RTU_A_In_DM_HBHH_opttype - Router Tunnel Mode AH Inbound, Detect modification of HBHOpt header option type with AH
Router
RTU_A_In_DM_HBHH_opttype.seq [-tooloption ...] -pkt RTU_A_DM_HBHH_opttype.def -tooloption : v6eval tool option See also HTR_A_common.def and HTR_common.def
For details of Network Topology, see 00README
Set NUT's SAD and SPD as following:
(Link0) (Link1) NET4 NET2 NET0 NET1 HOST1_NET4 -- SG1 -- Router -- NUT -- HOST1_NET1 =====tunnel======>
Security Association Database (SAD)
source address | SG1_NET2 |
destination address | NUT_NET0 |
SPI | 0x1000 |
mode | tunnel |
protocol | AH |
AH algorithm | HMAC-MD5 |
AH algorithm key | 0123456789ABCDEF |
Security Policy Database (SPD)
No SPD entry |
Tester Target Tester (Link0) (Link1) | | | Subtest No.1 "option bit 000: option type is immutable" | | | |-------------------------->| | | ICMP Echo Request | | | within [HBHH][AH] tunnel | | | |-------------------------->| | | ICMP Echo Request | | | Judgement #1 | | | | |-------------------------->| | | ICMP Echo Request | | | within [HBHH][AH] tunnel | | | (option type of HBHH is modified 0x02->0x22) | | | (---------------------->) | | | No ICMP Echo Request | | | Judgement #2 | | | | v v v Subtest No.2 "option bit 001: option type is immutable" | | | |-------------------------->| | | ICMP Echo Request | | | within [HBHH][AH] tunnel | | | (option type of HBHH is modified 0x22->0x23) | | | (---------------------->) | | | No ICMP Echo Request | | | Judgement #3 | | | | v v v
ICMP Echo Request within [HBHH][AH] tunnel to Link0
IP Header | Source Address | SG1_NET2 |
Destination Address | NUT_NET0 | |
HopByHop Options Header | Type | 0x02 |
Data Length | 4 | |
Data | 0x0f0f0000 | |
AH | SPI | 0x1000 |
Sequence Number | 1 | |
Algorithm | HMAC-MD5 | |
Key | 0123456789ABCDEF | |
IP Header | Source Address | HOST1_NET4 |
Destination Address | HOST1_NET1 | |
ICMP | Type | 128 (Echo Request) |
ICMP Echo Request from Link1
IP Header | Source Address | HOST1_NET4 |
Destination Address | HOST1_NET1 | |
ICMP | Type | 128 (Echo Request) |
Send ICMP Echo Request within [HBHH][AH] tunnel (option type of HBHH is modified 0x02->0x22) to Link0
IP Header | Source Address | SG1_NET2 |
Destination Address | NUT_NET0 | |
HopByHop Options Header | Type | 0x22 (0x02 is original) |
Data Length | 4 | |
Data | 0x0f0f0000 | |
AH | SPI | 0x1000 |
Sequence Number | 2 | |
Algorithm | HMAC-MD5 | |
Key | 0123456789ABCDEF | |
IP Header | Source Address | HOST1_NET4 |
Destination Address | HOST1_NET1 | |
ICMP | Type | 128 (Echo Request) |
Send ICMP Echo Request within [HBHH][AH] tunnel (option type of HBHH is modified 0x22->0x23) to Link0
IP Header | Source Address | SG1_NET2 |
Destination Address | NUT_NET0 | |
HopByHop Options Header | Type | 0x23 (0x22 is original) |
Data Length | 4 | |
Data | 0x0f0f0000 | |
AH | SPI | 0x1000 |
Sequence Number | 3 | |
Algorithm | HMAC-MD5 | |
Key | 0123456789ABCDEF | |
IP Header | Source Address | HOST1_NET4 |
Destination Address | HOST1_NET1 | |
ICMP | Type | 128 (Echo Request) |
Judgement #1: Receive ICMP Echo Request from Link1 (MUST) Judgement #2: Receive nothing (MUST) Judgement #3: Receive nothing (MUST)
perldoc V6evalTool
IPSEC.html IPsec Test Common Utility