Multi-strategy automatic testing method and system based on IPSec VPN equipment

Abstract

The invention belongs to the technical field of network security, and particularly relates to a multi-strategy automatic testing method and system based on IPSec VPN equipment. The method comprises the following steps: generating a test network message according to a security policy of the IPSec VPN equipment, wherein the test network message comprises header information and data information; controlling one network card connected with the test host and the to-be-tested network security equipment to send the test network message, controlling the other network card connected with the test host and the to-be-tested network security equipment to receive the test network message, and determining the test network message as a target network message; and reading and analyzing the target network message, verifying whether the target network message is consistent with the test network message, if the result is consistent, recording that the strategy test is passed, otherwise, determining that the test is failed. According to the method, the test network messages can be automatically generated in batches according to the security policies supported by the IPSec VPN equipment, and the maximum number of security policies supported by the IPSec VPN equipment can be automatically verified in batches.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and more specifically, relates to a multi-strategy automated testing method and system based on IPSec VPN equipment. Background Art

[0002] The IPSec network security software and equipment currently used in the industry generally use paired IPSec VPN devices. By configuring paired network policies and judging by the five-tuple information of network messages, network messages can be screened to achieve the purpose of security protection.

[0003] In the actual use of IPSec VPN devices, due to the complexity of the network environment, a large number of such policies are configured, especially for R&D companies of such devices, the number of policies required to be supported may even reach several thousand. It becomes very necessary to verify whether the security policies of such devices are correct and effective in a limited local area network test environment.

[0004] At present, most of the relevant testing methods in the industry are to automatically generate security policies or automatically obtain security policies and then compare whether the policies meet the setting requirements. On the one hand, there are few automated batch testing methods for the actual network connectivity to determine whether the security policies are real and effective, that is, whether the messages that do not meet the requirements cannot pass, and the messages that meet the requirements can pass. On the other hand, if you want to test the connectivity of the actual network, you often need the support of a real hardware environment, which does not have a large number of testing hardware conditions for general network testing environments.

[0005] Based on this, it is urgent to design a method for testing the correctness of security policies and the connectivity of security channels in IPSec VPN devices, so as to realize automated batch verification of the maximum number of security policies supported by IPSec VPN devices. Summary of the invention

[0006] The present invention aims to overcome at least one defect of the above-mentioned prior art and provides a multi-strategy automated testing method based on IPSec VPN equipment.

[0007] The invention also discloses a system loaded with a multi-strategy automatic testing method based on IPSec VPN equipment.

[0008] The detailed technical scheme of the present invention is as follows: A multi-strategy automated testing method based on IPSec VPN equipment, the method comprising: S1. Generate a corresponding test network message according to the security policy of the IPSec VPN device, wherein the test network message includes header information and data information; S2, controlling a network card connected between the test host and the network security device to be tested to send the test network message, and controlling another network card connected between the test host and the network security device to be tested to receive the test network message, and determining the received test network message as the target network message; S3. Read and parse the target network message, and verify whether the target network message is consistent with the test network message. If the result is consistent, the strategy test is recorded as passed, otherwise the test fails.

[0009] Preferably, according to the present invention, in step S1, the test network messages are divided into legal network messages and illegal network messages; The legitimate network message is a test network message, and the five-tuple information range is within the corresponding five-tuple information range of the security policy; The illegal network message is a test network message whose five-tuple information range has at least one tuple information range different from the corresponding five-tuple information range of the security policy; Among them, the five-tuple information range of the test network message and security policy refers to the source IP range, destination IP range, source port range, destination port range and protocol number range.

