5 from scapy.layers.inet import IP, ICMP, TCP, UDP
6 from scapy.layers.ipsec import SecurityAssociation, ESP
7 from scapy.layers.l2 import Ether
8 from scapy.packet import raw, Raw
9 from scapy.layers.inet6 import (
18 from framework import VppTestCase, VppTestRunner
19 from util import ppp, reassemble4, fragment_rfc791, fragment_rfc8200
20 from vpp_papi import VppEnum
22 from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSpdItfBinding
23 from ipaddress import ip_address
28 class IPsecIPv4Params:
29 addr_type = socket.AF_INET
31 addr_bcast = "255.255.255.255"
36 self.remote_tun_if_host = "1.1.1.1"
37 self.remote_tun_if_host6 = "1111::1"
39 self.scapy_tun_sa_id = 100
40 self.scapy_tun_spi = 1000
41 self.vpp_tun_sa_id = 200
42 self.vpp_tun_spi = 2000
44 self.scapy_tra_sa_id = 300
45 self.scapy_tra_spi = 3000
46 self.vpp_tra_sa_id = 400
47 self.vpp_tra_spi = 4000
49 self.outer_hop_limit = 64
50 self.inner_hop_limit = 255
51 self.outer_flow_label = 0
52 self.inner_flow_label = 0x12345
54 self.anti_replay_window_size = 64
56 self.auth_algo_vpp_id = (
57 VppEnum.vl_api_ipsec_integ_alg_t.IPSEC_API_INTEG_ALG_SHA1_96
59 self.auth_algo = "HMAC-SHA1-96" # scapy name
60 self.auth_key = b"C91KUR9GYMm5GfkEvNjX"
62 self.crypt_algo_vpp_id = (
63 VppEnum.vl_api_ipsec_crypto_alg_t.IPSEC_API_CRYPTO_ALG_AES_CBC_128
65 self.crypt_algo = "AES-CBC" # scapy name
66 self.crypt_key = b"JPjyOWBeVEQiMe7h"
69 self.nat_header = None
71 VppEnum.vl_api_tunnel_encap_decap_flags_t.TUNNEL_API_ENCAP_DECAP_FLAG_NONE
74 self.async_mode = False
77 class IPsecIPv6Params:
78 addr_type = socket.AF_INET6
80 addr_bcast = "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"
85 self.remote_tun_if_host = "1111:1111:1111:1111:1111:1111:1111:1111"
86 self.remote_tun_if_host4 = "1.1.1.1"
88 self.scapy_tun_sa_id = 500
89 self.scapy_tun_spi = 3001
90 self.vpp_tun_sa_id = 600
91 self.vpp_tun_spi = 3000
93 self.scapy_tra_sa_id = 700
94 self.scapy_tra_spi = 4001
95 self.vpp_tra_sa_id = 800
96 self.vpp_tra_spi = 4000
98 self.outer_hop_limit = 64
99 self.inner_hop_limit = 255
100 self.outer_flow_label = 0
101 self.inner_flow_label = 0x12345
103 self.anti_replay_window_size = 64
105 self.auth_algo_vpp_id = (
106 VppEnum.vl_api_ipsec_integ_alg_t.IPSEC_API_INTEG_ALG_SHA1_96
108 self.auth_algo = "HMAC-SHA1-96" # scapy name
109 self.auth_key = b"C91KUR9GYMm5GfkEvNjX"
111 self.crypt_algo_vpp_id = (
112 VppEnum.vl_api_ipsec_crypto_alg_t.IPSEC_API_CRYPTO_ALG_AES_CBC_128
114 self.crypt_algo = "AES-CBC" # scapy name
115 self.crypt_key = b"JPjyOWBeVEQiMe7h"
118 self.nat_header = None
120 VppEnum.vl_api_tunnel_encap_decap_flags_t.TUNNEL_API_ENCAP_DECAP_FLAG_NONE
123 self.async_mode = False
126 def mk_scapy_crypt_key(p):
127 if p.crypt_algo in ("AES-GCM", "AES-CTR", "AES-NULL-GMAC"):
128 return p.crypt_key + struct.pack("!I", p.salt)
133 def config_tun_params(p, encryption_type, tun_if):
134 ip_class_by_addr_type = {socket.AF_INET: IP, socket.AF_INET6: IPv6}
136 p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN)
138 p.tun_dst = tun_if.remote_addr[p.addr_type]
139 p.tun_src = tun_if.local_addr[p.addr_type]
140 crypt_key = mk_scapy_crypt_key(p)
141 p.scapy_tun_sa = SecurityAssociation(
144 crypt_algo=p.crypt_algo,
146 auth_algo=p.auth_algo,
148 tunnel_header=ip_class_by_addr_type[p.addr_type](src=p.tun_dst, dst=p.tun_src),
149 nat_t_header=p.nat_header,
152 p.vpp_tun_sa = SecurityAssociation(
155 crypt_algo=p.crypt_algo,
157 auth_algo=p.auth_algo,
159 tunnel_header=ip_class_by_addr_type[p.addr_type](dst=p.tun_dst, src=p.tun_src),
160 nat_t_header=p.nat_header,
165 def config_tra_params(p, encryption_type):
167 p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN)
169 crypt_key = mk_scapy_crypt_key(p)
170 p.scapy_tra_sa = SecurityAssociation(
173 crypt_algo=p.crypt_algo,
175 auth_algo=p.auth_algo,
177 nat_t_header=p.nat_header,
180 p.vpp_tra_sa = SecurityAssociation(
183 crypt_algo=p.crypt_algo,
185 auth_algo=p.auth_algo,
187 nat_t_header=p.nat_header,
192 class TemplateIpsec(VppTestCase):
197 |tra_if| <-------> |VPP|
202 ------ encrypt --- plain ---
203 |tun_if| <------- |VPP| <------ |pg1|
206 ------ decrypt --- plain ---
207 |tun_if| -------> |VPP| ------> |pg1|
214 def ipsec_select_backend(self):
215 """empty method to be overloaded when necessary"""
220 super(TemplateIpsec, cls).setUpClass()
223 def tearDownClass(cls):
224 super(TemplateIpsec, cls).tearDownClass()
226 def setup_params(self):
227 if not hasattr(self, "ipv4_params"):
228 self.ipv4_params = IPsecIPv4Params()
229 if not hasattr(self, "ipv6_params"):
230 self.ipv6_params = IPsecIPv6Params()
232 self.ipv4_params.addr_type: self.ipv4_params,
233 self.ipv6_params.addr_type: self.ipv6_params,
236 def config_interfaces(self):
237 self.create_pg_interfaces(range(3))
238 self.interfaces = list(self.pg_interfaces)
239 for i in self.interfaces:
247 super(TemplateIpsec, self).setUp()
251 self.vpp_esp_protocol = VppEnum.vl_api_ipsec_proto_t.IPSEC_API_PROTO_ESP
252 self.vpp_ah_protocol = VppEnum.vl_api_ipsec_proto_t.IPSEC_API_PROTO_AH
254 self.config_interfaces()
256 self.ipsec_select_backend()
258 def unconfig_interfaces(self):
259 for i in self.interfaces:
265 super(TemplateIpsec, self).tearDown()
267 self.unconfig_interfaces()
269 def show_commands_at_teardown(self):
270 self.logger.info(self.vapi.cli("show hardware"))
272 def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1, payload_size=54):
274 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
275 / sa.encrypt(IP(src=src, dst=dst) / ICMP() / Raw(b"X" * payload_size))
276 for i in range(count)
279 def gen_encrypt_pkts6(self, p, sa, sw_intf, src, dst, count=1, payload_size=54):
281 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
283 IPv6(src=src, dst=dst, hlim=p.inner_hop_limit, fl=p.inner_flow_label)
284 / ICMPv6EchoRequest(id=0, seq=1, data="X" * payload_size)
286 for i in range(count)
289 def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
291 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
292 / IP(src=src, dst=dst)
294 / Raw(b"X" * payload_size)
295 for i in range(count)
298 def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54):
300 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
301 / IPv6(src=src, dst=dst, hlim=p.inner_hop_limit, fl=p.inner_flow_label)
302 / ICMPv6EchoRequest(id=0, seq=1, data="X" * payload_size)
303 for i in range(count)
307 class IpsecTcp(object):
308 def verify_tcp_checksum(self):
309 # start http cli server listener on http://0.0.0.0:80
310 self.vapi.cli("http cli server")
311 p = self.params[socket.AF_INET]
313 src=self.tun_if.remote_mac, dst=self.tun_if.local_mac
314 ) / p.scapy_tun_sa.encrypt(
315 IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
316 / TCP(flags="S", dport=80)
318 self.logger.debug(ppp("Sending packet:", send))
319 recv = self.send_and_expect(self.tun_if, [send], self.tun_if)
321 decrypted = p.vpp_tun_sa.decrypt(recv[IP])
322 self.assert_packet_checksums_valid(decrypted)
325 class IpsecTcpTests(IpsecTcp):
326 def test_tcp_checksum(self):
327 """verify checksum correctness for vpp generated packets"""
328 self.verify_tcp_checksum()
331 class IpsecTra4(object):
332 """verify methods for Transport v4"""
334 def get_replay_counts(self, p):
335 replay_node_name = "/err/%s/replay" % self.tra4_decrypt_node_name[0]
336 count = self.statistics.get_err_counter(replay_node_name)
339 replay_post_node_name = (
340 "/err/%s/replay" % self.tra4_decrypt_node_name[p.async_mode]
342 count += self.statistics.get_err_counter(replay_post_node_name)
346 def get_hash_failed_counts(self, p):
347 if ESP == self.encryption_type and p.crypt_algo in ("AES-GCM", "AES-NULL-GMAC"):
348 hash_failed_node_name = (
349 "/err/%s/decryption_failed" % self.tra4_decrypt_node_name[p.async_mode]
352 hash_failed_node_name = (
353 "/err/%s/integ_error" % self.tra4_decrypt_node_name[p.async_mode]
355 count = self.statistics.get_err_counter(hash_failed_node_name)
358 count += self.statistics.get_err_counter("/err/crypto-dispatch/bad-hmac")
362 def verify_hi_seq_num(self):
363 p = self.params[socket.AF_INET]
364 saf = VppEnum.vl_api_ipsec_sad_flags_t
365 esn_on = p.vpp_tra_sa.esn_en
366 ar_on = p.flags & saf.IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY
368 seq_cycle_node_name = "/err/%s/seq_cycled" % self.tra4_encrypt_node_name
369 replay_count = self.get_replay_counts(p)
370 hash_failed_count = self.get_hash_failed_counts(p)
371 seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name)
373 # a few packets so we get the rx seq number above the window size and
374 # thus can simulate a wrap with an out of window packet
377 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
378 / p.scapy_tra_sa.encrypt(
379 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
383 for seq in range(63, 80)
385 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
387 # these 4 packets will all choose seq-num 0 to decrpyt since none
388 # are out of window when first checked. however, once #200 has
389 # decrypted it will move the window to 200 and has #81 is out of
390 # window. this packet should be dropped.
