.config data/test-compression-lz4.config \
certs/crl.pem server-cert-rsa-pss data/test-gssapi-opt-cert.config data/test-ciphers.config certs/crl.pem server-cert-rsa-pss data/test-gssapi-opt-cert.config data/test-ciphers.config \
cipher-common.sh
SUBDIRS = docker-ocserv docker-kerberos SUBDIRS = docker-ocserv docker-kerberos
@@ -60,7 +61,7 @@ dist_check_SCRIPTS += test-iroute test-multi-cookie test-pass-script \
#other tests requiring nuttcp for traffic #other tests requiring nuttcp for traffic
if ENABLE_NUTTCP_TESTS if ENABLE_NUTTCP_TESTS
dist_check_SCRIPTS += traffic lz4-compression lzs-compression \ dist_check_SCRIPTS += traffic lz4-compression lzs-compression \
aes256-cipher aes128-cipher aes256-cipher aes128-cipher aes256-gcm-cipher aes128-gcm-cipher
endif endif
endif endif

134
tests/aes128-cipher
View File

@@ -20,136 +20,8 @@
# This tests operation/traffic under compression (lzs or lz4). # This tests operation/traffic under compression (lzs or lz4).
OCCTL="${OCCTL:-../src/occtl/occtl}" CIPHER_NAME="AES128-SHA"
SERV="${SERV:-../src/ocserv}" GNUTLS_NAME="(DTLS0.9)-(RSA)-(AES-128-CBC)-(SHA1)"
srcdir=${srcdir:-.}
PORT=4574
PIDFILE=ocserv-pid.$$.tmp
CLIPID=oc-pid.$$.tmp
PATH=${PATH}:/usr/sbin
IP=$(which ip)
OUTFILE=traffic.$$.tmp
. `dirname $0`/common.sh . cipher-common.sh
if test -z "${IP}";then
echo "no IP tool is present"
exit 77
fi
if test "$(id -u)" != "0";then
echo "This test must be run as root"
exit 77
fi
echo "Testing ocserv connection with AES128-SHA under legacy DTLS... "
function finish {
set +e
echo " * Cleaning up..."
test -n "${PID}" && kill ${PID} >/dev/null 2>&1
test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1
test -n "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1
test -n "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1
test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1
rm -f ${OUTFILE} 2>&1
}
trap finish EXIT
# server address
ADDRESS=10.201.2.1
CLI_ADDRESS=10.201.1.1
VPNNET=192.168.2.0/24
VPNADDR=192.168.2.1
VPNNET6=fd91:6d87:7341:dc6a::/112
VPNADDR6=fd91:6d87:7341:dc6a::1
OCCTL_SOCKET=./occtl-comp-$$.socket
USERNAME=test
. `dirname $0`/ns.sh
# Run servers
update_config test-ciphers.config
if test "$VERBOSE" = 1;then
DEBUG="-d 3"
fi
${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
sleep 4
# Run clients
echo " * Getting cookie from ${ADDRESS}:${PORT}..."
( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --dtls-ciphers=AES128-SHA --cookieonly )
if test $? != 0;then
echo "Could not get cookie from server"
exit 1
fi
echo " * Connecting to ${ADDRESS}:${PORT}..."
( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --dtls-ciphers=AES128-SHA -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b )
if test $? != 0;then
echo "Could not connect to server"
exit 1
fi
set -e
echo " * ping remote address"
${CMDNS2} nuttcp -1
${CMDNS1} ping -c 3 ${VPNADDR}
sleep 2
echo " * Transmitting with nuttcp"
${CMDNS1} nuttcp -T 6 -t ${VPNADDR}
# IPv6
${CMDNS2} nuttcp -1
${CMDNS1} ping -c 3 ${VPNADDR6}
echo " * Receiving with nuttcp"
${CMDNS1} nuttcp -T 6 -r ${VPNADDR}
set +e
${OCCTL} -s ${OCCTL_SOCKET} show users|grep ${USERNAME}
if test $? != 0;then
echo "occtl didn't find connected user!"
exit 1
fi
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME} >${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl didn't find connected user!"
exit 1
fi
grep "Username: ${USERNAME}" ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't find connected user!"
exit 1
fi
grep "DTLS cipher: (DTLS0.9)-(RSA)-(AES-128-CBC)-(SHA1)" ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't show cipher!"
exit 1
fi
grep ${CLI_ADDRESS} ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't find client address!"
exit 1
fi
exit 0