[0010] Preferably, according to the present invention, in step S1, generating a corresponding test network message according to the security policy of the IPSec VPN device specifically includes: Parsing the five-tuple information range of all security policies of the IPSec VPN device to obtain the five-tuple information range parsing result of each security policy; According to the analysis result, a five-tuple information in the five-tuple information range that meets the security policy is selected as the header information of the legal network message; and a five-tuple information in the five-tuple information range that does not meet the security policy is selected as the header information of the illegal network message; According to the analysis result and based on the preset rules, a data packet containing an identification code, a policy state, random data and a check code is generated as data information of the legal network message and the illegal network message respectively; The identification code is located in the header of the data information, is 4 bytes, and is used to identify whether the message to which the data information belongs is the legal network message or the illegal network message; The policy status is 4 bytes, and the first 2 bytes are defined as the policy number, and the last 2 bytes are the identification bits, which are used to identify whether the network message generated by the policy is legal. The identification bit of the legal network message is defined as AAAA, and the identification bit of the illegal network message is defined as 5555; The random data is 16 bytes of randomly generated data; The check code is located at the end of the data information, a total of 8 bits, which is the CRC check data of the identification code, policy status, and random data, and is used to verify whether it is correct.

[0011] Preferably, according to the present invention, in step S1, selecting a five-tuple information that does not conform to the five-tuple information range of the security policy as the header information of the illegal network message specifically includes: Convert the source IP range in the five-tuple information range of the security policy into CIDR notation, find the converted IP subnet range, compare whether there is a range gap between the source IP range of the security policy before the conversion and the converted IP subnet range, and if there is a range gap, use any IP in the range gap as the source IP of the illegal network message; If there is no range gap, the destination IP range in the five-tuple information range of the security policy is converted into CIDR notation, and the converted IP subnet range is found, and the destination IP range of the security policy before the conversion is compared with the converted IP subnet range to see if there is a range gap. If there is a range gap, any IP in the range gap is used as the destination IP of the illegal network message; If not, compare the source port range in the five-tuple information range of the security policy with 0-65535 to find the source port range gap, and take any port in the source port range gap as the source port of the illegal network message; If there is no source port range gap, compare the destination port range in the five-tuple information range of the security policy with 0-65535, find the destination port range gap, and take any port in the destination port range gap as the destination port of the illegal network message; If there is no destination port range gap, the protocol number range in the five-tuple information range of the security policy is compared with 0-255 to find the protocol number range gap, and any protocol number in the protocol number range gap is taken as the protocol number of the illegal network message.

[0012] Preferably, according to the present invention, step S1 further comprises: exchanging the source IP range of the five-tuple information in the header information of the legal network message with the destination IP range, and exchanging the source port range with the destination port range to obtain reverse legal header information; At the same time, the random data in the data information of the legal network message is changed, and a new check code is generated according to the changed random data, so as to finally obtain the reverse legal data information; Combining the reverse legal header information and the reverse legal data information to obtain a reverse legal network message; And, exchanging the source IP range and the destination IP range of the five-tuple information in the header information of the illegal network message, and exchanging the source port range and the destination port range to obtain reverse illegal header information; At the same time, the random data in the data information of the illegal network message is changed, and a new check code is generated according to the changed random data, so as to finally obtain the reverse illegal data information; The reverse illegal header information and the reverse illegal data information are combined to obtain the reverse illegal network message.

[0013] Preferably, according to the present invention, step S1 also includes: generating corresponding ARP notification messages according to the source IP and the corresponding MAC address of the sending network card in the five-tuple information of the legal network message and the illegal network message, and generating corresponding reverse ARP notification messages according to the source IP and the corresponding MAC address of the sending network card in the five-tuple information of the reverse legal network message and the reverse illegal network message; the ARP notification message and the reverse ARP notification message are both used to broadcast the local IP address and MAC address.

[0014] Preferably, according to the present invention, step S2 specifically includes: controlling the first network card connected to the test host and the network security device to be tested to send the legal network message and the illegal network message, and controlling the second network card connected to the test host and the network security device to be tested to receive the legal network message and the illegal network message and save them as target network messages; And, control the second network card connected to the test host and the network security device to be tested to send the reverse legal network message and the reverse illegal network message, control the first network card connected to the test host and the network security device to be tested to receive the reverse legal network message and the reverse illegal network message and save them as target network messages.