393 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
394 / p.scapy_tra_sa.encrypt(
395 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
400 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
401 / p.scapy_tra_sa.encrypt(
402 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
407 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
408 / p.scapy_tra_sa.encrypt(
409 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
414 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
415 / p.scapy_tra_sa.encrypt(
416 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
422 # if anti-replay is off then we won't drop #81
423 n_rx = 3 if ar_on else 4
424 self.send_and_expect(self.tra_if, pkts, self.tra_if, n_rx=n_rx)
425 # this packet is one before the wrap
428 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
429 / p.scapy_tra_sa.encrypt(
430 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
435 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
437 # a replayed packet, then an out of window, then a legit
438 # tests that a early failure on the batch doesn't affect subsequent packets.
441 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
442 / p.scapy_tra_sa.encrypt(
443 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
448 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
449 / p.scapy_tra_sa.encrypt(
450 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
455 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
456 / p.scapy_tra_sa.encrypt(
457 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
462 n_rx = 1 if ar_on else 3
463 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if, n_rx=n_rx)
465 # move the window over half way to a wrap
468 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
469 / p.scapy_tra_sa.encrypt(
470 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
475 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
477 # anti-replay will drop old packets, no anti-replay will not
480 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
481 / p.scapy_tra_sa.encrypt(
482 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
489 self.send_and_assert_no_replies(self.tra_if, pkts)
491 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
495 # validate wrapping the ESN
498 # wrap scapy's TX SA SN
499 p.scapy_tra_sa.seq_num = 0x100000005
501 # send a packet that wraps the window for both AR and no AR
504 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
505 / p.scapy_tra_sa.encrypt(
506 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
513 rxs = self.send_and_expect(self.tra_if, pkts, self.tra_if)
515 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
517 # move the window forward to half way to the next wrap
520 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
521 / p.scapy_tra_sa.encrypt(
522 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
529 rxs = self.send_and_expect(self.tra_if, pkts, self.tra_if)
531 # a packet less than 2^30 from the current position is:
532 # - AR: out of window and dropped
536 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
537 / p.scapy_tra_sa.encrypt(
538 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
546 self.send_and_assert_no_replies(self.tra_if, pkts)
548 self.send_and_expect(self.tra_if, pkts, self.tra_if)
550 # a packet more than 2^30 from the current position is:
551 # - AR: out of window and dropped
552 # - non-AR: considered a wrap, but since it's not a wrap
553 # it won't decrpyt and so will be dropped
556 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
557 / p.scapy_tra_sa.encrypt(
558 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
565 self.send_and_assert_no_replies(self.tra_if, pkts)
567 # a packet less than 2^30 from the current position and is a
568 # wrap; (the seq is currently at 0x180000005).
569 # - AR: out of window so considered a wrap, so accepted
570 # - non-AR: not considered a wrap, so won't decrypt
571 p.scapy_tra_sa.seq_num = 0x260000005
574 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
575 / p.scapy_tra_sa.encrypt(
576 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
583 self.send_and_expect(self.tra_if, pkts, self.tra_if)
585 self.send_and_assert_no_replies(self.tra_if, pkts)
588 # window positions are different now for AR/non-AR
589 # move non-AR forward
592 # a packet more than 2^30 from the current position and is a
593 # wrap; (the seq is currently at 0x180000005).
595 # - non-AR: not considered a wrap, so won't decrypt
599 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
600 / p.scapy_tra_sa.encrypt(
601 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
607 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
608 / p.scapy_tra_sa.encrypt(
609 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
615 self.send_and_expect(self.tra_if, pkts, self.tra_if)
619 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
620 / p.scapy_tra_sa.encrypt(
621 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
627 self.send_and_expect(self.tra_if, pkts, self.tra_if)
629 def verify_tra_anti_replay(self):
630 p = self.params[socket.AF_INET]
631 esn_en = p.vpp_tra_sa.esn_en
632 anti_replay_window_size = p.anti_replay_window_size
634 seq_cycle_node_name = "/err/%s/seq_cycled" % self.tra4_encrypt_node_name
635 replay_count = self.get_replay_counts(p)
636 initial_sa_node_replay_diff = replay_count - p.tra_sa_in.get_err("replay")
637 hash_failed_count = self.get_hash_failed_counts(p)
638 seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name)
639 initial_sa_node_cycled_diff = seq_cycle_count - p.tra_sa_in.get_err(
642 hash_err = "integ_error"
644 if ESP == self.encryption_type:
645 undersize_node_name = "/err/%s/runt" % self.tra4_decrypt_node_name[0]
646 undersize_count = self.statistics.get_err_counter(undersize_node_name)
647 initial_sa_node_undersize_diff = undersize_count - p.tra_sa_in.get_err(
650 # For AES-GCM an error in the hash is reported as a decryption failure
651 if p.crypt_algo in ("AES-GCM", "AES-NULL-GMAC"):
652 hash_err = "decryption_failed"
653 # In async mode, we don't report errors in the hash.
657 initial_sa_node_hash_diff = hash_failed_count - p.tra_sa_in.get_err(
662 # send packets with seq numbers 1->34
663 # this means the window size is still in Case B (see RFC4303
666 # for reasons i haven't investigated Scapy won't create a packet with
671 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
672 / p.scapy_tra_sa.encrypt(
673 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
677 for seq in range(1, 34)
679 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
681 # replayed packets are dropped
682 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
683 replay_count += len(pkts)
684 self.assertEqual(self.get_replay_counts(p), replay_count)
685 err = p.tra_sa_in.get_err("replay") + initial_sa_node_replay_diff
686 self.assertEqual(err, replay_count)
689 # now send a batch of packets all with the same sequence number
690 # the first packet in the batch is legitimate, the rest bogus
692 self.vapi.cli("clear error")
693 self.vapi.cli("clear node counters")
695 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
696 ) / p.scapy_tra_sa.encrypt(
697 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
700 recv_pkts = self.send_and_expect(self.tra_if, pkts * 8, self.tra_if, n_rx=1)
702 self.assertEqual(self.get_replay_counts(p), replay_count)
703 err = p.tra_sa_in.get_err("replay") + initial_sa_node_replay_diff
704 self.assertEqual(err, replay_count)
707 # now move the window over to anti_replay_window_size + 100 and into Case A
709 self.vapi.cli("clear error")
711 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
712 ) / p.scapy_tra_sa.encrypt(
713 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
714 seq_num=anti_replay_window_size + 100,
716 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
718 self.logger.info(self.vapi.ppcli("show ipsec sa 1"))
720 # replayed packets are dropped
721 self.send_and_assert_no_replies(self.tra_if, pkt * 3, timeout=0.2)
723 self.assertEqual(self.get_replay_counts(p), replay_count)
724 err = p.tra_sa_in.get_err("replay") + initial_sa_node_replay_diff
725 self.assertEqual(err, replay_count)
727 # the window size is anti_replay_window_size packets
728 # in window are still accepted
730 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
731 ) / p.scapy_tra_sa.encrypt(
732 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
736 # a packet that does not decrypt does not move the window forward
737 bogus_sa = SecurityAssociation(
738 self.encryption_type,
740 crypt_algo=p.crypt_algo,
741 crypt_key=mk_scapy_crypt_key(p)[::-1],
742 auth_algo=p.auth_algo,
743 auth_key=p.auth_key[::-1],
746 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
747 ) / bogus_sa.encrypt(
748 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
749 seq_num=anti_replay_window_size + 200,
751 self.send_and_assert_no_replies(self.tra_if, pkt * 17, timeout=0.2)
753 hash_failed_count += 17
754 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
756 err = p.tra_sa_in.get_err(hash_err) + initial_sa_node_hash_diff
757 self.assertEqual(err, hash_failed_count)
759 # a malformed 'runt' packet
760 # created by a mis-constructed SA
761 if ESP == self.encryption_type and p.crypt_algo != "NULL":
762 bogus_sa = SecurityAssociation(self.encryption_type, p.scapy_tra_spi)
764 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
765 ) / bogus_sa.encrypt(
766 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
767 seq_num=anti_replay_window_size + 200,
769 self.send_and_assert_no_replies(self.tra_if, pkt * 17, timeout=0.2)
771 undersize_count += 17
772 self.assert_error_counter_equal(undersize_node_name, undersize_count)
773 err = p.tra_sa_in.get_err("runt") + initial_sa_node_undersize_diff
774 self.assertEqual(err, undersize_count)
776 # which we can determine since this packet is still in the window
778 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
779 ) / p.scapy_tra_sa.encrypt(
780 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
783 self.send_and_expect(self.tra_if, [pkt], self.tra_if)
786 # out of window are dropped
787 # this is Case B. So VPP will consider this to be a high seq num wrap
788 # and so the decrypt attempt will fail
791 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
792 ) / p.scapy_tra_sa.encrypt(
793 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
796 self.send_and_assert_no_replies(self.tra_if, pkt * 17, timeout=0.2)
799 # an out of window error with ESN looks like a high sequence
800 # wrap. but since it isn't then the verify will fail.
