#!/usr/bin/perl
#
# $Copyright$
#
# $Id: RTU_A_Out_2SA_SspiDipdst.seq,v 1.1.1.1 2000/10/31 22:38:52 sekiya Exp $
#
######################################################################
BEGIN {
    unshift(@INC, '../ipsec/');
    $V6evalTool::TestVersion = '$Name:  $ ';
}

use V6evalTool;
use IPSEC;

%pktdesc = (
            ### TBD
);
$IF0 = Link0;
$IF1 = Link1;

#----- check NUT type

ipsecCheckNUT(router);

#----- set SAD,SPD
vLogHTML("<FONT SIZE=3>*** Target initialization phase ***</FONT><BR>");

ipsecClearAll();

## SG1 vs NUT
ipsecSetSAD(
	"src=$IPSEC::IPsecAddr{IPSEC_NUT_NET0_ADDR}" ,
	"dst=$IPSEC::IPsecAddr{IPSEC_SG1_NET2_ADDR}" ,
	"spi=0x1000" ,
	"mode=tunnel" ,
	"direction=out" ,
	"protocol=ah" ,
	"aalgo=hmac-md5" ,
	"aalgokey=0123456789ABCDEF" ,
	"nsrc=$IPSEC::IPsecAddr{IPSEC_NET1_ADDR}" ,
	"ndst=$IPSEC::IPsecAddr{IPSEC_NET4_ADDR}" ,
	);

ipsecSetSPD(
	"src=$IPSEC::IPsecAddr{IPSEC_NET1_ADDR}" ,
	"dst=$IPSEC::IPsecAddr{IPSEC_NET4_ADDR}" ,
	"upperspec=any" ,
	"direction=out" ,
	"protocol=ah" ,
	"mode=tunnel" ,
	"tsrc=$IPSEC::IPsecAddr{IPSEC_NUT_NET0_ADDR}" ,
	"tdst=$IPSEC::IPsecAddr{IPSEC_SG1_NET2_ADDR}" ,
	);

## SG2 vs NUT
ipsecSetSAD(
	"src=$IPSEC::IPsecAddr{IPSEC_NUT_NET0_ADDR}" ,
	"dst=$IPSEC::IPsecAddr{IPSEC_SG2_NET2_ADDR}" ,
	"spi=0x1000" ,
	"mode=tunnel" ,
	"direction=out" ,
	"protocol=ah" ,
	"aalgo=hmac-md5" ,
	"aalgokey=foo0foo1foo2foo3" ,
	"nsrc=$IPSEC::IPsecAddr{IPSEC_NET1_ADDR}" ,
	"ndst=$IPSEC::IPsecAddr{IPSEC_NET6_ADDR}" ,
	);

ipsecSetSPD(
	"src=$IPSEC::IPsecAddr{IPSEC_NET1_ADDR}" ,
	"dst=$IPSEC::IPsecAddr{IPSEC_NET6_ADDR}" ,
	"upperspec=any" ,
	"direction=out" ,
	"protocol=ah" ,
	"mode=tunnel" ,
	"tsrc=$IPSEC::IPsecAddr{IPSEC_NUT_NET0_ADDR}" ,
	"tdst=$IPSEC::IPsecAddr{IPSEC_SG2_NET2_ADDR}" ,
	);

ipsecEnable();

#======================================================================
vLogHTML("<FONT SIZE=3>*** Target testing phase ***<FONT><BR>");
vCapture($IF0);
vCapture($IF1);


# ====tunnel-1===>

($stat, %ret) = ipsecForwardEncap($IF1, $IF0, 
    'echo_reply_from_host1_net1_to_host1_net4_on_net1',
    'ahtun_to_sg1_net2_echo_reply_from_host1_net1_to_host1_net4_on_net0');

if ($stat ne 'GOT_PACKET') {
    vLogHTML('TN received no encapuslated packet from NUT<BR>');
    ipsecExitFail();
}

vLogHTML("TN received encapsulated packet from HOST1_NET1 to HOST1_NET4.<BR>");
vLogHTML("Tunnel over 1st SA bundle is available.<BR>");