[0015] Preferably, step S2 further comprises: controlling a first network card connected to the test host and the network security device under test to broadcast the ARP notification message, and controlling a second network card connected to the test host and the network security device under test to broadcast the reverse ARP notification message.

[0016] Preferably, according to the present invention, step S3 specifically includes: Reading data information of the target network message received by the first network card and the second network card, determining whether the identification code of the data information header of the target network message matches the identification code of the data information header of the test network message, and if not, skipping the target network message and parsing the next target network message; If they match, the identification code, policy status and random data in the data information of the target network message are read to calculate and generate a corresponding check code, and the generated check code is checked with the check code in the data information of the test network message. If the check fails, the security policy corresponding to the target network message is confirmed according to the header information of the target network message, and the test result of the security policy is recorded as invalid test; If the verification is passed, the policy status in the data information of the target network message is read, and the corresponding policy number is determined according to the first 2 bytes of the policy status, and whether the corresponding security policy is legal is judged according to the last 2 bytes of the policy status. If the last 2 bytes of the policy status are AAAA, it is recorded that the security policy test under the policy number has passed; if the last 2 bytes of the policy status are 5555, it is recorded that the security policy test under the policy number has failed; Compare all test results of security policies under the same policy number. If all test results are test passed, the final test result of the security policy is determined to be test passed; if there is at least one test result that is test failed, the final test result of the security policy is determined to be test failed.

[0017] In another aspect of the present invention, a system for implementing a multi-strategy automated testing method based on an IPSec VPN device is provided, the system comprising: A message generation module, used to generate a corresponding test network message according to the security policy of the IPSec VPN device, wherein the test network message includes header information and data information; The message processing module is used to control a network card connected to the test host and the network security device to be tested to send the test network message, and control another network card connected to the test host and the network security device to be tested to receive the test network message, and determine the received test network message as the target network message; The message parsing module is used to read and parse the target network message and verify whether the target network message is consistent with the test network message. If the result is consistent, the strategy test is recorded as passed, otherwise the test fails.

[0018] Compared with the prior art, the present invention has the following beneficial effects: (1) The multi-strategy automated testing method based on IPSec VPN devices provided by the present invention can quickly generate two-way test legal messages and illegal messages in batches according to the security policies of the IPSecVPN devices, and send two-way legal messages and illegal messages through the two network cards connected to the test host and the network security device to be tested. This method can efficiently and comprehensively verify whether a large number of security policies are effective, save manpower and improve accuracy.

[0019] (2) By generating and sending ARP notification messages, the present invention can achieve that one host can simulate multiple devices and receive network messages of different IP addresses, thereby greatly saving the required hardware resources.

[0020] (3) The present invention analyzes the reception of four types of messages, namely, bidirectional legal and illegal messages, by analyzing the message policy status bits, comprehensively judges the policy matching of the IPSec VPN device, and displays the results of each policy in strips in combination with the security policy. The result analysis is comprehensive and the result display is clear. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of equipment connection of the present invention.

[0022] Figure 2 It is a test flow chart of the present invention.

[0023] Figure 3 It is a flow chart for selecting the five-tuple information of illegal network messages in the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0025] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0026] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0027] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0028] Example 1 Ginseng Figure 1 and Figure 2 This embodiment provides a multi-strategy automated testing method based on IPSec VPN equipment, the method comprising: S1. Generate a corresponding test network message according to the security policy of the IPSec VPN device, wherein the test network message includes header information and data information.

[0029] Security policies define how IP packets are processed. On devices that implement IPSec (Internet Protocol Security), the security policy database should be queried during all packet processing. IPSec VPN devices usually use the source IP address, destination IP address, source port number, destination port number, and protocol number of IP packets to form a five-tuple for security policy matching.

[0030] In this embodiment, the test network messages are divided into two types: legal network messages and illegal network messages, wherein the legal network messages are test network message quintuple information ranges that are all within the corresponding quintuple information range of the security policy; the illegal network messages are test network message quintuple information ranges that contain at least one tuple information range that is different from the corresponding quintuple information range of the security policy.