801 hash_failed_count += 17
802 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
804 err = p.tra_sa_in.get_err(hash_err) + initial_sa_node_hash_diff
805 self.assertEqual(err, hash_failed_count)
809 self.assertEqual(self.get_replay_counts(p), replay_count)
810 err = p.tra_sa_in.get_err("replay") + initial_sa_node_replay_diff
811 self.assertEqual(err, replay_count)
813 # valid packet moves the window over to anti_replay_window_size + 258
815 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
816 ) / p.scapy_tra_sa.encrypt(
817 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
818 seq_num=anti_replay_window_size + 258,
820 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
821 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
824 # move VPP's SA TX seq-num to just before the seq-number wrap.
825 # then fire in a packet that VPP should drop on TX because it
826 # causes the TX seq number to wrap; unless we're using extened sequence
829 self.vapi.cli("test ipsec sa %d seq 0xffffffff" % p.vpp_tra_sa_id)
830 self.logger.info(self.vapi.ppcli("show ipsec sa 0"))
831 self.logger.info(self.vapi.ppcli("show ipsec sa 1"))
835 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
836 / p.scapy_tra_sa.encrypt(
837 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
841 for seq in range(259, 280)
845 rxs = self.send_and_expect(self.tra_if, pkts, self.tra_if)
848 # in order for scapy to decrypt its SA's high order number needs
851 p.vpp_tra_sa.seq_num = 0x100000000
853 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
856 # wrap scapy's TX high sequence number. VPP is in case B, so it
857 # will consider this a high seq wrap also.
858 # The low seq num we set it to will place VPP's RX window in Case A
860 p.scapy_tra_sa.seq_num = 0x100000005
862 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
863 ) / p.scapy_tra_sa.encrypt(
864 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
867 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
869 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
872 # A packet that has seq num between (2^32-anti_replay_window_size)+4 and 5 is within
875 p.scapy_tra_sa.seq_num = 0xFFFFFFFD
877 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
878 ) / p.scapy_tra_sa.encrypt(
879 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
882 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
883 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
886 # While in case A we cannot wrap the high sequence number again
887 # because VPP will consider this packet to be one that moves the
891 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
892 ) / p.scapy_tra_sa.encrypt(
893 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
896 self.send_and_assert_no_replies(
897 self.tra_if, [pkt], self.tra_if, timeout=0.2
900 hash_failed_count += 1
901 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
903 err = p.tra_sa_in.get_err(hash_err) + initial_sa_node_hash_diff
904 self.assertEqual(err, hash_failed_count)
907 # but if we move the window forward to case B, then we can wrap
910 p.scapy_tra_sa.seq_num = 0x100000000 + anti_replay_window_size + 0x555
912 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
913 ) / p.scapy_tra_sa.encrypt(
914 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
915 seq_num=p.scapy_tra_sa.seq_num,
917 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
918 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
920 p.scapy_tra_sa.seq_num = 0x200000444
922 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
923 ) / p.scapy_tra_sa.encrypt(
924 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
927 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
928 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
932 # without ESN TX sequence numbers can't wrap and packets are
933 # dropped from here on out.
935 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
936 seq_cycle_count += len(pkts)
937 self.assert_error_counter_equal(seq_cycle_node_name, seq_cycle_count)
938 err = p.tra_sa_out.get_err("seq_cycled") + initial_sa_node_cycled_diff
939 self.assertEqual(err, seq_cycle_count)
941 # move the security-associations seq number on to the last we used
942 self.vapi.cli("test ipsec sa %d seq 0x15f" % p.scapy_tra_sa_id)
943 p.scapy_tra_sa.seq_num = 351
944 p.vpp_tra_sa.seq_num = 351
946 def verify_tra_lost(self):
947 p = self.params[socket.AF_INET]
948 esn_en = p.vpp_tra_sa.esn_en
951 # send packets with seq numbers 1->34
952 # this means the window size is still in Case B (see RFC4303
955 # for reasons i haven't investigated Scapy won't create a packet with
960 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
961 / p.scapy_tra_sa.encrypt(
962 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
966 for seq in range(1, 3)
968 self.send_and_expect(self.tra_if, pkts, self.tra_if)
970 self.assertEqual(p.tra_sa_in.get_err("lost"), 0)
972 # skip a sequence number
975 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
976 / p.scapy_tra_sa.encrypt(
977 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
981 for seq in range(4, 6)
983 self.send_and_expect(self.tra_if, pkts, self.tra_if)
985 self.assertEqual(p.tra_sa_in.get_err("lost"), 0)
987 # the lost packet are counted untill we get up past the first
988 # sizeof(replay_window) packets
991 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
992 / p.scapy_tra_sa.encrypt(
993 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
997 for seq in range(6, 100)
999 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1001 self.assertEqual(p.tra_sa_in.get_err("lost"), 1)
1003 # lost of holes in the sequence
1006 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1007 / p.scapy_tra_sa.encrypt(
1008 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1012 for seq in range(100, 200, 2)
1014 self.send_and_expect(self.tra_if, pkts, self.tra_if, n_rx=50)
1018 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1019 / p.scapy_tra_sa.encrypt(
1020 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1024 for seq in range(200, 300)
1026 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1028 self.assertEqual(p.tra_sa_in.get_err("lost"), 51)
1030 # a big hole in the seq number space
1033 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1034 / p.scapy_tra_sa.encrypt(
1035 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1039 for seq in range(400, 500)
1041 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1043 self.assertEqual(p.tra_sa_in.get_err("lost"), 151)
1045 def verify_tra_basic4(self, count=1, payload_size=54):
1046 """ipsec v4 transport basic test"""
1047 self.vapi.cli("clear errors")
1048 self.vapi.cli("clear ipsec sa")
1050 p = self.params[socket.AF_INET]
1051 send_pkts = self.gen_encrypt_pkts(
1055 src=self.tra_if.remote_ip4,
1056 dst=self.tra_if.local_ip4,
1058 payload_size=payload_size,
1060 recv_pkts = self.send_and_expect(self.tra_if, send_pkts, self.tra_if)
1061 for rx in recv_pkts:
1062 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
1063 self.assert_packet_checksums_valid(rx)
1065 decrypted = p.vpp_tra_sa.decrypt(rx[IP])
1066 self.assert_packet_checksums_valid(decrypted)
1068 self.logger.debug(ppp("Unexpected packet:", rx))
1071 self.logger.info(self.vapi.ppcli("show error"))
1072 self.logger.info(self.vapi.ppcli("show ipsec all"))
1074 pkts = p.tra_sa_in.get_stats()["packets"]
1076 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
1078 pkts = p.tra_sa_out.get_stats()["packets"]
1080 pkts, count, "incorrect SA out counts: expected %d != %d" % (count, pkts)
1082 self.assertEqual(p.tra_sa_out.get_err("lost"), 0)
1083 self.assertEqual(p.tra_sa_in.get_err("lost"), 0)
1085 self.assert_packet_counter_equal(self.tra4_encrypt_node_name, count)
1086 self.assert_packet_counter_equal(self.tra4_decrypt_node_name[0], count)
1088 def _verify_tra_anti_replay_algorithm_esn(self):
1089 def seq_num(seqh, seql):
1090 return (seqh << 32) | (seql & 0xFFFF_FFFF)
1092 p = self.params[socket.AF_INET]
1093 anti_replay_window_size = p.anti_replay_window_size
1095 seq_cycle_node_name = "/err/%s/seq_cycled" % self.tra4_encrypt_node_name
1096 replay_count = self.get_replay_counts(p)
1097 hash_failed_count = self.get_hash_failed_counts(p)
1098 seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name)
1100 if ESP == self.encryption_type:
1101 undersize_node_name = "/err/%s/runt" % self.tra4_decrypt_node_name[0]
1102 undersize_count = self.statistics.get_err_counter(undersize_node_name)
1104 # reset the TX SA to avoid conflict with left configuration
1105 self.vapi.cli(f"test ipsec sa {p.vpp_tra_sa_id} seq 0x0")
1108 RFC 4303 Appendix A2. Case A
1111 a-i: possible seq num received
1113 [BT]l(sign) = [BT]l (sign) 2^32 mod 2^32 (Th inc/dec-remented by 1)
1116 --|--a--+---b---+-c--|--d--+---e---+-f--|--g--+---h---+--i-|--
1117 ========= ========= =========
1118 Bl- Tl- Bl Tl Bl+ Tl+
1120 Case A implies Tl >= W - 1
1124 Tl = anti_replay_window_size + 40
1125 Bl = Tl - anti_replay_window_size + 1
1127 # move VPP's RX AR window to Case A
1128 self.vapi.cli(f"test ipsec sa {p.scapy_tra_sa_id} seq {seq_num(Th, Tl):#x}")
1129 p.scapy_tra_sa.seq_num = seq_num(Th, Tl)
1133 - pre-crypto check: algorithm predicts that the packet wrap the window
1135 - integrity check: should fail
1136 - post-crypto check: ...
