X-Git-Url: https://git.distorted.org.uk/~mdw/tripe/blobdiff_plain/01c2190311b3eab8e861014d57ddca6160998e69..c9cb7c0c2f698be97ddafd7575a3859aed9cb518:/server/tests.at
diff --git a/server/tests.at b/server/tests.at
index ab64c538..4aadc309 100644
--- a/server/tests.at
+++ b/server/tests.at
@@ -9,19 +9,18 @@
###
### This file is part of Trivial IP Encryption (TrIPE).
###
-### TrIPE is free software; you can redistribute it and/or modify
-### it under the terms of the GNU General Public License as published by
-### the Free Software Foundation; either version 2 of the License, or
-### (at your option) any later version.
+### TrIPE is free software: you can redistribute it and/or modify it under
+### the terms of the GNU General Public License as published by the Free
+### Software Foundation; either version 3 of the License, or (at your
+### option) any later version.
###
-### TrIPE is distributed in the hope that it will be useful,
-### but WITHOUT ANY WARRANTY; without even the implied warranty of
-### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-### GNU General Public License for more details.
+### TrIPE is distributed in the hope that it will be useful, but WITHOUT
+### ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+### FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+### for more details.
###
### You should have received a copy of the GNU General Public License
-### along with TrIPE; if not, write to the Free Software Foundation,
-### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+### along with TrIPE. If not, see .
m4_define([nl], [
])
@@ -35,11 +34,34 @@ m4_define([SETUPDIR], [
## Running standard programs with useful options.
m4_define([TRIPE],
[env TRIPE_PRIVHELPER=$abs_top_builddir/priv/tripe-privhelper \
- $abs_top_builddir/server/tripe -F -d. -aadmin -p0 -b127.0.0.1 -talice])
+ $abs_top_builddir/server/tripe -F -d. -aadmin -p0 -b127.0.0.1 -talice \
+ ${TRIPE_TEST_TRACEOPTS+-T$TRIPE_TEST_TRACEOPTS}])
m4_define([TRIPECTL], [$abs_top_builddir/client/tripectl -d. -aadmin])
m4_define([USLIP], [$abs_top_builddir/uslip/tripe-uslip])
m4_define([PKSTREAM],
[$abs_top_builddir/pkstream/pkstream -b127.0.0.1 -p127.0.0.1])
+m4_define([MITM], [$abs_top_builddir/proxy/tripe-mitm])
+
+## WITH_STRACE(tag, cmd)
+##
+## There's an awful hack here. If a process running under strace exits with
+## a signal, then strace will kill itself with the same signal -- and
+## therefore clobber the original process's core file. So we arrange to run
+## strace in one directory and have the child process run in another.
+m4_define([WITH_STRACE],
+[case "${TRIPE_TEST_STRACE-nil}" in
+ nil)
+ $2
+ ;;
+ *)
+ mkdir -p strace-hack.$1/
+ (ulimit -c hard >/dev/null 2>&1
+ sh -c 'cd strace-hack.$1; exec "$[]@"' - \
+ strace -ff -tt -v -s1024 -o../$1.trace \
+ sh -c 'cd ..; exec "$[]@"' - \
+ $2)
+ ;;
+ esac])
## Sequences. (These are used for testing the replay protection machinery.)
m4_define([R32], [ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 dnl
@@ -83,24 +105,17 @@ mv stdout $1/port
## Test body...
$3
-## End of the test, now run the server. There's an awful hack here. If a
-## process running under strace exits with a signal, then strace will kill
-## itself with the same signal -- and therefore clobber the original
-## process's core file. So we arrange to run strace in one directory and
-## have the child process run in another.
+## End of the test, now run the server.
) && :; } | {
cd $1
- mkdir -p strace-hack/
echo TRIPE $2 >&2
- (cd strace-hack/
- ulimit -c hard >/dev/null 2>&1
- strace -f -o ../tripe.trace \
- TRIPE -d.. $2 >../server-output.full 2>../server-errors)
+ WITH_STRACE([tripe], [TRIPE $2 >server-output.full 2>server-errors.full])
stat=$?
echo $stat >server-status
if test $stat -ne 0; then
- echo "exit status: $stat" >>server-errors
+ echo "exit status: $stat" >>server-errors.full
fi
+ grep -v '^+ tripe: ' server-errors.full >server-errors
## We interrupt this relatively sensible macro for an especially awful
## hack. The tripe server emits warnings which are often caused by lack of
@@ -151,7 +166,7 @@ $3
{
for (i = 0; i < npat; i++) {
n = length(pat[[i]]);
- if (substr($[]0, 0, n) == pat[[i]])
+ if (substr($[]0, 1, n) == pat[[i]])
next;
}
print $[]0;
@@ -181,10 +196,24 @@ m4_define([WITH_3TRIPES],
[WITH_TRIPEX([$3], [$4 $7],
[$8])])])])
-## COMMS_EPING(adir, aname, bdir, bname)
+## RETRY(n, body)
+m4_define([RETRY], [
+ n=0 rc=1
+ while test $n -lt $1; do
+ if $2
+ then rc=0; break
+ fi
+ n=$(( $n + 1 ))
+ done
+ exit $rc
+])
+
+## COMMS_EPING(adir, aname, bdir, bname, [n])
m4_define([COMMS_EPING], [
- AT_CHECK([TRIPECTL -d$1 EPING $4],, [ignore])
- AT_CHECK([TRIPECTL -d$3 EPING $2],, [ignore])
+ AT_CHECK([RETRY([m4_default([$5], [1])],
+ [TRIPECTL -d$1 EPING $4])],, [ignore])
+ AT_CHECK([RETRY([m4_default([$5], [1])],
+ [TRIPECTL -d$3 EPING $2])],, [ignore])
])
