266 lines
9.3 KiB
Bash
Executable file
266 lines
9.3 KiB
Bash
Executable file
#!/bin/sh
|
|
# $Id: check-decode 9882 2007-01-13 17:15:39Z rsh $
|
|
#
|
|
# check-decode -- Shell script to test ike-scan packet decoding
|
|
#
|
|
# Author: Roy Hills
|
|
# Date: 02 January 2007
|
|
#
|
|
# This script checks that ike-scan decodes and displays IKE packets correctly
|
|
# It uses the undocumented ike-scan option --readpktfromfile to read the
|
|
# packet from a file rather than from the network.
|
|
#
|
|
# The packet data files contain example responses from various VPN servers.
|
|
# In each case the initiator cookie is set to "deadbeefdeadbeef", so we
|
|
# specify this to ike-scan to ensure that the packet will be matched and
|
|
# displayed.
|
|
#
|
|
IKESCANOUTPUT=/tmp/ike-scan-output.$$.tmp
|
|
EXAMPLEOUTPUT=/tmp/example-output.$$.tmp
|
|
|
|
# Main Mode response from CheckPoint Firewall-1 NGX R60
|
|
SAMPLE01="$srcdir/pkt-main-mode-response.dat"
|
|
|
|
# Aggressive Mode response from Netscreen ScreenOS 5.4.0
|
|
SAMPLE02="$srcdir/pkt-aggr-mode-response.dat"
|
|
|
|
# Notify response from CheckPoint Firewall-1 NGX R60
|
|
SAMPLE03="$srcdir/pkt-notify-response.dat"
|
|
|
|
# IKEv2 SA_INIT response from strongSwan 4.0.5
|
|
SAMPLE04="$srcdir/pkt-v2-sainit-response.dat"
|
|
|
|
# IKEv2 notify response from strongSwan 4.0.5
|
|
SAMPLE05="$srcdir/pkt-v2-notify-response.dat"
|
|
|
|
# Aggressive Mode response with certificate from Borderware 3.8
|
|
SAMPLE06="$srcdir/pkt-aggr-cert-response.dat"
|
|
|
|
# Main Mode response with NAT-T from CheckPoint NGX
|
|
SAMPLE07="$srcdir/pkt-main-natt-response.dat"
|
|
|
|
# Checkpoint 9101 notify response from fw-1 4.0
|
|
SAMPLE08="$srcdir/pkt-checkpoint-notify.dat"
|
|
#
|
|
echo "Checking ike-scan main mode decode using $SAMPLE01 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) Main Mode Handshake returned
|
|
HDR=(CKY-R=636fa075dcf8ba90)
|
|
SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
|
|
VID=f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d459becd70000000018000000 (Firewall-1 NGX)
|
|
|
|
_EOF_
|
|
IKEARGS="-s 0 -r 1 -N -M -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE01 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
#
|
|
echo "Checking ike-scan aggressive mode decode using $SAMPLE02 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) Aggressive Mode Handshake returned
|
|
HDR=(CKY-R=61a878367079dd35)
|
|
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
|
|
VID=166f932d55eb64d8e4df4fd37e2313f0d0fd84510000000000000000 (Netscreen-15)
|
|
VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
|
|
VID=4865617274426561745f4e6f74696679386b0100 (Heartbeat Notify)
|
|
KeyExchange(128 bytes)
|
|
Nonce(20 bytes)
|
|
ID(Type=ID_IPV4_ADDR, Value=62.3.105.251)
|
|
Hash(20 bytes)
|
|
|
|
IKE PSK parameters (g_xr:g_xi:cky_r:cky_i:sai_b:idir_b:ni_b:nr_b:hash_r):
|
|
9a1f1fce36808165e6b253df5845567aebe67bcbcfed3f3347ca6349926bbc9f9bdc2ce1a3297ae7ffaf0fe86b4ae05ae63e2bf084b7f78c19d154560067b9a1492259a203df7d3d286dc093e1ea64f0683fb7bc1bbdd98fd34cd6568a9547573a9933f0d44aab7b21499d5995797cf183392a3dac51cb320fa56c0c57cff1bd:745db39c98420dc9f9d777c58f7eacc7b1da54dc17a1c845e92490269a5cc6461e20d232ab7e47cd9e84aed0ec9e48f57c1fa8281a1f3de07635bb1dbae9995b78e84d0370374180dc1da17c456df7ae506dbd54c9a373b67fc979cdf6c0c85efe092719af8daa8f3296550ef00eca80fb5652714c5486032539ab0522f7d7c5:61a878367079dd35:deadbeefdeadbeef:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:011101f43e0369fb:2f6b0731d3e2667f2685429f35dc5dd1ccec0e70:8ffc97aebdf3ea384341f12392043badce30c230:950d8c8ea94a4af3d0b078372e81608890485b54