[0031] Among them, the five-tuple information range of the test network message and security policy refers to the source IP range, destination IP range, source port range, destination port range and protocol number range.

[0032] Based on the above, in step S1, generating a corresponding test network message according to the security policy of the IPSec VPN device specifically includes: The five-tuple information ranges of all security policies of the IPSec VPN device are parsed to obtain the five-tuple information range parsing result of each security policy.

[0033] Specifically, the security policy of the IPSec VPN device can be obtained by importing or reading the security policy of the IPSec VPN device through a related API (Application Programming Interface), and then all security policies are traversed and the five-tuple information range of each security policy is parsed to obtain a corresponding parsing result.

[0034] According to the analysis result, a five-tuple information that meets the five-tuple information range of the security policy is selected as the header information of the legal network message.

[0035] For example, if the source IP range is 192.168.1.1 / 255.255.255.0, the destination IP range is 10.1.1.100 / 255.255.255.0, the source port range is 0-4096, the destination port range is 0-4096, and the protocol range is 1-100, then a header information with a source IP of 192.168.1.1, a destination IP of 10.1.1.100, a source port of 0, a destination port of 0, and a protocol of 1 will be generated and used as the header information of a legitimate network message.

[0036] And, a five-tuple information of the five-tuple information range that does not comply with the security policy is selected as the header information of the illegal network message. In this embodiment, the five-tuple of the header information of the illegal network message is selected in a descending priority manner, and the order of priority from high to low is source IP range, destination IP range, source port range, destination port range and protocol number range.

[0037] Reference Figure 3 ,The process of selecting the header information of the illegal network message is as follows: First, check the source IP range of the security policy. For example, check the source IP range of a security policy, convert it to CIDR notation, and find the converted IP subnet range. Then compare whether there is a range gap between the source IP range of the security policy before conversion and the converted IP subnet range. If there is a range gap, select the value included in the converted IP subnet range but not included in the source IP range of the security policy before conversion as the source IP of the illegal network message.

[0038] For example, if the source IP range of a security policy is 192.168.1.0-192.168.1.100, the CIDR notation corresponding to the source IP of this security policy is 192.168.1.0 / 25, and the subnet range is 192.168.1.0 to 192.168.1.127. Comparing this subnet range with the source IP range of the security policy, it is found that the 192.168.101-192.168.127 segment is a range gap. For simplicity, the first IP in this range gap can be selected as the source IP of the illegal network message.

[0039] If there is no range gap, refer to the source IP method to check the destination IP range of this security policy, convert it to CIDR notation, find the converted IP subnet range, and then compare whether there is a range gap between the destination IP range of the security policy before conversion and the converted IP subnet range. If there is a range gap, select the value included in the converted IP subnet range but not included in the destination IP range of the security policy before conversion as the destination IP of the illegal network message; if not, continue to check the port range.

[0040] That is, the source port range in the five-tuple information range of the security policy is directly compared with 0-65535 to find the source port range gap, and any port in the source port range gap is taken as the source port of the illegal network message. For simplicity, the first port in the source port range gap can be taken as the source port of the illegal network message.

[0041] Exemplarily, the source port range of the security policy is 0-1024, and the source port range interval is 1025-65535, then 1025 is taken as the source port of the illegal network message.

[0042] If there is no source port range gap, the same method is used to check the destination port range in the five-tuple information range of the security policy, and its destination port range is directly compared with 0-65535 to find the destination port range gap, and any port in the destination port range gap is taken as the destination port of the illegal network message. For simplicity, the first port in the destination port range gap can be taken as the destination port of the illegal network message.

[0043] If there is no gap in the destination port range, continue to check the protocol number range.

