esp: support dynamic load of esp for tests.

Author: philljj

.github/workflows/linux.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Run standalone "IPsec esp" test
         run: |
           sudo ./tools/ip-xfrm/rfc4106 128
-          sudo ./build/test-esp
+          sudo ./build/test-esp -m 0
           sudo killall tcpdump || true
           sudo ./tools/ip-xfrm/delete_all
 

src/test/esp_sa_list.c

@@ -31,16 +31,22 @@
 #include <sys/select.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <unistd.h>
+/* wolfip includes */
 #include "config.h"
 #include "wolfip.h"
 #include "wolfesp.h"
 
+static void __attribute__((noreturn)) print_usage_and_die(void);
+#if 0
 #include "esp_sa_list.c"
+#endif
 
 #define TEST_SIZE (12 * 1024)
 
 #define BUFFER_SIZE TEST_SIZE
 
+static int disable_ipsec = 0;
 static int listen_fd = -1, client_fd = -1;
 static int exit_ok = 0, exit_count = 0;
 static uint8_t buf[TEST_SIZE];
@@ -51,9 +57,34 @@ static int closed = 0;
 static int conn_fd = -1;
 static int client_connected = 0;
 /* "Test pattern - -" 16 chars without trailing null. */
-static const uint8_t test_pattern[16] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x70,
-                                         0x61, 0x74, 0x74, 0x65, 0x72, 0x6e,
-                                         0x20, 0x2d, 0x20, 0x2d};
+static const uint8_t test_pattern[16] =
+    {0x54, 0x65, 0x73, 0x74, 0x20, 0x70,
+     0x61, 0x74, 0x74, 0x65, 0x72, 0x6e,
+     0x20, 0x2d, 0x20, 0x2d};
+static uint8_t in_sa_gcm[ESP_SPI_LEN] = {0x01, 0x01, 0x01, 0x01};
+static uint8_t out_sa_gcm[ESP_SPI_LEN] = {0x02, 0x02, 0x02, 0x02};
+static uint8_t in_sa_cbc[ESP_SPI_LEN] = {0x03, 0x03, 0x03, 0x03};
+static uint8_t out_sa_cbc[ESP_SPI_LEN] = {0x04, 0x04, 0x04, 0x04};
+/* 32 byte key + 4 byte nonce*/
+static uint8_t in_enc_key[36] =
+     {0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
+      0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
+      0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
+      0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
+      0x0a, 0x0b, 0x0c, 0x0d};
+static uint8_t out_enc_key[36] =
+     {0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
+      0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
+      0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
+      0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
+      0x0a, 0x0b, 0x0c, 0x0d};
+
+static uint8_t in_auth_key[16] =
+     {0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+      0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01};
+static uint8_t out_auth_key[16] =
+     {0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
+      0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02};
 
 
 /* wolfIP: server side callback. */
@@ -494,14 +525,36 @@ int main(int argc, char **argv)
     struct in_addr         host_stack_ip;
     uint32_t               srv_ip = 0;
     int                    err = 0;
+    int                    opt = 0;
+    int                    mode = 0; /* 0 aead example, 1 cbc-auth example*/
+
+    while ((opt = getopt(argc, argv, "pm:?")) != -1) {
+        switch (opt) {
+        case 'p':
+            disable_ipsec = 1;
+            break;
+        case 'm':
+            mode = atoi(optarg);
+            break;
+        case '?':
+            print_usage_and_die();
+            break;
+        default: /* '?' */
+            fprintf(stderr, "Usage: %s [-t nsecs] [-n] name\n",
+                    argv[0]);
+            exit(EXIT_FAILURE);
+        }
+    }
 
     (void)argc;
     (void)argv;
 
-    err = wolfIP_esp_init();
-    if (err) {
-        perror("esp_init");
-        return 2;
+    if (!disable_ipsec) {
+        err = wolfIP_esp_init();
+        if (err) {
+            perror("esp_init");
+            return 2;
+        }
     }
 
     wolfIP_init_static(&s);
@@ -532,8 +585,36 @@ int main(int argc, char **argv)
     printf("IP: manually configured\n");
     inet_pton(AF_INET, WOLFIP_IP, &srv_ip);
 
-    wolfIP_esp_load_sa_list(test_in_sa_list, WOLFIP_ESP_NUM_SA, 1);
-    wolfIP_esp_load_sa_list(test_out_sa_list, WOLFIP_ESP_NUM_SA, 0);
+    if (!disable_ipsec) {
+        switch (mode) {
+        case 0:
+            err = wolfIP_esp_sa_new_aead(1, in_sa_gcm, atoip4(HOST_STACK_IP),
+                                         atoip4(WOLFIP_IP),
+                                         in_enc_key, sizeof(in_enc_key));
+
+            err = wolfIP_esp_sa_new_aead(0, out_sa_gcm, atoip4(WOLFIP_IP),
+                                         atoip4(HOST_STACK_IP),
+                                         out_enc_key, sizeof(out_enc_key));
+            break;
+
+        case 1:
+            err = wolfIP_esp_sa_new_cbc_sha256(1, in_sa_cbc, atoip4(HOST_STACK_IP),
+                                               atoip4(WOLFIP_IP),
+                                               in_enc_key, sizeof(in_enc_key) - 4,
+                                               in_auth_key, sizeof(in_auth_key),
+                                               ESP_ICVLEN_HMAC_128);
+
+            err = wolfIP_esp_sa_new_cbc_sha256(0, out_sa_cbc, atoip4(WOLFIP_IP),
+                                               atoip4(HOST_STACK_IP),
+                                               out_enc_key, sizeof(out_enc_key - 4),
+                                               out_auth_key, sizeof(out_auth_key),
+                                               ESP_ICVLEN_HMAC_128);
+            break;
+
+        default:
+            break;
+        }
+    }
 
     /* Server side test */
     test_wolfip_echoserver(s, srv_ip);
@@ -546,3 +627,14 @@ int main(int argc, char **argv)
 #endif
     return 0;
 }
+
+static void
+print_usage_and_die(void)
+{
+    printf("./test-esp [-m <mode>] [-p]\n");
+    printf("\n");
+    printf("options:\n");
+    printf("  -p         force plaintext (disable ipsec)\n");
+    printf("  -m <mode>  0 aead (default), 1 cbc auth\n");
+    exit(1);
+}