27
tests/aes128-gcm-cipher Executable file
View File

@@ -0,0 +1,27 @@
#!/bin/bash
#
# Copyright (C) 2018 Nikos Mavrogiannopoulos
#
# This file is part of ocserv.
#
# ocserv is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# ocserv is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# This tests operation/traffic under compression (lzs or lz4).
CIPHER_NAME="OC-DTLS1_2-AES128-GCM"
GNUTLS_NAME="(DTLS1.2)-(RSA)-(AES-128-GCM)"
. cipher-common.sh

134
tests/aes256-cipher
View File

@@ -20,136 +20,8 @@
# This tests operation/traffic under compression (lzs or lz4). # This tests operation/traffic under compression (lzs or lz4).
OCCTL="${OCCTL:-../src/occtl/occtl}" CIPHER_NAME="AES256-SHA"
SERV="${SERV:-../src/ocserv}" GNUTLS_NAME="(DTLS0.9)-(RSA)-(AES-256-CBC)-(SHA1)"
srcdir=${srcdir:-.}
PORT=4574
PIDFILE=ocserv-pid.$$.tmp
CLIPID=oc-pid.$$.tmp
PATH=${PATH}:/usr/sbin
IP=$(which ip)
OUTFILE=traffic.$$.tmp
. `dirname $0`/common.sh . cipher-common.sh
if test -z "${IP}";then
echo "no IP tool is present"
exit 77
fi
if test "$(id -u)" != "0";then
echo "This test must be run as root"
exit 77
fi
echo "Testing ocserv connection with AES256-SHA under legacy DTLS... "
function finish {
set +e
echo " * Cleaning up..."
test -n "${PID}" && kill ${PID} >/dev/null 2>&1
test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1
test -n "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1
test -n "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1
test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1
rm -f ${OUTFILE} 2>&1
}
trap finish EXIT
# server address
ADDRESS=10.201.2.1
CLI_ADDRESS=10.201.1.1
VPNNET=192.168.2.0/24
VPNADDR=192.168.2.1
VPNNET6=fd91:6d87:7341:dc6a::/112
VPNADDR6=fd91:6d87:7341:dc6a::1
OCCTL_SOCKET=./occtl-comp-$$.socket
USERNAME=test
. `dirname $0`/ns.sh
# Run servers
update_config test-ciphers.config
if test "$VERBOSE" = 1;then
DEBUG="-d 3"
fi
${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
sleep 4
# Run clients
echo " * Getting cookie from ${ADDRESS}:${PORT}..."
( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --dtls-ciphers=AES256-SHA --cookieonly )
if test $? != 0;then
echo "Could not get cookie from server"
exit 1
fi
echo " * Connecting to ${ADDRESS}:${PORT}..."
( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --dtls-ciphers=AES256-SHA -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b )
if test $? != 0;then
echo "Could not connect to server"
exit 1
fi
set -e
echo " * ping remote address"
${CMDNS2} nuttcp -1
${CMDNS1} ping -c 3 ${VPNADDR}
sleep 2
echo " * Transmitting with nuttcp"
${CMDNS1} nuttcp -T 6 -t ${VPNADDR}
# IPv6
${CMDNS2} nuttcp -1
${CMDNS1} ping -c 3 ${VPNADDR6}
echo " * Receiving with nuttcp"
${CMDNS1} nuttcp -T 6 -r ${VPNADDR}
set +e
${OCCTL} -s ${OCCTL_SOCKET} show users|grep ${USERNAME}
if test $? != 0;then
echo "occtl didn't find connected user!"
exit 1
fi
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME} >${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl didn't find connected user!"
exit 1
fi
grep "Username: ${USERNAME}" ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't find connected user!"
exit 1
fi
grep "DTLS cipher: (DTLS0.9)-(RSA)-(AES-256-CBC)-(SHA1)" ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't show cipher!"
exit 1
fi
grep ${CLI_ADDRESS} ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't find client address!"
exit 1
fi
exit 0