[0044] That is, the protocol number range in the five-tuple information range of the security policy is directly compared with 0-255 to find the protocol number range gap, and any protocol number in the protocol number range gap is taken as the protocol number of the illegal network message. For simplicity, the first protocol number in the protocol number range gap can be taken as the protocol number of the illegal network message.

[0045] Exemplarily, the protocol number range of the security policy is 0-100, and the protocol number range interval is 101-255, so 101 can be selected as the protocol number of the illegal network message.

[0046] If no illegal five-tuple information is found in the above steps, the illegal network message test for this security policy will not be performed.

[0047] According to the analysis result and based on preset rules, a data packet containing an identification code, a policy state, random data and a check code is generated as data information of the legal network message and the illegal network message respectively.

[0048] In this embodiment, the data information of the network message is 32 bytes in total, which is divided into four parts according to classification: identification code, policy status, random data and check code. The definitions of each part are as follows: The identification code is defined to be located at the head of the data information, which is 4 bytes and is used to identify whether the message to which the data information belongs is a test network message (a legal network message or an illegal network message), and the identification code is defined to be in the form of A0 B1 C2 D3.

[0049] The policy status is defined as 4 bytes, and according to the legality of the set policy, the first 2 bytes are defined as the policy number, such as 00 01; the last 2 bytes are identification bits, which are used to identify whether the network message generated by the policy is legal. The identification bit of the legal network message is defined as AAAA, and the identification bit of the illegal network message is defined as 5555.

[0050] The random data is 16 bytes of randomly generated data.

[0051] The check code is located at the end of the data information, a total of 8 bits, which is the CRC check data of the identification code, policy status, and random data, used to verify whether it is correct.

[0052] Based on the above, the header information and data information of the legal network message and the illegal network message can be obtained respectively, and the corresponding header information and data information are combined to obtain the corresponding legal network message and illegal network message.

[0053] Furthermore, the source IP and destination IP of the five-tuple information in the header information of the legal network message are exchanged, and the source port and destination port are exchanged to obtain the reverse legal header information; at the same time, the random data in the data information of the legal network message is changed, and a new check code is generated according to the changed random data, and finally the reverse legal data information can be obtained; the reverse legal header information and the reverse legal data information are combined to obtain the reverse legal network message. For ease of understanding, in this embodiment, the legal network message is represented by A1, and the reverse legal network message is represented by A2.

[0054] Similarly, by exchanging the source IP and destination IP of the five-tuple information in the header information of the illegal network message, and exchanging the source port and destination port, the reverse illegal header information can be obtained; at the same time, the random data in the data information of the illegal network message is changed, and a new check code is generated according to the changed random data, and finally the reverse illegal data information can be obtained; the reverse illegal header information and the reverse illegal data information are combined to obtain the reverse illegal network message. For ease of understanding, in this embodiment, the illegal network message is represented by B1, and the reverse illegal network message is represented by B2.

[0055] Furthermore, corresponding ARP notification messages are generated according to the source IP and the MAC address of the corresponding sending network card in the five-tuple information of the legal network message and the illegal network message, and corresponding reverse ARP notification messages are generated according to the source IP and the MAC address of the corresponding sending network card in the five-tuple information of the reverse legal network message and the reverse illegal network message; the ARP notification message and the reverse ARP notification message are both used to broadcast the local IP address and MAC address, which are sent in the form of broadcast and do not need to get a response. The purpose is to tell other hosts their own IP address and MAC address. After receiving the ARP notification packet, other hosts will update their ARP cache table. This method can realize the function of a single network card receiving multiple IP messages.

[0056] For example, if the source IP of the legal message is 192.168.1.100, the source IP of the illegal message is 192.168.1.200, and the MAC of the sending network card is 00:1A:2B:3C:4D:5E, then the source IP of the ARP notification message corresponding to the legal message in this direction is 192.168.1.100, the source MAC is 00:1A:2B:3C:4D:5E, the destination IP is 192.168.1.100, and the destination MAC is 00:00:00:00:00:00; and the source IP of the ARP notification message corresponding to the illegal message in this direction is 192.168.1.200, the source MAC is 00:1A:2B:3C:4D:5E, the destination IP is 192.168.1.200, and the destination MAC is 00:00: 00: 00: 00:00.