1140 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1141 / p.scapy_tra_sa.encrypt(
1142 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1146 for seq in range(seq_num(Th - 1, Bl - 20), seq_num(Th - 1, Bl - 5))
1149 # out-of-window packets fail integrity check
1150 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1151 hash_failed_count += len(pkts)
1152 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1155 case b: Bl <= Seql <= Tl
1156 - pre-crypto check: algorithm predicts that the packet is in the window
1158 -> check for a replayed packet with Seql
1159 - integrity check: should fail
1160 - post-crypto check: ...
1164 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1165 / p.scapy_tra_sa.encrypt(
1166 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1170 for seq in range(seq_num(Th, Tl - 10), seq_num(Th, Tl - 5))
1172 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1174 p.scapy_tra_sa.seq_num = seq_num(Th - 1, Tl)
1177 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1178 / p.scapy_tra_sa.encrypt(
1179 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1183 for seq in range(seq_num(Th - 1, Tl - 35), seq_num(Th - 1, Tl - 5))
1186 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1188 # some packets are rejected by the pre-crypto check
1190 self.assertEqual(self.get_replay_counts(p), replay_count)
1192 # out-of-window packets fail integrity check
1193 hash_failed_count += len(pkts) - 5
1194 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1198 - pre-crypto check: algorithm predicts that the packet does not wrap the window
1200 - integrity check: should fail
1201 - post-crypto check: ...
1205 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1206 / p.scapy_tra_sa.encrypt(
1207 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1211 for seq in range(seq_num(Th - 1, Tl + 5), seq_num(Th - 1, Tl + 20))
1214 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1216 # out-of-window packets fail integrity check
1217 hash_failed_count += len(pkts)
1218 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1222 - pre-crypto check: algorithm predicts that the packet wrap the window
1224 - integrity check: should fail
1225 - post-crypto check: ...
1227 p.scapy_tra_sa.seq_num = seq_num(Th, Tl)
1230 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1231 / p.scapy_tra_sa.encrypt(
1232 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1236 for seq in range(seq_num(Th, Bl - 20), seq_num(Th, Bl - 5))
1239 # out-of-window packets fail integrity check
1240 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1241 hash_failed_count += len(pkts)
1242 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1245 case e: Bl <= Seql <= Tl
1246 - pre-crypto check: algorithm predicts that the packet is in the window
1248 -> check for a replayed packet with Seql
1249 - integrity check: should pass
1250 - post-crypto check: should pass
1251 -> Seql is marked in the AR window
1255 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1256 / p.scapy_tra_sa.encrypt(
1257 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1261 for seq in range(seq_num(Th, Bl + 10), seq_num(Th, Bl + 30))
1264 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1268 - pre-crypto check: algorithm predicts that the packet does not wrap the window
1270 - integrity check: should pass
1271 - post-crypto check: should pass
1272 -> AR window shift (the window stays Case A)
1273 -> Seql is marked in the AR window
1277 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1278 / p.scapy_tra_sa.encrypt(
1279 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1283 for seq in range(seq_num(Th, Tl + 50), seq_num(Th, Tl + 60))
1286 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1290 - pre-crypto check: algorithm predicts that the packet wrap the window
1292 - integrity check: should pass
1293 - post-crypto check: should pass
1294 -> AR window shift (may set the window in Case B)
1295 -> Seql is marked in the AR window
1297 p.scapy_tra_sa.seq_num = seq_num(Th + 1, Tl)
1300 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1301 / p.scapy_tra_sa.encrypt(
1302 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1306 # set the window in Case B (the minimum window size is 64
1307 # so we are sure to overlap)
1308 for seq in range(seq_num(Th + 1, 10), seq_num(Th + 1, 20))
1311 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1313 # reset the VPP's RX AR window to Case A
1315 Tl = 2 * anti_replay_window_size + 40
1316 Bl = Tl - anti_replay_window_size + 1
1318 self.vapi.cli(f"test ipsec sa {p.scapy_tra_sa_id} seq {seq_num(Th, Tl):#x}")
1320 p.scapy_tra_sa.seq_num = seq_num(Th + 1, Tl)
1323 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1324 / p.scapy_tra_sa.encrypt(
1325 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1329 # the AR will stay in Case A
1331 seq_num(Th + 1, anti_replay_window_size + 10),
1332 seq_num(Th + 1, anti_replay_window_size + 20),
1336 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1339 case h: Bl <= Seql <= Tl
1340 - pre-crypto check: algorithm predicts that the packet is in the window
1342 -> check for a replayed packet with Seql
1343 - integrity check: the wrap is not detected, should fail
1344 - post-crypto check: ...
1347 Tl = anti_replay_window_size + 20
1348 Bl = Tl - anti_replay_window_size + 1
1350 p.scapy_tra_sa.seq_num = seq_num(Th + 1, Tl)
1354 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1355 / p.scapy_tra_sa.encrypt(
1356 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1360 for seq in range(seq_num(Th + 1, Tl - 20), seq_num(Th + 1, Tl - 5))
1363 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1365 # some packets are rejected by the pre-crypto check
1367 self.assertEqual(self.get_replay_counts(p), replay_count)
1369 # out-of-window packets fail integrity check
1370 hash_failed_count += len(pkts) - 5
1371 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1375 - pre-crypto check: algorithm predicts that the packet does not wrap the window
1377 - integrity check: the wrap is not detected, shoud fail
1378 - post-crypto check: ...
1382 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1383 / p.scapy_tra_sa.encrypt(
1384 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1388 for seq in range(seq_num(Th + 1, Tl + 5), seq_num(Th + 1, Tl + 15))
1391 # out-of-window packets fail integrity check
1392 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1393 hash_failed_count += len(pkts)
1394 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1397 RFC 4303 Appendix A2. Case B
1400 ----|-a-+-----b----+--c--|-d-+----e-----+--f--|-g-+--h---
1401 ========= =========== ===========
1404 Case B implies Tl < W - 1
1407 # reset the VPP's RX AR window to Case B
1409 Tl = 30 # minimum window size of 64, we are sure to overlap
1410 Bl = (Tl - anti_replay_window_size + 1) % (1 << 32)
1412 self.vapi.cli(f"test ipsec sa {p.scapy_tra_sa_id} seq {seq_num(Th, Tl):#x}")
1413 p.scapy_tra_sa.seq_num = seq_num(Th, Tl)
1416 case a: Seql <= Tl < Bl
1417 - pre-crypto check: algorithm predicts that the packet is in the window
1419 -> check for replayed packet
1420 - integrity check: should fail
1421 - post-crypto check: ...
1425 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1426 / p.scapy_tra_sa.encrypt(
1427 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1431 for seq in range(seq_num(Th, 5), seq_num(Th, 10))
1434 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1436 p.scapy_tra_sa.seq_num = seq_num(Th - 1, Tl)
1439 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1440 / p.scapy_tra_sa.encrypt(
1441 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1445 for seq in range(seq_num(Th - 1, 0), seq_num(Th - 1, 15))
1448 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1450 # some packets are rejected by the pre-crypto check
1452 self.assertEqual(self.get_replay_counts(p), replay_count)
1454 # out-of-window packets fail integrity check
1455 hash_failed_count += len(pkts) - 5
1456 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1459 case b: Tl < Seql < Bl
1460 - pre-crypto check: algorithm predicts that the packet will shift the window
1462 - integrity check: should fail
1463 - post-crypto check: ...
1467 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1468 / p.scapy_tra_sa.encrypt(
1469 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1473 for seq in range(seq_num(Th - 1, Tl + 10), seq_num(Th - 1, Tl + 20))
1476 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1478 # out-of-window packets fail integrity check
1479 hash_failed_count += len(pkts)
1480 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1483 case c: Tl < Bl <= Seql
1484 - pre-crypto check: algorithm predicts that the packet is in the window
1486 -> check for a replayed packet with Seql
1487 - integrity check: should pass
1488 - post-crypto check: should pass
1489 -> Seql is marked in the AR window
1493 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1494 / p.scapy_tra_sa.encrypt(
1495 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1499 for seq in range(seq_num(Th - 1, Bl + 10), seq_num(Th - 1, Bl + 20))
1502 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1505 case d: Seql <= Tl < Bl
1506 - pre-crypto check: algorithm predicts that the packet is the window
1508 -> check for replayed packet
1509 - integrity check: should pass
1510 - post-crypto check: should pass
1511 -> Seql is marked in the AR window
1513 p.scapy_tra_sa.seq_num = seq_num(Th, Tl)
1516 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1517 / p.scapy_tra_sa.encrypt(
1518 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1522 for seq in range(seq_num(Th, 15), seq_num(Th, 25))
1525 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1528 case e: Tl < Seql < Bl
1529 - pre-crypto check: algorithm predicts that the packet is in the window
1531 -> check for a replayed packet with Seql
1532 - integrity check: should pass
1533 - post-crypto check: should pass
1534 -> AR window shift (may set the window in Case A)
1535 -> Seql is marked in the AR window
1539 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1540 / p.scapy_tra_sa.encrypt(
1541 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1545 for seq in range(seq_num(Th, Tl + 5), seq_num(Th, Tl + 15))
1548 # the window stays in Case B
1549 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1553 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1554 / p.scapy_tra_sa.encrypt(
1555 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1560 seq_num(Th, Tl + anti_replay_window_size + 5),
1561 seq_num(Th, Tl + anti_replay_window_size + 15),
1565 # the window moves to Case A
1566 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1568 # reset the VPP's RX AR window to Case B
1570 Tl = 30 # minimum window size of 64, we are sure to overlap
1571 Bl = (Tl - anti_replay_window_size + 1) % (1 << 32)
1573 self.vapi.cli(f"test ipsec sa {p.scapy_tra_sa_id} seq {seq_num(Th, Tl):#x}")
1574 p.scapy_tra_sa.seq_num = seq_num(Th, Tl)
1577 case f: Tl < Bl <= Seql
1578 - pre-crypto check: algorithm predicts that the packet is in the previous window
1580 -> check for a replayed packet with Seql
1581 - integrity check: should fail
1582 - post-crypto check: ...
