| % Ikev2 Tests |
| * Tests for the Ikev2 layer |
| |
| + Basic Layer Tests |
| |
| = Ikev2 build |
| |
| a = IKEv2() |
| assert raw(a) == b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c' |
| |
| = Ikev2 dissection |
| |
| a = IKEv2(b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00! \x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x14\x00\x00\x00\x10\x01\x01\x00\x00\x00\x00\x00\x08\x02\x00\x00\x03") |
| assert a[IKEv2_payload_Transform].transform_type == 2 |
| assert a[IKEv2_payload_Transform].transform_id == 3 |
| assert a.next_payload == 33 |
| assert a[IKEv2_payload_SA].next_payload == 0 |
| assert a[IKEv2_payload_Proposal].next_payload == 0 |
| assert a[IKEv2_payload_Proposal].proposal == 1 |
| assert a[IKEv2_payload_Transform].next_payload == 0 |
| a[IKEv2_payload_Transform].show() |
| |
| |
| = Build Ikev2 SA request packet |
| |
| a = IKEv2(init_SPI="MySPI",exch_type=34)/IKEv2_payload_SA(prop=IKEv2_payload_Proposal()) |
| assert raw(a) == b'MySPI\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00! "\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x0c\x00\x00\x00\x08\x01\x01\x00\x00' |
| |
| |
| ## packets taken from |
| ## https://github.com/wireshark/wireshark/blob/master/test/captures/ikev2-decrypt-aes128ccm12.pcap |
| |
| = Dissect Initiator Request |
| |
| a = Ether(b'\x00!k\x91#H\xb8\'\xeb\xa6XI\x08\x00E\x00\x01\x14u\xc2@\x00@\x11@\xb6\xc0\xa8\x01\x02\xc0\xa8\x01\x0e\x01\xf4\x01\xf4\x01\x00=8\xeahM!Yz\xfd6\x00\x00\x00\x00\x00\x00\x00\x00! "\x08\x00\x00\x00\x00\x00\x00\x00\xf8"\x00\x00(\x00\x00\x00$\x01\x01\x00\x03\x03\x00\x00\x0c\x01\x00\x00\x0f\x80\x0e\x00\x80\x03\x00\x00\x08\x02\x00\x00\x05\x00\x00\x00\x08\x04\x00\x00\x13(\x00\x00H\x00\x13\x00\x002\xc6\xdf\xfe\\C\xb0\xd5\x81\x1f~\xaa\xa8L\x9fx\xbf\x99\xb9\x06\x9c+\x07.\x0b\x82\xf4k\xf6\xf6m\xd4_\x97\xef\x89\xee(_\xd5\xdfRzDwkR\x9f\xc9\xd8\xa9\t\xd8B\xa6\xfbY\xb9j\tS\x95ar)\x00\x00$\xb6UF-oKf\xf8r\xcc\xd7\xf0\xf4\xb4\x85w2\x92\x139\xcb\xaaR7\xed\xba$O&+h#)\x00\x00\x1c\x00\x00@\x04\x94\x9c\x9d\xb5s\x9du\xa9t\xa4\x9c\x18F\x186\x9b4\xb7\xf9B)\x00\x00\x1c\x00\x00@\x05>r\x1bF\xbe\x07\xd51\x11B]\x7f\x80\xd2\xc6\xe2 \xc6\x07.\x00\x00\x00\x10\x00\x00@/\x00\x01\x00\x02\x00\x03\x00\x04') |
| assert a[IKEv2_payload_SA].prop.trans.transform_id == 15 |
| assert a[IKEv2_payload_Notify].next_payload == 41 |
| assert IP(a[IKEv2_payload_Notify].load).src == "70.24.54.155" |
| assert IP(a[IKEv2_payload_Notify].payload.load).dst == "32.198.7.46" |
| |
| = Dissect Responder Response |
| |
| b = Ether(b'\xb8\'\xeb\xa6XI\x00!k\x91#H\x08\x00E\x00\x01\x0c\xd2R@\x00@\x11\xe4-\xc0\xa8\x01\x0e\xc0\xa8\x01\x02\x01\xf4\x01\xf4\x00\xf8\x07\xdd\xeahM!Yz\xfd6\xd9\xfe*\xb2-\xac#\xac! " \x00\x00\x00\x00\x00\x00\x00\xf0"\x00\x00(\x00\x00\x00$\x01\x01\x00\x03\x03\x00\x00\x0c\x01\x00\x00\x0f\x80\x0e\x00\x80\x03\x00\x00\x08\x02\x00\x00\x05\x00\x00\x00\x08\x04\x00\x00\x13(\x00\x00H\x00\x13\x00\x00,f\xbe\xad\xb6\xce\x855\xd6!\x8c\xb4\x01\xaaZ\x1e\xb4\x03[\x97\xca\xdd\xaf67J\x97\x9c\x04F\xb8\x80\x05\x06\xbf\x9do\x95\tR2k\xf3\x01\x19\x13\xda\x93\xbb\x8e@\xf8\x157k\xe1\xa0h\x01\xc0\xa6>;T)\x00\x00$\x9e]&sy\xe6\x81\xe7\xd3\x8d\x81\xc7\x10\xd3\x83@\x1d\xe7\xe3`{\x92m\x90\xa9\x95\x8a\xdc\xb5(1\xaa)\x00\x00\x1c\x00\x00@\x04z\x07\x85\'=Y 8)\xa6\x97U\x0f1\xcb\xb9N\xb7+C)\x00\x00\x1c\x00\x00@\x05\xc3\xe5\x8a\x8c\xc9\x93<\xe0\xb7\x8f*P\xe8\xde\x80\x13N\x12\xce1\x00\x00\x00\x08\x00\x00@\x14') |