[0057] S2. Control a network card connected between the test host and the network security device to be tested to send the test network message, and control another network card connected between the test host and the network security device to be tested to receive the test network message, and determine the received test network message as the target network message.

[0058] In this embodiment, the test host communicates with the network security device to be tested through the first network card and the second network card, and the promiscuous mode is turned on. First, an ARP announcement message is sent, that is, the first network card is controlled to broadcast the ARP announcement message corresponding to the source IP of the legal network message and the illegal network message, and the second network card is controlled to broadcast the reverse ARP announcement message corresponding to the source IP of the reverse legal network message and the reverse illegal network message.

[0059] Then the second network card is controlled to start the network message receiving mode, and the legal network message A1 and illegal network message B1 generated in S1 are sent to the network port of the network security device under test connected to it through the first network card. The second network card connected to the network security device under test receives the message and saves it as the target network message.

[0060] And, control the first network card to start the network message receiving mode, and send the reverse legal network message A2 and the reverse illegal network message B2 generated in S1 to the network port of the network security device under test connected to it through the second network card, and the first network card connected to the network security device under test receives the message and saves it as the target network message.

[0061] S3. Read and parse the target network message, and verify whether the target network message is consistent with the test network message. If the result is consistent, the strategy test is recorded as passed, otherwise the test fails.

[0062] Specifically: first read the target network message received by the first network card and the second network card and perform field analysis on it, then read the first 4 bits of the data information of the target network message, and determine whether the identification code of the data information header of the target network message matches the identification code of the data information header of the test network message. If not, skip this target network message and parse the next target network message; if they match, proceed to the next step.

[0063] Read the identification code, policy status and random data in the data information of the target network message to calculate and generate the corresponding 8-bit CRC check code, and check the generated check code with the last 8 bits of the check code in the data information of the test network message. If the check fails, confirm the corresponding security policy according to the header information of the target network message, and record the test result of the security policy as invalid test; if the check passes, proceed to the next step.

[0064] Read the policy status in the data information of the target network message, determine the corresponding policy number according to the first 2 bytes of the policy status, and judge whether the corresponding security policy is legal according to the last 2 bytes of the policy status. If the last 2 bytes of the policy status are AAAA, it is recorded that the security policy test under the policy number has passed; if the last 2 bytes of the policy status are 5555, it is recorded that the security policy test under the policy number has failed.

[0065] Combined with S2, the test network message in this embodiment includes two-way legal network messages and two-way illegal network messages. Therefore, it is necessary to summarize all the two-way test results of each security policy (that is, there are 4 test results for the security policy under the same policy number) and compare all the test results of the security policy under the same policy number. If all the test results are passed, the final test result of the security policy is determined to be passed; if there is at least one test result that is a test failure, the final test result of the security policy is determined to be a test failure, that is, if there is 1 test result that is a failure under a certain security policy, the final test result of the security policy is determined to be a test failure. As shown in Table 1 below.

[0066] Table 1. Message test result truth table

[0067] Based on the above, the test results in other situations are considered invalid.

[0068] Finally, the results of the above message analysis can be listed and displayed in the test program according to the policy number and policy content, which is convenient for result viewing.

[0069] In summary, the present invention verifies whether the security policy is true and effective by exchanging network messages between the two ends of the IPSec VPN device, and quickly generates legal and illegal network messages that match the security policy through an automated program, and simulates a large number of terminal device networks in a small number of hardware devices through program simulation, thereby reducing the requirements for the number of hardware environments and reducing the testing cost; and outputs visual test results through a comprehensive analysis of the test results of legal and illegal messages, which is convenient for use.