1586 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1587 / p.scapy_tra_sa.encrypt(
1588 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1592 for seq in range(seq_num(Th, Bl + 10), seq_num(Th, Bl + 20))
1595 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1597 # out-of-window packets fail integrity check
1598 hash_failed_count += len(pkts)
1599 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1602 case g: Seql <= Tl < Bl
1603 - pre-crypto check: algorithm predicts that the packet is the window
1605 -> check for replayed packet
1606 - integrity check: should fail
1607 - post-crypto check: ...
1611 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1612 / p.scapy_tra_sa.encrypt(
1613 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1617 for seq in range(seq_num(Th, 10), seq_num(Th, 15))
1620 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1622 p.scapy_tra_sa.seq_num = seq_num(Th + 1, Tl)
1625 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1626 / p.scapy_tra_sa.encrypt(
1627 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1631 for seq in range(seq_num(Th + 1, 0), seq_num(Th + 1, 15))
1634 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1636 # some packets are rejected by the pre-crypto check
1638 self.assertEqual(self.get_replay_counts(p), replay_count)
1640 # out-of-window packets fail integrity check
1641 hash_failed_count += len(pkts) - 5
1642 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1645 case h: Tl < Seql < Bl
1646 - pre-crypto check: algorithm predicts that the packet will shift the window
1648 - integrity check: should fail
1649 - post-crypto check: ...
1653 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1654 / p.scapy_tra_sa.encrypt(
1655 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1659 for seq in range(seq_num(Th + 1, Tl + 10), seq_num(Th + 1, Tl + 20))
1662 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1664 # out-of-window packets fail integrity check
1665 hash_failed_count += len(pkts)
1666 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
1668 def _verify_tra_anti_replay_algorithm_no_esn(self):
1670 return seql & 0xFFFF_FFFF
1672 p = self.params[socket.AF_INET]
1673 anti_replay_window_size = p.anti_replay_window_size
1675 seq_cycle_node_name = "/err/%s/seq_cycled" % self.tra4_encrypt_node_name
1676 replay_count = self.get_replay_counts(p)
1677 hash_failed_count = self.get_hash_failed_counts(p)
1678 seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name)
1680 if ESP == self.encryption_type:
1681 undersize_node_name = "/err/%s/runt" % self.tra4_decrypt_node_name[0]
1682 undersize_count = self.statistics.get_err_counter(undersize_node_name)
1684 # reset the TX SA to avoid conflict with left configuration
1685 self.vapi.cli(f"test ipsec sa {p.vpp_tra_sa_id} seq 0x0")
1688 RFC 4303 Appendix A2. Case A
1690 a-c: possible seq num received
1693 |--a--+---b---+-c--|
1697 No ESN implies Th = 0
1698 Case A implies Tl >= W - 1
1701 Tl = anti_replay_window_size + 40
1702 Bl = Tl - anti_replay_window_size + 1
1704 # move VPP's RX AR window to Case A
1705 self.vapi.cli(f"test ipsec sa {p.scapy_tra_sa_id} seq {seq_num(Tl):#x}")
1706 p.scapy_tra_sa.seq_num = seq_num(Tl)
1710 - pre-crypto check: algorithm predicts that the packet is out of window
1711 -> packet should be dropped
1712 - integrity check: ...
1713 - post-crypto check: ...
1717 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1718 / p.scapy_tra_sa.encrypt(
1719 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1723 for seq in range(seq_num(Bl - 20), seq_num(Bl - 5))
1726 # out-of-window packets
1727 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1728 replay_count += len(pkts)
1729 self.assertEqual(self.get_replay_counts(p), replay_count)
1732 case b: Bl <= Seql <= Tl
1733 - pre-crypto check: algorithm predicts that the packet is in the window
1734 -> check for a replayed packet with Seql
1735 - integrity check: should pass
1736 - post-crypto check:
1737 -> check for a replayed packet with Seql
1741 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1742 / p.scapy_tra_sa.encrypt(
1743 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1747 for seq in range(seq_num(Tl - 50), seq_num(Tl - 30))
1749 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1753 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1754 / p.scapy_tra_sa.encrypt(
1755 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1759 for seq in range(seq_num(Tl - 35), seq_num(Tl - 30))
1762 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
1766 self.assertEqual(self.get_replay_counts(p), replay_count)
1770 - pre-crypto check: algorithm predicts that the packet will shift the window
1771 - integrity check: should pass
1772 - post-crypto check: should pass
1773 -> AR window is shifted
1777 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1778 / p.scapy_tra_sa.encrypt(
1779 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1783 for seq in range(seq_num(Tl + 5), seq_num(Tl + 20))
1786 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1789 RFC 4303 Appendix A2. Case B
1791 |-a-----+------b-----|
1795 Case B implies Tl < W - 1
1798 # reset the VPP's RX AR window to Case B
1799 Tl = 30 # minimum window size of 64, we are sure to overlap
1800 Bl = seq_num(Tl - anti_replay_window_size + 1)
1802 self.vapi.cli(f"test ipsec sa {p.scapy_tra_sa_id} seq {seq_num(Tl):#x}")
1805 case a: Seql <= Tl < Bl
1806 - pre-crypto check: algorithm predicts that the packet is in the window
1807 -> check for replayed packet
1808 - integrity check: should fail
1809 - post-crypto check: ...
1813 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1814 / p.scapy_tra_sa.encrypt(
1815 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1819 for seq in range(seq_num(5), seq_num(10))
1822 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1825 case b: Tl < Seql < Bl
1826 - pre-crypto check: algorithm predicts that the packet will shift the window
1827 - integrity check: should pass
1828 - post-crypto check: should pass
1829 -> AR window is shifted
1833 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
1834 / p.scapy_tra_sa.encrypt(
1835 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
1839 for seq in range(seq_num(-50), seq_num(-20))
1842 self.send_and_expect(self.tra_if, pkts, self.tra_if)
1844 def verify_tra_anti_replay_algorithm(self):
1845 if self.params[socket.AF_INET].vpp_tra_sa.esn_en:
1846 self._verify_tra_anti_replay_algorithm_esn()
1848 self._verify_tra_anti_replay_algorithm_no_esn()
1851 class IpsecTra4Tests(IpsecTra4):
1852 """UT test methods for Transport v4"""
1854 def test_tra_anti_replay(self):
1855 """ipsec v4 transport anti-replay test"""
1856 self.verify_tra_anti_replay()
1858 def test_tra_anti_replay_algorithm(self):
1859 """ipsec v4 transport anti-replay algorithm test"""
1860 self.verify_tra_anti_replay_algorithm()
1862 def test_tra_lost(self):
1863 """ipsec v4 transport lost packet test"""
1864 self.verify_tra_lost()
1866 def test_tra_basic(self, count=1):
1867 """ipsec v4 transport basic test"""
1868 self.verify_tra_basic4(count=1)
1870 def test_tra_burst(self):
1871 """ipsec v4 transport burst test"""
1872 self.verify_tra_basic4(count=257)
1875 class IpsecTra6(object):
1876 """verify methods for Transport v6"""
1878 def verify_tra_basic6(self, count=1, payload_size=54):
1879 self.vapi.cli("clear errors")
1880 self.vapi.cli("clear ipsec sa")
1882 p = self.params[socket.AF_INET6]
1883 send_pkts = self.gen_encrypt_pkts6(
1887 src=self.tra_if.remote_ip6,
1888 dst=self.tra_if.local_ip6,
1890 payload_size=payload_size,
1892 recv_pkts = self.send_and_expect(self.tra_if, send_pkts, self.tra_if)
1893 for rx in recv_pkts:
1894 self.assertEqual(len(rx) - len(Ether()) - len(IPv6()), rx[IPv6].plen)
1896 decrypted = p.vpp_tra_sa.decrypt(rx[IPv6])
1897 self.assert_packet_checksums_valid(decrypted)
