#!/usr/bin/perl
#
# $Copyright$
#
# $Id: RTU_A_In_DM_DSTH_opttype.seq,v 1.1.1.1 2000/10/31 22:38:51 sekiya Exp $
#
######################################################################
BEGIN {
    unshift(@INC, '../ipsec/');
    $V6evalTool::TestVersion = '$Name:  $ ';
}

use V6evalTool;
use IPSEC;

%pktdesc = (
            ### TBD
);
$IF0 = Link0;
$IF1 = Link1;

#----- check NUT type

ipsecCheckNUT(router);

#----- set SAD,SPD
vLogHTML("<FONT SIZE=3>*** Target initialization phase ***</FONT><BR>");

ipsecClearAll();

## SG1 vs NUT
ipsecSetSAD(
	"src=$IPSEC::IPsecAddr{IPSEC_SG1_NET2_ADDR}" ,
	"dst=$IPSEC::IPsecAddr{IPSEC_NUT_NET0_ADDR}" ,
	"spi=0x1000" ,
	"mode=tunnel" ,
	"direction=in" ,
	"protocol=ah" ,
	"aalgo=hmac-md5" ,
	"aalgokey=0123456789ABCDEF",
	"nsrc=$IPSEC::IPsecAddr{IPSEC_NET4_ADDR}" ,
	"ndst=$IPSEC::IPsecAddr{IPSEC_NET1_ADDR}" ,
	);

# No SPD entry
#
#ipsecSetSPD(
#	"src=$IPSEC::IPsecAddr{IPSEC_NET4_ADDR}" ,
#	"dst=$IPSEC::IPsecAddr{IPSEC_NET1_ADDR}" ,
#	"upperspec=any" ,
#	"direction=in" ,
#	"protocol=ah" ,
#	"mode=tunnel" ,
#	"tsrc=$IPSEC::IPsecAddr{IPSEC_SG1_NET2_ADDR}" ,
#	"tdst=$IPSEC::IPsecAddr{IPSEC_NUT_NET0_ADDR}" ,
#	);

ipsecEnable();

#======================================================================
vLogHTML("<FONT SIZE=3>*** Target testing phase ***<FONT><BR>");
vCapture($IF0);
vCapture($IF1);
$test_result = 'PASS';

#           NET1     NET0     NET2    NET4
#  HOST1_NET1 <- NUT <- Router <- SG1 <- HOST1_NET4
#                 <====tunnel=====

#### subtest No.1
$subtest_no = 1;
$subtest_title[$subtest_no] = "option bit 000: option type is immutable";
vLogHTML("<FONT SIZE=4>Subtest No.$subtest_no: $subtest_title[$subtest_no]</FONT><BR>");
$csts = 'PASS'; #initialize current subtest status

($stat, %ret) = ipsecForwardDecap($IF0, $IF1, 
    'ahtun_from_sg1_net2_dstopt_echo_request_from_host1_net4_to_host1_net1_on_net0',
    'echo_request_from_host1_net4_to_host1_net1_on_net1');
$csts = 'FAIL' if $stat ne 'GOT_PACKET';

if ($csts eq 'PASS') {
    ($stat, %ret) = ipsecForwardDecap($IF0, $IF1, 
        'ahtun_from_sg1_net2_dm_dsth_000opttype_echo_request_from_host1_net4_to_host1_net1_on_net0',
        'echo_request_from_host1_net4_to_host1_net1_on_net1');
    if($stat eq 'NO_PACKET') {
	vLogHTML("TN received no decapsulated packet from HOST1_NET4 to HOST1_NET1.<BR>");
    }
    else{
	vLogHTML("TN received something packet from NUT to HOST1_NET1.<BR>");
	$csts = 'FAIL';
    }
}
vLogHTML("Subtest No.$subtest_no $csts<BR><BR>");
$subtest_results[$subtest_no] = $csts;


#### subtest No.2
$subtest_no = 2;
$subtest_title[$subtest_no] = "option bit 001: option type is immutable";
vLogHTML("<FONT SIZE=4>Subtest No.$subtest_no: $subtest_title[$subtest_no]</FONT><BR>");
$csts = 'PASS'; #initialize current subtest status

