#!/usr/bin/perl
#
# Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
# Yokogawa Electric Corporation.
# All rights reserved.
# 
# Redistribution and use of this software in source and binary
# forms, with or without modification, are permitted provided that
# the following conditions and disclaimer are agreed and accepted
# by the user:
# 
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in
#    the documentation and/or other materials provided with
#    the distribution.
# 
# 3. Neither the names of the copyrighters, the name of the project
#    which is related to this software (hereinafter referred to as
#    "project") nor the names of the contributors may be used to
#    endorse or promote products derived from this software without
#    specific prior written permission.
# 
# 4. No merchantable use may be permitted without prior written
#    notification to the copyrighters.
# 
# 5. The copyrighters, the project and the contributors may prohibit
#    the use of this software at any time.
# 
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHTERS, THE PROJECT AND
# CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING
# BUT NOT LIMITED THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE, ARE DISCLAIMED.  IN NO EVENT SHALL THE
# COPYRIGHTERS, THE PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
# IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# $Id: IKEv2-EN-R-1-1-6-4-C.seq,v 1.3 2008/11/28 10:16:21 doo Exp $
#
################################################################

BEGIN
{
	push(@INC, '..');
}

END { }

use IKEv2;
use strict;


my $remote	= 'common_remote_index';


my $session = undef;
my $ret = undef;
my $str = undef;

my $ike_sa_init_req_param = undef;
my $ike_sa_init_resp_param = undef;

my @local_ike_sa_init_req = undef;
my $second_proposal = undef;

kLogHTML('<FONT COLOR="#FF0000" SIZE="+1"><U><B>TEST SETUP</B></U></FONT>');

#------------------------------#
# register IKEv2.pm            #
#------------------------------#
unless (IKEv2initialize('EN', 'EN')) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">IKEv2 module initializing failure</FONT>');
}


#------------------------------#
# configure TN                 #
#------------------------------#
unless (IKEv2setupTN()) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">TN setup failure</FONT>');
}


#------------------------------#
# configure NUT                #
#------------------------------#
unless (IKEv2setupNUT()) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">NUT setup failure</FONT>');
}

kLogHTML('<FONT COLOR="#FF0000" SIZE="+1"><U><B>TEST PROCEDURE</B></U></FONT>');
kLogHTML('<FONT COLOR="#000000" SIZE="+1"><U><B>Part C: Multiple Proposals for IKE_SA.</B></U></FONT>');



#------------------------------#
# prepare session handler      #
#------------------------------#
$session = IKEv2create_session('common_remote_index');
unless (defined($session)) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">IKEv2 session creation failure</FONT>');
}



#------------------------------#
# prepare IKE_SA_INIT Request  #
#------------------------------#
my $common1_ike_sa_init_req = IKEv2load_packet($gen_ike_sa_init_req,'common_remote_index');
my @tmp_ike_sa_init_req = @{$common1_ike_sa_init_req};
# change Protocol ID and get proposal
for (my $i = 0; $i < scalar(@tmp_ike_sa_init_req); $i++) {
        my $payload = $tmp_ike_sa_init_req[$i];

        if ($payload->{'self'} eq 'SA') {
		$second_proposal = @{$payload->{'proposals'}}[0];
	}
}
# change Transform ID
foreach my $transform (@{$second_proposal->{'transforms'}}) {
	if ($transform->{'type'} eq 'INTEG') {
		$transform->{'id'} = 'AES_XCBC_96';
	}
}

# add second proposal
my $common2_ike_sa_init_req = $gen_ike_sa_init_req->{'common_remote_index'};
@local_ike_sa_init_req = @{$common2_ike_sa_init_req};
for (my $i = 0; $i < scalar(@local_ike_sa_init_req); $i++) {
        my $payload = $local_ike_sa_init_req[$i];

        if ($payload->{'self'} eq 'SA') {
		unshift(@{$payload->{'proposals'}}, $second_proposal);
        }
}
$gen_ike_sa_init_req->{'EN-R-1-1-7-3.C.1'} = \@local_ike_sa_init_req;



#--------------------------------------#
# send IKE_SA_INIT request to NUT      #
#--------------------------------------#
$str  = '<PRE>';
$str .= "    (R)             (I)\n";
$str .= "    NUT             TN1\n";
$str .= "     |               |\n";
$str .= "     |<--------------| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)\n";
$str .= "     |               |\n";
$str .= "     V               V";
$str .= '</PRE>';
                          
kLogHTML($str);