# ====tunnel-2===>

($stat, %ret) = ipsecForwardEncap($IF1, $IF0, 
    'echo_reply_from_host1_net1_to_host1_net6_on_net1',
    'ahtun_to_sg2_net2_echo_reply_from_host1_net1_to_host1_net6_on_net0');

if ($stat ne 'GOT_PACKET') {
    vLogHTML('TN received no encapuslated packet from NUT<BR>');
    ipsecExitFail();
}

vLogHTML("TN received encapsulated packet from HOST1_NET1 to HOST1_NET6.<BR>");
vLogHTML("Tunnel over 2nd SA bundle is available.<BR>");

vLogHTML("Tunnel over coexisting two SA bundles are available.<BR>");
ipsecExitPass();


######################################################################
__END__

=head1 NAME

  RTU_A_Out_2SA_SspiDipdst - Router Tunnel Mode AH Outbound 2 SA selection, Same SPI, Different IPdst


=head1 TARGET

  Router

=head1 SYNOPSIS

=begin html
<PRE>
  <A HREF="./RTU_A_Out_2SA_SspiDipdst.seq">RTU_A_Out_2SA_SspiDipdst.seq</A> [-tooloption ...] -pkt <A HREF="./RTU_A_2SA_SspiDip.def">RTU_A_2SA_SspiDip.def</A>
    -tooloption : v6eval tool option
  See also <A HREF="./HTR_A_common.def">HTR_A_common.def</A> and <A HREF="./HTR_common.def">HTR_common.def</A>
</PRE>

=end html

=head1 INITIALIZATION

=begin html
<P>
For details of Network Topology, see <A HREF="00README">00README</A>
</P>
<P>
Set NUT's SAD and SPD as following:
</P>
<PRE>
                          (Link0)  (Link1)
            NET4   NET2      NET0   NET1
  HOST1_NET4 -- SG1 +- Router -- NUT -- HOST1_NET1
                 <==|=tunnel======= (SA1)
            NET6    |
  HOST1_NET6 -- SG2 +
                 <====tunnel======= (SA2)
</PRE>
<P>
Security Association Database (SAD) for SA1
</P>
<TABLE border="1">
  <TR>
    <TD>source address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>destination address</TD>
    <TD><B>SG1_NET2</B></TD></TR>
  <TR>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD>mode</TD>
    <TD>tunnel</TD></TR>
  <TR>
    <TD>protocol</TD>
    <TD>AH</TD></TR>
  <TR>
    <TD>AH algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD>ESP algorithm key</TD>
    <TD>0123456789ABCDEF</TD></TR>
</TABLE>
<P>
Security Policy Database (SPD) for SA1
</P>
<TABLE border="1">
  <TR>
    <TD>tunnel source address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>tunnel destination address</TD>
    <TD><B>SG1_NET2</B></TD></TR>
  <TR>
    <TD>source address</TD>
    <TD>NET1</TD></TR>
  <TR>
    <TD>destination address</TD>
    <TD><B>NET4</B></TD></TR>
  <TR>
    <TD>upper spec</TD>
    <TD>any</TD></TR>
  <TR>
    <TD>direction</TD>
    <TD>out</TD></TR>
  <TR>
    <TD>protocol</TD>
    <TD>AH</TD></TR>
  <TR>
    <TD>mode</TD>
    <TD>tunnel</TD></TR>
</TABLE>
<P>
Security Association Database (SAD) for SA2
</P>
<TABLE border="1">
  <TR>
    <TD>source address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>destination address</TD>
    <TD><B>SG2_NET2</B></TD></TR>
  <TR>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD>mode</TD>
    <TD>tunnel</TD></TR>
  <TR>
    <TD>protocol</TD>
    <TD>AH</TD></TR>
  <TR>
    <TD>AH algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD>AH algorithm key</TD>
    <TD>foo0foo1foo2foo3</TD></TR>
</TABLE>
<P>
Security Policy Database (SPD) for SA2
</P>
<TABLE border="1">
  <TR>
    <TD>tunnel source address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD>tunnel destination address</TD>
    <TD><B>SG2_NET2</B></TD></TR>
  <TR>
    <TD>source address</TD>
    <TD>NET1</TD></TR>
  <TR>
    <TD>destination address</TD>
    <TD><B>NET6</B></TD></TR>
  <TR>
    <TD>upper spec</TD>
    <TD>any</TD></TR>
  <TR>
    <TD>direction</TD>
    <TD>out</TD></TR>
  <TR>
    <TD>protocol</TD>
    <TD>AH</TD></TR>
  <TR>
    <TD>mode</TD>
    <TD>tunnel</TD></TR>
</TABLE>