27
tests/aes256-gcm-cipher Executable file
View File

@@ -0,0 +1,27 @@
#!/bin/bash
#
# Copyright (C) 2018 Nikos Mavrogiannopoulos
#
# This file is part of ocserv.
#
# ocserv is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# ocserv is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# This tests operation/traffic under compression (lzs or lz4).
CIPHER_NAME="OC-DTLS1_2-AES256-GCM"
GNUTLS_NAME="(DTLS1.2)-(RSA)-(AES-256-GCM)"
. cipher-common.sh

155
tests/cipher-common.sh Executable file
View File

@@ -0,0 +1,155 @@
#!/bin/bash
#
# Copyright (C) 2018 Nikos Mavrogiannopoulos
#
# This file is part of ocserv.
#
# ocserv is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# ocserv is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# This tests operation/traffic under compression (lzs or lz4).
OCCTL="${OCCTL:-../src/occtl/occtl}"
SERV="${SERV:-../src/ocserv}"
srcdir=${srcdir:-.}
PORT=4574
PIDFILE=ocserv-pid.$$.tmp
CLIPID=oc-pid.$$.tmp
PATH=${PATH}:/usr/sbin
IP=$(which ip)
OUTFILE=traffic.$$.tmp
. `dirname $0`/common.sh
if test -z "${IP}";then
echo "no IP tool is present"
exit 77
fi
if test "$(id -u)" != "0";then
echo "This test must be run as root"
exit 77
fi
echo "Testing ocserv connection with ${CIPHER_NAME} under legacy DTLS... "
function finish {
set +e
echo " * Cleaning up..."
test -n "${PID}" && kill ${PID} >/dev/null 2>&1
test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1
test -n "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1
test -n "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1
test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1
rm -f ${OUTFILE} 2>&1
}
trap finish EXIT
# server address
ADDRESS=10.201.2.1
CLI_ADDRESS=10.201.1.1
VPNNET=192.168.2.0/24
VPNADDR=192.168.2.1
VPNNET6=fd91:6d87:7341:dc6a::/112
VPNADDR6=fd91:6d87:7341:dc6a::1
OCCTL_SOCKET=./occtl-comp-$$.socket
USERNAME=test
. `dirname $0`/ns.sh
# Run servers
update_config test-ciphers.config
if test "$VERBOSE" = 1;then
DEBUG="-d 3"
fi
${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
sleep 4
# Run clients
echo " * Getting cookie from ${ADDRESS}:${PORT}..."
( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --dtls-ciphers=${CIPHER_NAME} --cookieonly )
if test $? != 0;then
echo "Could not get cookie from server"
exit 1
fi
echo " * Connecting to ${ADDRESS}:${PORT}..."
( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --dtls-ciphers=${CIPHER_NAME} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b )
if test $? != 0;then
echo "Could not connect to server"
exit 1
fi
set -e
echo " * ping remote address"
${CMDNS2} nuttcp -1
${CMDNS1} ping -c 3 ${VPNADDR}
sleep 2
echo " * Transmitting with nuttcp"
${CMDNS1} nuttcp -T 6 -t ${VPNADDR}
# IPv6
${CMDNS2} nuttcp -1
${CMDNS1} ping -c 3 ${VPNADDR6}
echo " * Receiving with nuttcp"
${CMDNS1} nuttcp -T 6 -r ${VPNADDR}
set +e
${OCCTL} -s ${OCCTL_SOCKET} show users|grep ${USERNAME}
if test $? != 0;then
echo "occtl didn't find connected user!"
exit 1
fi
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME} >${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl didn't find connected user!"
exit 1
fi
grep "Username: ${USERNAME}" ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't find connected user!"
exit 1
fi
grep "DTLS cipher: ${GNUTLS_NAME}" ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't show cipher!"
exit 1
fi
grep ${CLI_ADDRESS} ${OUTFILE}
if test $? != 0;then
${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME}
echo "occtl show user didn't find client address!"
exit 1
fi
exit 0