($stat, %ret) = ipsecForwardDecap($IF0, $IF1, 
    'ahtun_from_sg1_net2_dm_dsth_001opttype_echo_request_from_host1_net4_to_host1_net1_on_net0',
    'echo_request_from_host1_net4_to_host1_net1_on_net1');
if($stat eq 'NO_PACKET') {
    vLogHTML("TN received no decapsulated packet from HOST1_NET4 to HOST1_NET1.<BR>");
}
else{
    vLogHTML("TN received something packet from NUT to HOST1_NET1.<BR>");
    $csts = 'FAIL';
}
vLogHTML("Subtest No.$subtest_no $csts<BR><BR>");
$subtest_results[$subtest_no] = $csts;


### resluts table
vLogHTML("Subtest Results<BR>");
for($i=1; $i < @subtest_title; $i++) {
    vLogHTML("|$i| $subtest_title[$i] | $subtest_results[$i] |<BR>");
    $test_results = 'FAIL' if $subtest_results[$i] eq 'FAIL';
}

if ($test_results eq 'FAIL') {
    ipsecExitFail();
}else{
    ipsecExitPass();
}


######################################################################
__END__

=head1 NAME

  RTU_A_In_DM_DSTH_opttype - Router Tunnel Mode AH Inbound, Detect modification of DstOpt header option type before AH


=head1 TARGET

  Router

=head1 SYNOPSIS

=begin html
<PRE>
  <A HREF="./RTU_A_In_DM_DSTH_opttype.seq">RTU_A_In_DM_DSTH_opttype.seq</A> [-tooloption ...] -pkt <A HREF="./RTU_A_DM_DSTH_opttype.def">RTU_A_DM_DSTH_opttype.def</A>
    -tooloption : v6eval tool option
  See also <A HREF="./HTR_A_common.def">HTR_A_common.def</A> and <A HREF="./HTR_common.def">HTR_common.def</A>
</PRE>

=end html

=head1 INITIALIZATION

=begin html
<P>
For details of Network Topology, see <A HREF="00README">00README</A>
</P>
<P>
Set NUT's SAD and SPD as following:
</P>
<PRE>
                          (Link0)  (Link1)
            NET4   NET2      NET0   NET1
  HOST1_NET4 -- SG1 -- Router -- NUT -- HOST1_NET1
                 =====tunnel======>
</PRE>
<P>
Security Association Database (SAD)
</P>
<TABLE border="1">
  <TR>
    <TD>source address</TD>
    <TD>SG1_NET2</TD></TR>
  <TR>
    <TD>destination address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD>mode</TD>
    <TD>tunnel</TD></TR>
  <TR>
    <TD>protocol</TD>
    <TD>AH</TD></TR>
  <TR>
    <TD>AH algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD>AH algorithm key</TD>
    <TD>0123456789ABCDEF</TD></TR>
</TABLE>
<P>
Security Policy Database (SPD)
</P>
<TABLE border="1">
  <TR><TD>No SPD entry</TD></TR>
<!--
  <TR>
    <TD>tunnel source address</TD>
    <TD>SG1_NET2</TD></TR>
  <TR>
    <TD>tunnel destination address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>source address</TD>
    <TD>NET4</TD></TR>
  <TR>
    <TD>destination address</TD>
    <TD>NET1</TD></TR>
  <TR>
    <TD>upper spec</TD>
    <TD>any</TD></TR>
  <TR>
    <TD>direction</TD>
    <TD>in</TD></TR>
  <TR>
    <TD>protocol</TD>
    <TD>AH</TD></TR>
  <TR>
    <TD>mode</TD>
    <TD>tunnel</TD></TR>
-->
</TABLE>