1899 self.logger.debug(ppp("Unexpected packet:", rx))
1902 self.logger.info(self.vapi.ppcli("show error"))
1903 self.logger.info(self.vapi.ppcli("show ipsec all"))
1905 pkts = p.tra_sa_in.get_stats()["packets"]
1907 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
1909 pkts = p.tra_sa_out.get_stats()["packets"]
1911 pkts, count, "incorrect SA out counts: expected %d != %d" % (count, pkts)
1913 self.assert_packet_counter_equal(self.tra6_encrypt_node_name, count)
1914 self.assert_packet_counter_equal(self.tra6_decrypt_node_name[0], count)
1916 def gen_encrypt_pkts_ext_hdrs6(
1917 self, sa, sw_intf, src, dst, count=1, payload_size=54
1920 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
1922 IPv6(src=src, dst=dst)
1923 / ICMPv6EchoRequest(id=0, seq=1, data="X" * payload_size)
1925 for i in range(count)
1928 def gen_pkts_ext_hdrs6(self, sw_intf, src, dst, count=1, payload_size=54):
1930 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
1931 / IPv6(src=src, dst=dst)
1932 / IPv6ExtHdrHopByHop()
1933 / IPv6ExtHdrFragment(id=2, offset=200)
1934 / Raw(b"\xff" * 200)
1935 for i in range(count)
1938 def verify_tra_encrypted6(self, p, sa, rxs):
1941 self.assert_packet_checksums_valid(rx)
1943 decrypt_pkt = p.vpp_tra_sa.decrypt(rx[IPv6])
1944 decrypted.append(decrypt_pkt)
1945 self.assert_equal(decrypt_pkt.src, self.tra_if.local_ip6)
1946 self.assert_equal(decrypt_pkt.dst, self.tra_if.remote_ip6)
1948 self.logger.debug(ppp("Unexpected packet:", rx))
1950 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
1956 def verify_tra_66_ext_hdrs(self, p):
1960 # check we can decrypt with options
1962 tx = self.gen_encrypt_pkts_ext_hdrs6(
1965 src=self.tra_if.remote_ip6,
1966 dst=self.tra_if.local_ip6,
1969 self.send_and_expect(self.tra_if, tx, self.tra_if)
1972 # injecting a packet from ourselves to be routed of box is a hack
1973 # but it matches an outbout policy, alors je ne regrette rien
1976 # one extension before ESP
1978 Ether(src=self.pg2.remote_mac, dst=self.pg2.local_mac)
1979 / IPv6(src=self.tra_if.local_ip6, dst=self.tra_if.remote_ip6)
1980 / IPv6ExtHdrFragment(id=2, offset=200)
1981 / Raw(b"\xff" * 200)
1984 rxs = self.send_and_expect(self.pg2, [tx], self.tra_if)
1985 dcs = self.verify_tra_encrypted6(p, p.vpp_tra_sa, rxs)
1988 # for reasons i'm not going to investigate scapy does not
1989 # created the correct headers after decrypt. but reparsing
1990 # the ipv6 packet fixes it
1991 dc = IPv6(raw(dc[IPv6]))
1992 self.assert_equal(dc[IPv6ExtHdrFragment].id, 2)
1994 # two extensions before ESP
1996 Ether(src=self.pg2.remote_mac, dst=self.pg2.local_mac)
1997 / IPv6(src=self.tra_if.local_ip6, dst=self.tra_if.remote_ip6)
1998 / IPv6ExtHdrHopByHop()
1999 / IPv6ExtHdrFragment(id=2, offset=200)
2000 / Raw(b"\xff" * 200)
2003 rxs = self.send_and_expect(self.pg2, [tx], self.tra_if)
2004 dcs = self.verify_tra_encrypted6(p, p.vpp_tra_sa, rxs)
2007 dc = IPv6(raw(dc[IPv6]))
2008 self.assertTrue(dc[IPv6ExtHdrHopByHop])
2009 self.assert_equal(dc[IPv6ExtHdrFragment].id, 2)
2011 # two extensions before ESP, one after
2013 Ether(src=self.pg2.remote_mac, dst=self.pg2.local_mac)
2014 / IPv6(src=self.tra_if.local_ip6, dst=self.tra_if.remote_ip6)
2015 / IPv6ExtHdrHopByHop()
2016 / IPv6ExtHdrFragment(id=2, offset=200)
2017 / IPv6ExtHdrDestOpt()
2018 / Raw(b"\xff" * 200)
2021 rxs = self.send_and_expect(self.pg2, [tx], self.tra_if)
2022 dcs = self.verify_tra_encrypted6(p, p.vpp_tra_sa, rxs)
2025 dc = IPv6(raw(dc[IPv6]))
2026 self.assertTrue(dc[IPv6ExtHdrDestOpt])
2027 self.assertTrue(dc[IPv6ExtHdrHopByHop])
2028 self.assert_equal(dc[IPv6ExtHdrFragment].id, 2)
2031 class IpsecTra6Tests(IpsecTra6):
2032 """UT test methods for Transport v6"""
2034 def test_tra_basic6(self):
2035 """ipsec v6 transport basic test"""
2036 self.verify_tra_basic6(count=1)
2038 def test_tra_burst6(self):
2039 """ipsec v6 transport burst test"""
2040 self.verify_tra_basic6(count=257)
2043 class IpsecTra6ExtTests(IpsecTra6):
2044 def test_tra_ext_hdrs_66(self):
2045 """ipsec 6o6 tra extension headers test"""
2046 self.verify_tra_66_ext_hdrs(self.params[socket.AF_INET6])
2049 class IpsecTra46Tests(IpsecTra4Tests, IpsecTra6Tests):
2050 """UT test methods for Transport v6 and v4"""
2055 class IpsecTun4(object):
2056 """verify methods for Tunnel v4"""
2058 def verify_counters4(self, p, count, n_frags=None, worker=None):
2061 if hasattr(p, "spd_policy_in_any"):
2062 pkts = p.spd_policy_in_any.get_stats(worker)["packets"]
2066 "incorrect SPD any policy: expected %d != %d" % (count, pkts),
2069 if hasattr(p, "tun_sa_in"):
2070 pkts = p.tun_sa_in.get_stats(worker)["packets"]
2072 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
2074 pkts = p.tun_sa_out.get_stats(worker)["packets"]
2078 "incorrect SA out counts: expected %d != %d" % (count, pkts),
2081 self.assert_packet_counter_equal(self.tun4_encrypt_node_name, n_frags)
2082 self.assert_packet_counter_equal(self.tun4_decrypt_node_name[0], count)
2084 def verify_decrypted(self, p, rxs):
2086 self.assert_equal(rx[IP].src, p.remote_tun_if_host)
2087 self.assert_equal(rx[IP].dst, self.pg1.remote_ip4)
2088 self.assert_packet_checksums_valid(rx)
2090 def verify_esp_padding(self, sa, esp_payload, decrypt_pkt):
2091 align = sa.crypt_algo.block_size
2094 exp_len = (len(decrypt_pkt) + 2 + (align - 1)) & ~(align - 1)
2095 exp_len += sa.crypt_algo.iv_size
2096 exp_len += sa.crypt_algo.icv_size or sa.auth_algo.icv_size
2097 self.assertEqual(exp_len, len(esp_payload))
2099 def verify_encrypted(self, p, sa, rxs):
2103 self.assertEqual(rx[UDP].dport, p.nat_header.dport)
2104 self.assert_packet_checksums_valid(rx)
2105 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
2108 decrypt_pkt = p.vpp_tun_sa.decrypt(rx_ip)
2109 if not decrypt_pkt.haslayer(IP):
2110 decrypt_pkt = IP(decrypt_pkt[Raw].load)
2111 if rx_ip.proto == socket.IPPROTO_ESP:
2112 self.verify_esp_padding(sa, rx_ip[ESP].data, decrypt_pkt)
2113 decrypt_pkts.append(decrypt_pkt)
2114 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
2115 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
2117 self.logger.debug(ppp("Unexpected packet:", rx))
2119 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
2123 pkts = reassemble4(decrypt_pkts)
2125 self.assert_packet_checksums_valid(pkt)
2127 def verify_tun_44(self, p, count=1, payload_size=64, n_rx=None):
2128 self.vapi.cli("clear errors")
2129 self.vapi.cli("clear ipsec counters")
2130 self.vapi.cli("clear ipsec sa")
2134 send_pkts = self.gen_encrypt_pkts(
2138 src=p.remote_tun_if_host,
2139 dst=self.pg1.remote_ip4,
2141 payload_size=payload_size,
2143 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
2144 self.verify_decrypted(p, recv_pkts)
2146 send_pkts = self.gen_pkts(
2148 src=self.pg1.remote_ip4,
2149 dst=p.remote_tun_if_host,
2151 payload_size=payload_size,
2153 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if, n_rx)
2154 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
2156 for rx in recv_pkts:
2157 self.assertEqual(rx[IP].src, p.tun_src)
2158 self.assertEqual(rx[IP].dst, p.tun_dst)
2161 self.logger.info(self.vapi.ppcli("show error"))
2162 self.logger.info(self.vapi.ppcli("show ipsec all"))
2164 self.logger.info(self.vapi.ppcli("show ipsec sa 0"))
2165 self.logger.info(self.vapi.ppcli("show ipsec sa 4"))
2166 self.verify_counters4(p, count, n_rx)
2168 def verify_tun_dropped_44(self, p, count=1, payload_size=64, n_rx=None):
2169 self.vapi.cli("clear errors")
2173 send_pkts = self.gen_encrypt_pkts(
2177 src=p.remote_tun_if_host,
2178 dst=self.pg1.remote_ip4,
2181 self.send_and_assert_no_replies(self.tun_if, send_pkts)
2183 send_pkts = self.gen_pkts(
2185 src=self.pg1.remote_ip4,
2186 dst=p.remote_tun_if_host,
2188 payload_size=payload_size,
2190 self.send_and_assert_no_replies(self.pg1, send_pkts)
2193 self.logger.info(self.vapi.ppcli("show error"))
2194 self.logger.info(self.vapi.ppcli("show ipsec all"))
2196 def verify_tun_reass_44(self, p):