## COMMS_SLIP(adir, aname, bdir, bname)
@@ -199,9 +228,13 @@ m4_define([COMMS_SLIP], [
m4_define([AWAIT_KXDONE], [
## Ignore some reports caused by races.
- TRIPECTL -d$3 WARN test PUSH
- TRIPECTL -d$3 WARN test IGNORE WARN KX $2 incorrect cookie
- TRIPECTL -d$3 WARN test IGNORE WARN KX $2 unexpected pre-challenge
+ for i in $1!$4 $3!$2; do
+ d=${i%!*} o=${i#*!}
+ TRIPECTL -d$d WARN test PUSH
+ TRIPECTL -d$d WARN test IGNORE WARN KX $o incorrect cookie
+ TRIPECTL -d$d WARN test IGNORE WARN KX $o unexpected pre-challenge
+ TRIPECTL -d$d WARN test IGNORE WARN KX $o unexpected challenge
+ done
## Watch for the key-exchange completion announcement in the background.
COPROCESSES([wait-$1], [
@@ -212,7 +245,7 @@ m4_define([AWAIT_KXDONE], [
case "$[]1:$[]2:$[]3" in
OK::) ;;
NOTE:KXDONE:$4) break ;;
- NOTE:*) ;;
+ NOTE:* | TRACE:* | WARN:*) ;;
*) exit 63 ;;
esac
done
@@ -227,7 +260,7 @@ m4_define([AWAIT_KXDONE], [
AT_CHECK([echo $waitrc],, [0[]nl])
## Be interested in key-exchange warnings again.
- TRIPECTL -d$4 WARN test POP
+ for d in $1 $3; do TRIPECTL -d$d WARN test POP; done
])
## ESTABLISH(adir, aname, aopts, bdir, bname, bopts, [aport], [bport])
@@ -349,12 +382,16 @@ AT_SETUP([server communication])
AT_KEYWORDS([comm])
export TRIPE_SLIPIF=USLIP
-for p in alice bob; do (mkdir $p; cd $p; SETUPDIR([alpha])); done
-
-WITH_2TRIPES([alice], [bob], [-nslip], [-talice], [-tbob], [
- ESTABLISH([alice], [not-alice], [-key alice],
- [bob], [bob], [])
-])
+for k in alpha beta-new; do
+ for p in alice bob; do (
+ rm -rf $p; mkdir $p; cd $p; SETUPDIR([$k])
+ ); done
+ WITH_2TRIPES([alice], [bob], [-nslip], [-talice], [-tbob], [
+ ESTABLISH([alice], [not-alice], [-key alice],
+ [bob], [bob], [])
+ ])
+ for p in alice bob; do rm -rf $p.$k; mv $p $p.$k; done
+done
AT_CLEANUP
@@ -424,6 +461,187 @@ WITH_3TRIPES([alice], [bob], [carol], [-nslip],
AT_CLEANUP
###--------------------------------------------------------------------------
+### Adverse communication.
+
+AT_SETUP([server retry])
+AT_KEYWORDS([backoff])
+export TRIPE_SLIPIF=USLIP
+
+for i in alice bob; do (mkdir $i; cd $i; SETUPDIR([beta])); done
+
+WITH_2TRIPES([alice], [bob], [-nslip], [-talice], [-tbob], [
+
+ ## Set up the evil proxy.
+ alicemitm=24516 bobmitm=14016
+ mknod pipe-mitmpid p
+ WITH_STRACE([mitm],
+ [sh -c 'echo $$ >pipe-mitmpid; exec "$@"' - \
+ MITM -kalice/keyring.pub >mitm.out 2>mitm.err \
+ peer:alice:$alicemitm:127.0.0.1:$(cat alice/port) \
+ peer:bob:$bobmitm:127.0.0.1:$(cat bob/port) \
+ filt:drop:5 filt:send])&
+ read mitmpid &-
+
+ ## Try to establish keys anyway.
+ AWAIT_KXDONE([alice], [alice], [bob], [bob], [
+ AT_CHECK([TRIPECTL -dalice ADD -cork bob INET 127.0.0.1 $alicemitm])
+ AT_CHECK([TRIPECTL -dbob ADD alice INET 127.0.0.1 $bobmitm])
+ ])
+
+ ## Check pinging.
+ COMMS_EPING([alice], [alice], [bob], [bob], [10])
+ COMMS_EPING([bob], [bob], [alice], [alice], [10])
+
+ ## Tear down the MITM proxy.
+ kill $mitmpid
+])
+
+AT_CLEANUP
+
+###--------------------------------------------------------------------------
+### Key management.
+
+AT_SETUP([server key-management])
+AT_KEYWORDS([keymgmt])
+export TRIPE_SLIPIF=USLIP
+
+## Determine all of the nets and the principals.
+princs=""
+nets=" "
+while read princ pnets; do
+ princs="$princs $princ"
+ for n in $pnets; do
+ case " $nets " in *" $n "*) ;; *) nets="$nets$n " ;; esac
+ done
+done <