|
|
_EOF_
|
|
IKEARGS="-s 0 -r 1 -N -A -M --randomseed=1234 -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef --pskcrack"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE02 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
#
|
|
echo "Checking ike-scan notify message decode using $SAMPLE03 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) Notify message 14 (NO-PROPOSAL-CHOSEN)
|
|
HDR=(CKY-R=0000000000000000, msgid=41a8534e)
|
|
|
|
_EOF_
|
|
IKEARGS="-s 0 -r 1 -N -M -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE03 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
#
|
|
echo "Checking ike-scan IKEv2 SA_INIT decode using $SAMPLE04 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) IKEv2 SA_INIT Handshake returned
|
|
HDR=(CKY-R=224bb31e5cd6a0db, IKEv2)
|
|
SA=(Encr=AES_CBC,KeyLength=128 Integ=HMAC_SHA1_96 Prf=HMAC_SHA1 DH_Group=14:modp2048)
|
|
KeyExchange(132 bytes)
|
|
Nonce(16 bytes)
|
|
|
|
_EOF_
|
|
IKEARGS="-s 0 -r 1 -N -M -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE04 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
#
|
|
echo "Checking ike-scan IKEv2 notify decode using $SAMPLE05 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) Notify message 14 (NO_PROPOSAL_CHOSEN)
|
|
HDR=(CKY-R=16d65a5a981a7c48, IKEv2)
|
|
|
|
_EOF_
|
|
IKEARGS="-s 0 -r 1 -N -M -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE05 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
#
|
|
echo "Checking ike-scan certificate decode using $SAMPLE06 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) Aggressive Mode Handshake returned
|
|
HDR=(CKY-R=94403c1b3fcacf94)
|
|
SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
|
|
KeyExchange(128 bytes)
|
|
Nonce(20 bytes)
|
|
ID(Type=ID_IPV4_ADDR, Value=172.16.3.27)
|
|
Certificate(Type=X.509 Certificate - Signature, Length=1376 bytes)
|
|
Signature(256 bytes)
|
|
|
|
_EOF_
|
|
IKEARGS="-s 0 -r 1 -N -A -M -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE06 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
#
|
|
echo "Checking ike-scan NAT-T decode using $SAMPLE07 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) Main Mode Handshake returned
|
|
HDR=(CKY-R=f92704e8a4245b38)
|
|
SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
|
|
VID=f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d459d15d80000000018000000 (Firewall-1 NGX)
|
|
|
|
_EOF_
|
|
IKEARGS="--nat-t -s 0 -r 1 -N -M -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE07 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
#
|
|
echo "Checking ike-scan CheckPoint Notify decode using $SAMPLE08 ..."
|
|
cat >$EXAMPLEOUTPUT <<_EOF_
|
|
127.0.0.1 (0.0.0.0) Notify message 9101 (Firewall-1) Message="User testing unknown.\000"
|
|
HDR=(CKY-R=0000000000000000)
|
|
|
|
_EOF_
|
|
IKEARGS="-s 0 -r 1 -N -M -I $srcdir/ike-vendor-ids --cookie=deadbeefdeadbeef"
|
|
$srcdir/ike-scan $IKEARGS --readpktfromfile=$SAMPLE08 127.0.0.1 | grep -v '^Starting ike-scan ' | grep -v '^Ending ike-scan ' >$IKESCANOUTPUT 2>&1
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
cmp -s $IKESCANOUTPUT $EXAMPLEOUTPUT
|
|
if test $? -ne 0; then
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|
|
echo "FAILED"
|
|
exit 1
|
|
fi
|
|
echo "ok"
|
|
rm -f $IKESCANOUTPUT
|
|
rm -f $EXAMPLEOUTPUT
|