=end html

=head1 TEST PROCEDURE

=begin html
<PRE>
 Tester                      Target                      Tester
              (Link0)                     (Link1)
   |                           |                           |
 Subtest No.1 "option bit 000: option type is immutable"
   |                           |                           |
   |-------------------------->|                           |
   |      ICMP Echo Request    |                           |
   |  within [DSTH][AH] tunnel |                           |
   |                           |-------------------------->|
   |                           |      ICMP Echo Request    |
   |                           |        Judgement #1       |
   |                           |                           |
   |-------------------------->|                           |
   |      ICMP Echo Request    |                           |
   |  within [DSTH][AH] tunnel |                           |
   |  (option type of DSTH is modified 0x02->0x22)         |
   |                           | (---------------------->) |
   |                           |     No ICMP Echo Request  |
   |                           |        Judgement #2       |
   |                           |                           |
   v                           v                           v
 Subtest No.2 "option bit 001: option type is immutable"
   |                           |                           |
   |-------------------------->|                           |
   |      ICMP Echo Request    |                           |
   |  within [DSTH][AH] tunnel |                           |
   |  (option type of DSTH is modified 0x22->0x23)         |
   |                           | (---------------------->) |
   |                           |     No ICMP Echo Request  |
   |                           |        Judgement #3       |
   |                           |                           |
   v                           v                           v
</PRE>
<P>
ICMP Echo Request within [DSTH][AH] tunnel to Link0
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>SG1_NET2</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>Destination Options Header</TD>
    <TD>Type</TD>
    <TD>0x02</TD></TR>
  <TR>
    <TD></TD>
    <TD>Data Length</TD>
    <TD>4</TD></TR>
  <TR>
    <TD></TD>
    <TD>Data</TD>
    <TD>0x0f0f0000</TD></TR>
  <TR>
    <TD>AH</TD>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD></TD>
    <TD>Sequence Number</TD>
    <TD>1</TD></TR>
  <TR>
    <TD></TD>
    <TD>Algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD></TD>
    <TD>Key</TD>
    <TD>0123456789ABCDEF</TD></TR>
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET4</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>128 (Echo Request)</TD></TR>
</TABLE>
<P>
ICMP Echo Request from Link1
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET4</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>128 (Echo Request)</TD></TR>
</TABLE>
<P>
Send ICMP Echo Request within [DSTH][AH] tunnel (option type of DSTH is modified 0x02->0x22) to Link0
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>SG1_NET2</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>Destination Options Header</TD>
    <TD>Type</TD>
    <TD>0x22 (0x02 is original)</TD></TR>
  <TR>
    <TD></TD>
    <TD>Data Length</TD>
    <TD>4</TD></TR>
  <TR>
    <TD></TD>
    <TD>Data</TD>
    <TD>0x0f0f0000</TD></TR>
  <TR>
    <TD>AH</TD>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD></TD>
    <TD>Sequence Number</TD>
    <TD>2</TD></TR>
  <TR>
    <TD></TD>
    <TD>Algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD></TD>
    <TD>Key</TD>
    <TD>0123456789ABCDEF</TD></TR>
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET4</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>128 (Echo Request)</TD></TR>
</TABLE>
<P>
Send ICMP Echo Request within [DSTH][AH] tunnel (option type of DSTH is modified 0x22->0x23) to Link0
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>SG1_NET2</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>Destination Options Header</TD>
    <TD>Type</TD>
    <TD>0x23 (0x22 is original)</TD></TR>
  <TR>
    <TD></TD>
    <TD>Data Length</TD>
    <TD>4</TD></TR>
  <TR>
    <TD></TD>
    <TD>Data</TD>
    <TD>0x0f0f0000</TD></TR>
  <TR>
    <TD>AH</TD>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD></TD>
    <TD>Sequence Number</TD>
    <TD>3</TD></TR>
  <TR>
    <TD></TD>
    <TD>Algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD></TD>
    <TD>Key</TD>
    <TD>0123456789ABCDEF</TD></TR>
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET4</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>128 (Echo Request)</TD></TR>
</TABLE>


=end html

=head1 JUDGEMENT

  Judgement #1:
      Receive ICMP Echo Request from Link1 (MUST)
  Judgement #2:
      Receive nothing (MUST)
  Judgement #3:
      Receive nothing (MUST)

=head1 SEE ALSO

  perldoc V6evalTool

=begin html
<PRE>
  <A HREF="./IPSEC.html">IPSEC.html</A> IPsec Test Common Utility
</PRE>

=end html

=cut