3 # Copyright (c) 2021 Cisco and/or its affiliates.
5 # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
7 # Licensed under the Apache License 2.0 or
8 # GNU General Public License v2.0 or later; you may not use this file
9 # except in compliance with one of these Licenses. You
10 # may obtain a copy of the Licenses at:
12 # http://www.apache.org/licenses/LICENSE-2.0
13 # https://www.gnu.org/licenses/old-licenses/gpl-2.0-standalone.html
15 # Note: If this file is linked with Scapy, which is GPLv2+, your use of it
16 # must be under GPLv2+. If at any point in the future it is no longer linked
17 # with Scapy (or other GPLv2+ licensed software), you are free to choose
20 # Unless required by applicable law or agreed to in writing, software
21 # distributed under the License is distributed on an "AS IS" BASIS,
22 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
23 # See the License for the specific language governing permissions and
24 # limitations under the License.
26 """Traffic script for IPsec verification."""
30 from ipaddress import ip_address
31 from scapy.layers.l2 import Ether
32 from scapy.layers.inet import IP, TCP
33 from scapy.layers.inet6 import IPv6, ICMPv6ND_NS, ICMPv6MLReport2, ICMPv6ND_RA
34 from scapy.packet import Raw
36 from .TrafficScriptArg import TrafficScriptArg
37 from .PacketVerifier import RxQueue, TxQueue
40 def check_ipv4(pkt_recv, dscp):
41 """Check received IPv4 IPsec packet.
43 :param pkt_recv: Received packet to verify.
44 :param dscp: DSCP value to check.
45 :type pkt_recv: scapy.Ether
47 :raises RuntimeError: If received packet is invalid.
49 if not pkt_recv.haslayer(IP):
50 raise RuntimeError(f"Not an IPv4 packet received: {pkt_recv!r}")
52 rx_dscp = pkt_recv[IP].tos >> 2
54 raise RuntimeError(f"Invalid DSCP {rx_dscp} should be {dscp}")
56 if not pkt_recv.haslayer(TCP):
57 raise RuntimeError(f"Not a TCP packet received: {pkt_recv!r}")
60 def check_ipv6(pkt_recv, dscp):
61 """Check received IPv6 IPsec packet.
63 :param pkt_recv: Received packet to verify.
64 :param dscp: DSCP value to check.
65 :type pkt_recv: scapy.Ether
67 :raises RuntimeError: If received packet is invalid.
69 if not pkt_recv.haslayer(IPv6):
70 raise RuntimeError(f"Not an IPv6 packet received: {pkt_recv!r}")
72 rx_dscp = pkt_recv[IPv6].tc >> 2
74 raise RuntimeError(f"Invalid DSCP {rx_dscp} should be {dscp}")
76 if not pkt_recv.haslayer(TCP):
77 raise RuntimeError(f"Not a TCP packet received: {pkt_recv!r}")
80 # TODO: Pylint says too-many-locals and too-many-statements. Refactor!
82 """Send and receive TCP packet."""
83 args = TrafficScriptArg(
84 [u"src_mac", u"dst_mac", u"src_ip", u"dst_ip", u"dscp"]
87 rxq = RxQueue(args.get_arg(u"rx_if"))
88 txq = TxQueue(args.get_arg(u"tx_if"))
90 src_mac = args.get_arg(u"src_mac")
91 dst_mac = args.get_arg(u"dst_mac")
92 src_ip = args.get_arg(u"src_ip")
93 dst_ip = args.get_arg(u"dst_ip")
94 dscp = int(args.get_arg(u"dscp"))
96 ip_layer = IPv6 if ip_address(src_ip).version == 6 else IP
99 pkt_send = (Ether(src=src_mac, dst=dst_mac) /
100 ip_layer(src=src_ip, dst=dst_ip) /
104 sent_packets.append(pkt_send)
108 pkt_recv = rxq.recv(2, sent_packets)
110 raise RuntimeError(u"ICMPv6 echo reply Rx timeout")
112 if pkt_recv.haslayer(ICMPv6ND_NS):
113 # read another packet in the queue if the current one is ICMPv6ND_NS
115 elif pkt_recv.haslayer(ICMPv6MLReport2):
116 # read another packet in the queue if the current one is
119 elif pkt_recv.haslayer(ICMPv6ND_RA):
120 # read another packet in the queue if the current one is
124 # otherwise process the current packet
128 raise RuntimeError(u"Rx timeout")
131 check_ipv4(pkt_recv, dscp)
133 check_ipv6(pkt_recv, dscp)
138 if __name__ == u"__main__":