$ike_sa_init_req_param = devel_IKEv2send_IKE_SA_INIT_request($session,
                                                             'EN-R-1-1-7-3.C.1');
unless (defined($ike_sa_init_req_param)) {
	kLogHTML(kDump_Common_Error());
	IKEv2exitFatal('<FONT COLOR="#ff0000">Can\'t send IKE_SA_INIT request.</FONT>');
}



#--------------------------------------#
# receive IKE_SA_INIT response by NUT  #
#--------------------------------------#
$str  = '<PRE>';
$str .= "    (R)             (I)\n";
$str .= "    NUT             TN1\n";
$str .= "     |               |\n";
$str .= "     |-------------->| IKE_SA_INIT response (HDR, SAr1, KEr, Nr)\n";
$str .= "     |               |\n";
$str .= "     V               V";
$str .= '</PRE>';

kLogHTML($str);


$ike_sa_init_resp_param = devel_IKEv2receive_IKE_SA_INIT_response($session,
                                                                  $remote,
                                                                  $ike_sa_init_req_param);
unless (defined($ike_sa_init_resp_param)) {
	kLogHTML(kDump_Common_Error());
	kLogHTML('<FONT COLOR="#ff0000">Can\'t observe IKE_SA_INIT response.</FONT>');
	IKEv2exitFail();
}



#--------------------------------------#
# exit with cleanup                    #
#--------------------------------------#
IKEv2exitPass();

#
# perldoc
#
########################################################################
__END__

=head1 Title

  Test IKEv2.EN.R.1.1.6.4: Receiving Multiple Proposals for IKE_SA
  Part C: Multiple Integrity Algorithms (BASIC) 

=head1 Purpose

  To verify an IKEv2 device properly handles IKE_SA_INIT request with multiple proposals.

=head1 References

  * [RFC 4306] - Sections 2.7, 3.4 and 3.10.1
  * [RFC 4718] - Sections 2.1 and 2.2

=head1 Test Setup

  * Network Topology
      Connect the devices according to the Common Topology.
  * Configuration
      In each part, configure the devices according to the Common Configuration.
  * Pre-Sequence and Cleanup Sequence
      IKEv2 on the NUT is disabled after each part.

=head1 Procedure

=begin html

<BLOCKQUOTE>
<PRE>

   NUT                  TN1
(End-Node)           (End-Node)
    |                    |
    |<-------------------| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)
    |                    | (Packet #1)
    |------------------->| IKE_SA_INIT response (HDR, SAr1, KEr, Nr)
    |                    | (Judgement #1)
    |                    |
    V                    V<br>
<br>
</BLOCKQUOTE>

<BLOCKQUOTE>
<TABLE BORDER>
<TR>
<TD><TT>Packet #1</TT></TD>
<TD><TT>See below</TT></TD>
</TR>
</TABLE>
</BLOCKQUOTE>
<br>

<BLOCKQUOTE>
  From part A to part D, TN1 transmits an IKE_SA_INIT request including a SA payload
  which contains the transforms as follows:
<TABLE BORDER>
<TR>
<TD></TD>
<TD colspan="6">IKE_SA_INIT exchanges Algorithms</TD>
</TR>
<TR>
<TD></TD>
<TD>Proposals</TD>
<TD>Protocol ID</TD>
<TD>Encryption</TD>
<TD>PRF</TD>
<TD>Integrity</TD>
<TD>D-H Group</TD>
</TR>
<TR>
<TD rowspan="2">Part C</TD>
<TD>Proposal #1</TD>
<TD>IKE</TD>
<TD>ENCR_3DES</TD>
<TD>PRF_HMAC_SHA1</TD>
<TD>AUTH_AES_XCBC_96</TD>
<TD>Group 2</TD>
</TR>
<TR>
<TD>Proposal #2</TD>
<TD>IKE</TD>
<TD>ENCR_3DES</TD>
<TD>PRF_HMAC_SHA1</TD>
<TD>AUTH_HMAC_SHA1_96</TD>
<TD>Group 2</TD>
</TR>
</TABLE>
</BLOCKQUOTE>
<br>