2197 self.vapi.cli("clear errors")
2198 self.vapi.ip_reassembly_enable_disable(
2199 sw_if_index=self.tun_if.sw_if_index, enable_ip4=True
2203 send_pkts = self.gen_encrypt_pkts(
2207 src=p.remote_tun_if_host,
2208 dst=self.pg1.remote_ip4,
2212 send_pkts = fragment_rfc791(send_pkts[0], 1400)
2213 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1, n_rx=1)
2214 self.verify_decrypted(p, recv_pkts)
2216 send_pkts = self.gen_pkts(
2217 self.pg1, src=self.pg1.remote_ip4, dst=p.remote_tun_if_host, count=1
2219 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
2220 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
2223 self.logger.info(self.vapi.ppcli("show error"))
2224 self.logger.info(self.vapi.ppcli("show ipsec all"))
2226 self.verify_counters4(p, 1, 1)
2227 self.vapi.ip_reassembly_enable_disable(
2228 sw_if_index=self.tun_if.sw_if_index, enable_ip4=False
2231 def verify_tun_64(self, p, count=1):
2232 self.vapi.cli("clear errors")
2233 self.vapi.cli("clear ipsec sa")
2235 send_pkts = self.gen_encrypt_pkts6(
2239 src=p.remote_tun_if_host6,
2240 dst=self.pg1.remote_ip6,
2243 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
2244 for recv_pkt in recv_pkts:
2245 self.assert_equal(recv_pkt[IPv6].src, p.remote_tun_if_host6)
2246 self.assert_equal(recv_pkt[IPv6].dst, self.pg1.remote_ip6)
2247 self.assert_packet_checksums_valid(recv_pkt)
2248 send_pkts = self.gen_pkts6(
2251 src=self.pg1.remote_ip6,
2252 dst=p.remote_tun_if_host6,
2255 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
2256 for recv_pkt in recv_pkts:
2258 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IP])
2259 if not decrypt_pkt.haslayer(IPv6):
2260 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
2261 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
2262 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host6)
2263 self.assert_packet_checksums_valid(decrypt_pkt)
2265 self.logger.error(ppp("Unexpected packet:", recv_pkt))
2267 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
2272 self.logger.info(self.vapi.ppcli("show error"))
2273 self.logger.info(self.vapi.ppcli("show ipsec all"))
2275 self.verify_counters4(p, count)
2277 def verify_keepalive(self, p):
2278 # the sizeof Raw is calculated to pad to the minimum ehternet
2279 # frame size of 64 btyes
2281 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
2282 / IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
2283 / UDP(sport=333, dport=4500)
2287 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
2288 self.assert_error_counter_equal(
2289 "/err/%s/nat_keepalive" % self.tun4_input_node, 31
2293 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
2294 / IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
2295 / UDP(sport=333, dport=4500)
2298 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
2299 self.assert_error_counter_equal("/err/%s/too_short" % self.tun4_input_node, 31)
2302 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
2303 / IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
2304 / UDP(sport=333, dport=4500)
2308 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
2309 self.assert_error_counter_equal("/err/%s/too_short" % self.tun4_input_node, 62)
2312 class IpsecTun4Tests(IpsecTun4):
2313 """UT test methods for Tunnel v4"""
2315 def test_tun_basic44(self):
2316 """ipsec 4o4 tunnel basic test"""
2317 self.verify_tun_44(self.params[socket.AF_INET], count=1)
2318 self.tun_if.admin_down()
2319 self.tun_if.resolve_arp()
2320 self.tun_if.admin_up()
2321 self.verify_tun_44(self.params[socket.AF_INET], count=1)
2323 def test_tun_reass_basic44(self):
2324 """ipsec 4o4 tunnel basic reassembly test"""
2325 self.verify_tun_reass_44(self.params[socket.AF_INET])
2327 def test_tun_burst44(self):
2328 """ipsec 4o4 tunnel burst test"""
2329 self.verify_tun_44(self.params[socket.AF_INET], count=127)
2332 class IpsecTun6(object):
2333 """verify methods for Tunnel v6"""
2335 def verify_counters6(self, p_in, p_out, count, worker=None):
2336 if hasattr(p_in, "tun_sa_in"):
2337 pkts = p_in.tun_sa_in.get_stats(worker)["packets"]
2339 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
2341 if hasattr(p_out, "tun_sa_out"):
2342 pkts = p_out.tun_sa_out.get_stats(worker)["packets"]
2346 "incorrect SA out counts: expected %d != %d" % (count, pkts),
2348 self.assert_packet_counter_equal(self.tun6_encrypt_node_name, count)
2349 self.assert_packet_counter_equal(self.tun6_decrypt_node_name[0], count)
2351 def verify_decrypted6(self, p, rxs):
2353 self.assert_equal(rx[IPv6].src, p.remote_tun_if_host)
2354 self.assert_equal(rx[IPv6].dst, self.pg1.remote_ip6)
2355 self.assert_packet_checksums_valid(rx)
2357 def verify_encrypted6(self, p, sa, rxs):
2359 self.assert_packet_checksums_valid(rx)
2360 self.assertEqual(len(rx) - len(Ether()) - len(IPv6()), rx[IPv6].plen)
2361 self.assert_equal(rx[IPv6].hlim, p.outer_hop_limit)
2362 if p.outer_flow_label:
2363 self.assert_equal(rx[IPv6].fl, p.outer_flow_label)
2365 decrypt_pkt = p.vpp_tun_sa.decrypt(rx[IPv6])
2366 if not decrypt_pkt.haslayer(IPv6):
2367 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
2368 self.assert_packet_checksums_valid(decrypt_pkt)
2369 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
2370 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
2371 self.assert_equal(decrypt_pkt.hlim, p.inner_hop_limit - 1)
2372 self.assert_equal(decrypt_pkt.fl, p.inner_flow_label)
2374 self.logger.debug(ppp("Unexpected packet:", rx))
2376 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
2381 def verify_drop_tun_tx_66(self, p_in, count=1, payload_size=64):
2382 self.vapi.cli("clear errors")
2383 self.vapi.cli("clear ipsec sa")
2385 send_pkts = self.gen_pkts6(
2388 src=self.pg1.remote_ip6,
2389 dst=p_in.remote_tun_if_host,
2391 payload_size=payload_size,
2393 self.send_and_assert_no_replies(self.tun_if, send_pkts)
2394 self.logger.info(self.vapi.cli("sh punt stats"))
2396 def verify_drop_tun_rx_66(self, p_in, count=1, payload_size=64):
2397 self.vapi.cli("clear errors")
2398 self.vapi.cli("clear ipsec sa")
2400 send_pkts = self.gen_encrypt_pkts6(
2404 src=p_in.remote_tun_if_host,
2405 dst=self.pg1.remote_ip6,
2408 self.send_and_assert_no_replies(self.tun_if, send_pkts)
2410 def verify_drop_tun_66(self, p_in, count=1, payload_size=64):
2411 self.verify_drop_tun_tx_66(p_in, count=count, payload_size=payload_size)
2412 self.verify_drop_tun_rx_66(p_in, count=count, payload_size=payload_size)
2414 def verify_tun_66(self, p_in, p_out=None, count=1, payload_size=64):
2415 self.vapi.cli("clear errors")
2416 self.vapi.cli("clear ipsec sa")
2420 send_pkts = self.gen_encrypt_pkts6(
2424 src=p_in.remote_tun_if_host,
2425 dst=self.pg1.remote_ip6,
2427 payload_size=payload_size,
2429 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
2430 self.verify_decrypted6(p_in, recv_pkts)
2432 send_pkts = self.gen_pkts6(
2435 src=self.pg1.remote_ip6,
2436 dst=p_out.remote_tun_if_host,
2438 payload_size=payload_size,
2440 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
2441 self.verify_encrypted6(p_out, p_out.vpp_tun_sa, recv_pkts)
2443 for rx in recv_pkts:
2444 self.assertEqual(rx[IPv6].src, p_out.tun_src)
2445 self.assertEqual(rx[IPv6].dst, p_out.tun_dst)
2448 self.logger.info(self.vapi.ppcli("show error"))
2449 self.logger.info(self.vapi.ppcli("show ipsec all"))
2450 self.verify_counters6(p_in, p_out, count)
2452 def verify_tun_reass_66(self, p):
2453 self.vapi.cli("clear errors")
2454 self.vapi.ip_reassembly_enable_disable(
2455 sw_if_index=self.tun_if.sw_if_index, enable_ip6=True
2459 send_pkts = self.gen_encrypt_pkts6(
2463 src=p.remote_tun_if_host,
2464 dst=self.pg1.remote_ip6,
2468 send_pkts = fragment_rfc8200(send_pkts[0], 1, 1400, self.logger)
2469 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1, n_rx=1)
2470 self.verify_decrypted6(p, recv_pkts)
2472 send_pkts = self.gen_pkts6(
2475 src=self.pg1.remote_ip6,