| assert b[UDP].dport == 500 |
| assert b[IKEv2_payload_KE].load == b',f\xbe\xad\xb6\xce\x855\xd6!\x8c\xb4\x01\xaaZ\x1e\xb4\x03[\x97\xca\xdd\xaf67J\x97\x9c\x04F\xb8\x80\x05\x06\xbf\x9do\x95\tR2k\xf3\x01\x19\x13\xda\x93\xbb\x8e@\xf8\x157k\xe1\xa0h\x01\xc0\xa6>;T' |
| assert b[IKEv2_payload_Nonce].payload.type == 16388 |
| assert b[IKEv2_payload_Nonce].payload.payload.payload.next_payload == 0 |
| |
| = Dissect Encrypted Inititor Request |
| |
| a = Ether(b"\x00!k\x91#H\xb8'\xeb\xa6XI\x08\x00E\x00\x00Yu\xe2@\x00@\x11AQ\xc0\xa8\x01\x02\xc0\xa8\x01\x0e\x01\xf4\x01\xf4\x00E}\xe0\xeahM!Yz\xfd6\xd9\xfe*\xb2-\xac#\xac. %\x08\x00\x00\x00\x02\x00\x00\x00=*\x00\x00!\xcc\xa0\xb3]\xe5\xab\xc5\x1c\x99\x87\xcb\xf1\xf5\xec\xff!\x0e\xb7g\xcd\xb8Qy8;\x96Mx\xe2") |
| assert a[IKEv2_payload_Encrypted].next_payload == 42 |
| assert a[IKEv2_payload_Encrypted].load == b'\xcc\xa0\xb3]\xe5\xab\xc5\x1c\x99\x87\xcb\xf1\xf5\xec\xff!\x0e\xb7g\xcd\xb8Qy8;\x96Mx\xe2' |
| |
| = Dissect Encrypted Responder Response |
| |
| b = Ether(b"\xb8'\xeb\xa6XI\x00!k\x91#H\x08\x00E\x00\x00Q\xd5y@\x00@\x11\xe1\xc1\xc0\xa8\x01\x0e\xc0\xa8\x01\x02\x01\xf4\x01\xf4\x00=\xf9F\xeahM!Yz\xfd6\xd9\xfe*\xb2-\xac#\xac. % \x00\x00\x00\x02\x00\x00\x005\x00\x00\x00\x19\xa8\x0c\x95{\xac\x15\xc3\xf8\xaf\xdf1Z\x81\xccK|@\xe8f\rD") |
| assert b[IKEv2].init_SPI == b'\xeahM!Yz\xfd6' |
| assert b[IKEv2].resp_SPI == b'\xd9\xfe*\xb2-\xac#\xac' |
| assert b[IKEv2].next_payload == 46 |
| assert b[IKEv2_payload_Encrypted].load == b'\xa8\x0c\x95{\xac\x15\xc3\xf8\xaf\xdf1Z\x81\xccK|@\xe8f\rD' |
| |
| = Test Certs detection |
| |
| a = IKEv2_payload_CERT(raw(IKEv2_payload_CERT_CRL())) |
| b = IKEv2_payload_CERT(raw(IKEv2_payload_CERT_STR())) |
| c = IKEv2_payload_CERT(raw(IKEv2_payload_CERT_CRT())) |
| |
| assert isinstance(a, IKEv2_payload_CERT_CRL) |
| assert isinstance(b, IKEv2_payload_CERT_STR) |
| assert isinstance(c, IKEv2_payload_CERT_CRT) |
| |
| = Test TrafficSelector detection |
| |
| a = TrafficSelector(raw(IPv4TrafficSelector())) |
| b = TrafficSelector(raw(IPv6TrafficSelector())) |
| c = TrafficSelector(raw(EncryptedTrafficSelector())) |
| |
| assert isinstance(a, IPv4TrafficSelector) |
| assert isinstance(b, IPv6TrafficSelector) |
| assert isinstance(c, EncryptedTrafficSelector) |
| |
| = IKEv2_payload_Encrypted_Fragment, simple tests |
| |
| s = b"\x00\x00\x00\x08\x00\x01\x00\x01" |
| assert raw(IKEv2_payload_Encrypted_Fragment()) == s |
| |
| p = IKEv2_payload_Encrypted_Fragment(s) |
| assert p.length == 8 and p.frag_number == 1 |