[0070] Example 2 This embodiment provides a system for implementing a multi-strategy automated testing method based on an IPSec VPN device, the system comprising: A message generation module, used to generate a corresponding test network message according to the security policy of the IPSec VPN device, wherein the test network message includes header information and data information; The message processing module is used to control a network card connected to the test host and the network security device to be tested to send the test network message, and control another network card connected to the test host and the network security device to be tested to receive the test network message, and determine the received test network message as the target network message; The message parsing module is used to read and parse the target network message and verify whether the target network message is consistent with the test network message. If the result is consistent, the strategy test is recorded as passed, otherwise the test fails.

[0071] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solution of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A multi-strategy automated testing method based on IPSec VPN equipment, characterized in that: The method comprises: S1. Generate a corresponding test network message according to the security policy of the IPSec VPN device, wherein the test network message includes header information and data information; S2, controlling a network card connected between the test host and the network security device to be tested to send the test network message, and controlling another network card connected between the test host and the network security device to be tested to receive the test network message, and determining the received test network message as the target network message; S3. Read and parse the target network message, and verify whether the target network message is consistent with the test network message. If the result is consistent, the strategy test is recorded as passed, otherwise the test fails.

2. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 1 is characterized in that: In step S1, the test network messages are divided into legal network messages and illegal network messages; The legitimate network message is a test network message, and the five-tuple information range is within the corresponding five-tuple information range of the security policy; The illegal network message is a test network message whose five-tuple information range has at least one tuple information range different from the corresponding five-tuple information range of the security policy; Among them, the five-tuple information range of the test network message and security policy refers to the source IP range, destination IP range, source port range, destination port range and protocol number range.

3. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 2 is characterized in that: In step S1, generating a corresponding test network message according to the security policy of the IPSec VPN device specifically includes: Parsing the five-tuple information range of all security policies of the IPSec VPN device to obtain the five-tuple information range parsing result of each security policy; According to the analysis result, a five-tuple information in the five-tuple information range that meets the security policy is selected as the header information of the legal network message; and a five-tuple information in the five-tuple information range that does not meet the security policy is selected as the header information of the illegal network message; According to the analysis result and based on the preset rules, a data packet containing an identification code, a policy state, random data and a check code is generated as data information of the legal network message and the illegal network message respectively; The identification code is located in the header of the data information, is 4 bytes, and is used to identify whether the message to which the data information belongs is the legal network message or the illegal network message; The policy status is 4 bytes, and the first 2 bytes are defined as the policy number, and the last 2 bytes are the identification bits, which are used to identify whether the network message generated by the policy is legal. The identification bit of the legal network message is defined as AAAA, and the identification bit of the illegal network message is defined as 5555; The random data is 16 bytes of randomly generated data; The check code is located at the end of the data information, a total of 8 bits, which is the CRC check data of the identification code, policy status, and random data, and is used to verify whether it is correct.

4. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 3 is characterized in that: In step S1, the step of selecting a five-tuple information that does not conform to the five-tuple information range of the security policy as the header information of the illegal network message specifically includes: Convert the source IP range in the five-tuple information range of the security policy into CIDR notation, find the converted IP subnet range, compare whether there is a range gap between the source IP range of the security policy before the conversion and the converted IP subnet range, and if there is a range gap, use any IP in the range gap as the source IP of the illegal network message; If there is no range gap, the destination IP range in the five-tuple information range of the security policy is converted into CIDR notation, and the converted IP subnet range is found, and the destination IP range of the security policy before the conversion is compared with the converted IP subnet range to see if there is a range gap. If there is a range gap, any IP in the range gap is used as the destination IP of the illegal network message; If not, compare the source port range in the five-tuple information range of the security policy with 0-65535 to find the source port range gap, and take any port in the source port range gap as the source port of the illegal network message; If there is no source port range gap, compare the destination port range in the five-tuple information range of the security policy with 0-65535, find the destination port range gap, and take any port in the destination port range gap as the destination port of the illegal network message; If there is no destination port range gap, the protocol number range in the five-tuple information range of the security policy is compared with 0-255 to find the protocol number range gap, and any protocol number in the protocol number range gap is taken as the protocol number of the illegal network message.

5. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 3 is characterized in that: Step S1 also includes: exchanging the source IP range and the destination IP range of the five-tuple information in the header information of the legal network message, and exchanging the source port range and the destination port range to obtain reverse legal header information; At the same time, the random data in the data information of the legal network message is changed, and a new check code is generated according to the changed random data, so as to finally obtain the reverse legal data information; Combining the reverse legal header information and the reverse legal data information to obtain a reverse legal network message; And, exchanging the source IP range and the destination IP range of the five-tuple information in the header information of the illegal network message, and exchanging the source port range and the destination port range to obtain reverse illegal header information; At the same time, the random data in the data information of the illegal network message is changed, and a new check code is generated according to the changed random data, so as to finally obtain the reverse illegal data information; The reverse illegal header information and the reverse illegal data information are combined to obtain the reverse illegal network message.

6. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 5, characterized in that: Step S1 also includes: generating corresponding ARP notification messages according to the source IP and the MAC address of the corresponding sending network card in the five-tuple information of the legal network message and the illegal network message, and generating corresponding reverse ARP notification messages according to the source IP and the MAC address of the corresponding sending network card in the five-tuple information of the reverse legal network message and the reverse illegal network message; the ARP notification message and the reverse ARP notification message are both used to broadcast the local IP address and MAC address.

7. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 5 is characterized in that: Step S2 specifically includes: controlling the first network card connected to the test host and the network security device to be tested to send the legal network message and the illegal network message, and controlling the second network card connected to the test host and the network security device to be tested to receive the legal network message and the illegal network message and save them as target network messages; And, control the second network card connected to the test host and the network security device to be tested to send the reverse legal network message and the reverse illegal network message, control the first network card connected to the test host and the network security device to be tested to receive the reverse legal network message and the reverse illegal network message and save them as target network messages.

8. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 6 is characterized in that: Step S2 specifically also includes: controlling the first network card connected to the test host and the network security device to be tested to broadcast the ARP notification message, and controlling the second network card connected to the test host and the network security device to be tested to broadcast the reverse ARP notification message.

9. The multi-strategy automated testing method based on IPSec VPN equipment according to claim 7, characterized in that: Step S3 specifically includes: Reading data information of the target network message received by the first network card and the second network card, determining whether the identification code of the data information header of the target network message matches the identification code of the data information header of the test network message, and if not, skipping the target network message and parsing the next target network message; If they match, the identification code, policy status and random data in the data information of the target network message are read to calculate and generate a corresponding check code, and the generated check code is checked with the check code in the data information of the test network message. If the check fails, the security policy corresponding to the target network message is confirmed according to the header information of the target network message, and the test result of the security policy is recorded as invalid test; If the verification is passed, the policy status in the data information of the target network message is read, and the corresponding policy number is determined according to the first 2 bytes of the policy status, and whether the corresponding security policy is legal is judged according to the last 2 bytes of the policy status. If the last 2 bytes of the policy status are AAAA, it is recorded that the security policy test under the policy number has passed; if the last 2 bytes of the policy status are 5555, it is recorded that the security policy test under the policy number has failed; Compare all test results of security policies under the same policy number. If all test results are test passed, the final test result of the security policy is determined to be test passed; if there is at least one test result that is test failed, the final test result of the security policy is determined to be test failed.

10. A system for implementing a multi-strategy automated testing method based on IPSec VPN equipment, characterized in that: The system comprises: A message generation module, used to generate a corresponding test network message according to the security policy of the IPSec VPN device, wherein the test network message includes header information and data information; The message processing module is used to control a network card connected to the test host and the network security device to be tested to send the test network message, and control another network card connected to the test host and the network security device to be tested to receive the test network message, and determine the received test network message as the target network message; The message parsing module is used to read and parse the target network message and verify whether the target network message is consistent with the test network message. If the result is consistent, the strategy test is recorded as passed, otherwise the test fails.

Images