=end html

=head1 TEST PROCEDURE

=begin html
<PRE>
 Tester                      Target                      Tester
              (Link0)                     (Link1)
   |                           |                           |
   |                           |<--------------------------|
   |                           |      ICMP Echo Reply      |
   |                           |       ToHost1Net4         |
   |                           |                           |
   |<--------------------------|                           |
   |      ICMP Echo Reply      |                           |
   |       ToHost1Net4         |                           |
   |        (using SA1)        |                           |
   |                           |                           |
   |                           |                           |
   |                           |<--------------------------|
   |                           |      ICMP Echo Reply      |
   |                           |       ToHost1Net6         |
   |                           |                           |
   |<--------------------------|                           |
   |      ICMP Echo Reply      |                           |
   |       ToHost1Net6         |                           |
   |        (using SA2)        |                           |
   |                           |                           |
   |                           |                           |
   v                           v                           v
</PRE>
<OL>
  <LI>Send ICMP Echo Reply ToHost1Net4 to Link1
  <LI>Receive ICMP Echo Reply ToHost1Net4 using SA1 from Link0
  <LI>Send ICMP Echo Reply ToHost1Net6 to Link1
  <LI>Receive ICMP Echo Reply ToHost1Net6 using SA2 from Link0
</OL>
<P>
ICMP Echo Reply ToHost1Net4 to Link1
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD><B>HOST1_NET4<B></TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>129 (Echo Reply)</TD></TR>
</TABLE>
<P>
ICMP Echo Reply ToHost1Net4 using SA1 from Link0
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD><B>SG1_NET2</B></TD></TR>
  <TR>
    <TD>AH</TD>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD></TD>
    <TD>Algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD></TD>
    <TD>Key</TD>
    <TD>0123456789ABCDEF</TD></TR>
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD><B>HOST1_NET4</B></TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>129 (Echo Reply)</TD></TR>
</TABLE>
<P>
ICMP Echo Reply ToHost1Net6 to Link1
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD><B>HOST1_NET6<B></TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>129 (Echo Reply)</TD></TR>
</TABLE>
<P>
ICMP Echo Reply ToHost1Net6 using SA2 from Link0
</P>
<TABLE border="1">
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>NUT_NET0</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD><B>SG2_NET2</B></TD></TR>
  <TR>
    <TD>AH</TD>
    <TD>SPI</TD>
    <TD>0x1000</TD></TR>
  <TR>
    <TD></TD>
    <TD>Algorithm</TD>
    <TD>HMAC-MD5</TD></TR>
  <TR>
    <TD></TD>
    <TD>Key</TD>
    <TD>foo0foo1foo2foo3</TD></TR>
  <TR>
    <TD>IP Header</TD>
    <TD>Source Address</TD>
    <TD>HOST1_NET1</TD></TR>
  <TR>
    <TD></TD>
    <TD>Destination Address</TD>
    <TD><B>HOST1_NET6</B></TD></TR>
  <TR>
    <TD>ICMP</TD>
    <TD>Type</TD>
    <TD>129 (Echo Reply)</TD></TR>
</TABLE>


=end html

=head1 JUDGEMENT

  PASS: Both ICMP Echo Reply (using SA1, SA2) received

=head1 SEE ALSO

  perldoc V6evalTool

=begin html
<PRE>
  <A HREF="./IPSEC.html">IPSEC.html</A> IPsec Test Common Utility
</PRE>

=end html

=cut