<br>
<BLOCKQUOTE>
  * Packet #1 IKE_SA_INIT request
<TABLE BORDER>
<TR>
<TD>IPv6 Header</TD>
<TD colspan="2">Same as the Common Packet #1</TD>
</TR>
<TR>
<TD>UDP Header</TD>
<TD colspan="2">Same as the Common Packet #1</TD>
</TR>
<TR>
<TD>IKEv2 Header</TD>
<TD colspan="2">Same as the Common Packet #1</TD>
</TR>
<TR>
<TD rowspan="2">SA Payload</TD>
<TD colspan="2">Other fields are same as the common packet #1</TD>
</TR>
<TR>
<TD>SA Proposals</TD>
<TD>See SA Table below</TD>
</TR>
<TR>
<TD>KE Payload</TD>
<TD colspan="2">Same as the Common Packet #1</TD>
</TR>
<TR>
<TD>Ni, Nr Payload</TD>
<TD colspan="2">Same as the common packet #1</TD>
</TR>
</TABLE>
</BLOCKQUOTE>
<br>

<br>
<BLOCKQUOTE>
<TABLE BORDER>
<TR>
<TD rowspan="31">Proposal #1</TD>
<TD rowspan="31">SA Proposal</TD>
<TD colspan="2">Next Payload</TD>
<TD>2 (more)</TD>
</TR>
<TR>
<TD colspan="2">Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD colspan="2">Proposal Length</TD>
<TD>44</TD>
</TR>
<TR>
<TD colspan="2">Proposal #</TD>
<TD>1</TD>
</TR>
<TR>
<TD colspan="2">Protocol ID</TD>
<TD>1 (IKE)</TD>
</TR>
<TR>
<TD colspan="2">SPI Size</TD>
<TD>0</TD>
</TR>
<TR>
<TD colspan="2"># of Transforms</TD>
<TD>5</TD>
</TR>
<TR>

<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>3 (more)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>1 (ENCR)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>According to above configuration</TD>
</TR>
<TR>

<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>3 (more)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>2 (PRF)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>According to above configuration</TD>
</TR>

<TR>
<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>3 (more)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>3 (INTEG)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>According to above configuration</TD>
</TR>

<TR>
<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>0 (last)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>4 (D-H)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>According to above configuration</TD>
</TR>
<TR>

<TR>
<TD rowspan="31">Proposal #2</TD>
<TD rowspan="31">SA Proposal</TD>
<TD colspan="2">Next Payload</TD>
<TD>0 (last)</TD>
</TR>
<TR>
<TD colspan="2">Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD colspan="2">Proposal Length</TD>
<TD>44</TD>
</TR>
<TR>
<TD colspan="2">Proposal #</TD>
<TD>2</TD>
</TR>
<TR>
<TD colspan="2">Protocol ID</TD>
<TD>1 (IKE)</TD>
</TR>
<TR>
<TD colspan="2">SPI Size</TD>
<TD>0</TD>
</TR>
<TR>
<TD colspan="2"># of Transforms</TD>
<TD>5</TD>
</TR>
<TR>

<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>3 (more)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>1 (ENCR)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>3 (3DES)</TD>
</TR>
<TR>

<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>3 (more)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>2 (PRF)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>2 (HMAC_SHA1)</TD>
</TR>

<TR>
<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>3 (more)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>3 (INTEG)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>2 (HMAC_SHA1_96)</TD>
</TR>

<TR>
<TD rowspan="6">SA Transform</TD>
<TD>Next Payload</TD>
<TD>0 (last)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform Length</TD>
<TD>8</TD>
</TR>
<TR>
<TD>Transform Type</TD>
<TD>4 (D-H)</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Transform ID</TD>
<TD>2 (1024 MODP Group)</TD>
</TR>
<TR>

</TABLE>
</BLOCKQUOTE>

=end html

  Part C: Multiple Integrity Algorithms (BASIC)
      13. TN1 starts to negotiate with NUT by sending IKE_SA_INIT request including a SA payload
          as described above.
      14. Observe the messages transmitted on Link A.


=head1 Observable Result

  Part C
    Step 6: Judgment #1
      The NUT transmits an IKE_SA_INIT response including "ENCR_3DES",
      "PRF_HMAC_SHA1", "AUTH_HMAC_SHA1_96" and "D-H group 2" as accepted
      algorithms.

=head1 Possible Problems

  * None.

=cut