2476 dst=p.remote_tun_if_host,
2480 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
2481 self.verify_encrypted6(p, p.vpp_tun_sa, recv_pkts)
2483 self.logger.info(self.vapi.ppcli("show error"))
2484 self.logger.info(self.vapi.ppcli("show ipsec all"))
2485 self.verify_counters6(p, p, 1)
2486 self.vapi.ip_reassembly_enable_disable(
2487 sw_if_index=self.tun_if.sw_if_index, enable_ip6=False
2490 def verify_tun_46(self, p, count=1):
2491 """ipsec 4o6 tunnel basic test"""
2492 self.vapi.cli("clear errors")
2493 self.vapi.cli("clear ipsec sa")
2495 send_pkts = self.gen_encrypt_pkts(
2499 src=p.remote_tun_if_host4,
2500 dst=self.pg1.remote_ip4,
2503 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
2504 for recv_pkt in recv_pkts:
2505 self.assert_equal(recv_pkt[IP].src, p.remote_tun_if_host4)
2506 self.assert_equal(recv_pkt[IP].dst, self.pg1.remote_ip4)
2507 self.assert_packet_checksums_valid(recv_pkt)
2508 send_pkts = self.gen_pkts(
2510 src=self.pg1.remote_ip4,
2511 dst=p.remote_tun_if_host4,
2514 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
2515 for recv_pkt in recv_pkts:
2517 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IPv6])
2518 if not decrypt_pkt.haslayer(IP):
2519 decrypt_pkt = IP(decrypt_pkt[Raw].load)
2520 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
2521 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host4)
2522 self.assert_packet_checksums_valid(decrypt_pkt)
2524 self.logger.debug(ppp("Unexpected packet:", recv_pkt))
2526 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
2531 self.logger.info(self.vapi.ppcli("show error"))
2532 self.logger.info(self.vapi.ppcli("show ipsec all"))
2533 self.verify_counters6(p, p, count)
2535 def verify_keepalive(self, p):
2536 # the sizeof Raw is calculated to pad to the minimum ehternet
2537 # frame size of 64 btyes
2539 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
2540 / IPv6(src=p.remote_tun_if_host, dst=self.tun_if.local_ip6)
2541 / UDP(sport=333, dport=4500)
2545 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
2546 self.assert_error_counter_equal(
2547 "/err/%s/nat_keepalive" % self.tun6_input_node, 31
2551 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
2552 / IPv6(src=p.remote_tun_if_host, dst=self.tun_if.local_ip6)
2553 / UDP(sport=333, dport=4500)
2556 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
2557 self.assert_error_counter_equal("/err/%s/too_short" % self.tun6_input_node, 31)
2560 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
2561 / IPv6(src=p.remote_tun_if_host, dst=self.tun_if.local_ip6)
2562 / UDP(sport=333, dport=4500)
2566 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
2567 self.assert_error_counter_equal("/err/%s/too_short" % self.tun6_input_node, 62)
2570 class IpsecTun6Tests(IpsecTun6):
2571 """UT test methods for Tunnel v6"""
2573 def test_tun_basic66(self):
2574 """ipsec 6o6 tunnel basic test"""
2575 self.verify_tun_66(self.params[socket.AF_INET6], count=1)
2577 def test_tun_reass_basic66(self):
2578 """ipsec 6o6 tunnel basic reassembly test"""
2579 self.verify_tun_reass_66(self.params[socket.AF_INET6])
2581 def test_tun_burst66(self):
2582 """ipsec 6o6 tunnel burst test"""
2583 self.verify_tun_66(self.params[socket.AF_INET6], count=257)
2586 class IpsecTun6HandoffTests(IpsecTun6):
2587 """UT test methods for Tunnel v6 with multiple workers"""
2589 vpp_worker_count = 2
2591 def test_tun_handoff_66(self):
2592 """ipsec 6o6 tunnel worker hand-off test"""
2593 self.vapi.cli("clear errors")
2594 self.vapi.cli("clear ipsec sa")
2597 p = self.params[socket.AF_INET6]
2599 # inject alternately on worker 0 and 1. all counts on the SA
2600 # should be against worker 0
2601 for worker in [0, 1, 0, 1]:
2602 send_pkts = self.gen_encrypt_pkts6(
2606 src=p.remote_tun_if_host,
2607 dst=self.pg1.remote_ip6,
2610 recv_pkts = self.send_and_expect(
2611 self.tun_if, send_pkts, self.pg1, worker=worker
2613 self.verify_decrypted6(p, recv_pkts)
2615 send_pkts = self.gen_pkts6(
2618 src=self.pg1.remote_ip6,
2619 dst=p.remote_tun_if_host,
2622 recv_pkts = self.send_and_expect(
2623 self.pg1, send_pkts, self.tun_if, worker=worker
2625 self.verify_encrypted6(p, p.vpp_tun_sa, recv_pkts)
2627 # all counts against the first worker that was used
2628 self.verify_counters6(p, p, 4 * N_PKTS, worker=0)
2631 class IpsecTun4HandoffTests(IpsecTun4):
2632 """UT test methods for Tunnel v4 with multiple workers"""
2634 vpp_worker_count = 2
2636 def test_tun_handooff_44(self):
2637 """ipsec 4o4 tunnel worker hand-off test"""
2638 self.vapi.cli("clear errors")
2639 self.vapi.cli("clear ipsec sa")
2642 p = self.params[socket.AF_INET]
2644 # inject alternately on worker 0 and 1. all counts on the SA
2645 # should be against worker 0
2646 for worker in [0, 1, 0, 1]:
2647 send_pkts = self.gen_encrypt_pkts(
2651 src=p.remote_tun_if_host,
2652 dst=self.pg1.remote_ip4,
2655 recv_pkts = self.send_and_expect(
2656 self.tun_if, send_pkts, self.pg1, worker=worker
2658 self.verify_decrypted(p, recv_pkts)
2660 send_pkts = self.gen_pkts(
2662 src=self.pg1.remote_ip4,
2663 dst=p.remote_tun_if_host,
2666 recv_pkts = self.send_and_expect(
2667 self.pg1, send_pkts, self.tun_if, worker=worker
2669 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
2671 # all counts against the first worker that was used
2672 self.verify_counters4(p, 4 * N_PKTS, worker=0)
2675 class IpsecTun46Tests(IpsecTun4Tests, IpsecTun6Tests):
2676 """UT test methods for Tunnel v6 & v4"""
2681 class IPSecIPv4Fwd(VppTestCase):
2682 """Test IPSec by capturing and verifying IPv4 forwarded pkts"""
2685 def setUpConstants(cls):
2686 super(IPSecIPv4Fwd, cls).setUpConstants()
2689 super(IPSecIPv4Fwd, self).setUp()
2690 # store SPD objects so we can remove configs on tear down
2692 self.spd_policies = []
2695 # remove SPD policies
2696 for obj in self.spd_policies:
2697 obj.remove_vpp_config()
2698 self.spd_policies = []
2699 # remove SPD items (interface bindings first, then SPD)
2700 for obj in reversed(self.spd_objs):
2701 obj.remove_vpp_config()
2703 # close down pg intfs
2704 for pg in self.pg_interfaces:
2707 super(IPSecIPv4Fwd, self).tearDown()
2709 def create_interfaces(self, num_ifs=2):
2710 # create interfaces pg0 ... pg<num_ifs>
2711 self.create_pg_interfaces(range(num_ifs))
2712 for pg in self.pg_interfaces:
2713 # put the interface up
2715 # configure IPv4 address on the interface
2717 # resolve ARP, so that we know VPP MAC
2719 self.logger.info(self.vapi.ppcli("show int addr"))
2721 def spd_create_and_intf_add(self, spd_id, pg_list):
2722 spd = VppIpsecSpd(self, spd_id)
2723 spd.add_vpp_config()
2724 self.spd_objs.append(spd)
2726 spdItf = VppIpsecSpdItfBinding(self, spd, pg)
2727 spdItf.add_vpp_config()
2728 self.spd_objs.append(spdItf)
2730 def get_policy(self, policy_type):
2731 e = VppEnum.vl_api_ipsec_spd_action_t
2732 if policy_type == "protect":
2733 return e.IPSEC_API_SPD_ACTION_PROTECT
2734 elif policy_type == "bypass":
2735 return e.IPSEC_API_SPD_ACTION_BYPASS
2736 elif policy_type == "discard":
2737 return e.IPSEC_API_SPD_ACTION_DISCARD
2739 raise Exception("Invalid policy type: %s", policy_type)
2741 def spd_add_rem_policy(
2753 local_ip_start=ip_address("0.0.0.0"),
2754 local_ip_stop=ip_address("255.255.255.255"),
2755 remote_ip_start=ip_address("0.0.0.0"),
2756 remote_ip_stop=ip_address("255.255.255.255"),
2757 remote_port_start=0,
2758 remote_port_stop=65535,
2760 local_port_stop=65535,
2762 spd = VppIpsecSpd(self, spd_id)
2765 src_range_low = ip_address("0.0.0.0")
2766 src_range_high = ip_address("255.255.255.255")
2767 dst_range_low = ip_address("0.0.0.0")
2768 dst_range_high = ip_address("255.255.255.255")
2771 src_range_low = local_ip_start
2772 src_range_high = local_ip_stop
2773 dst_range_low = remote_ip_start
2774 dst_range_high = remote_ip_stop
2777 src_range_low = src_if.remote_ip4
2778 src_range_high = src_if.remote_ip4
2779 dst_range_low = dst_if.remote_ip4
2780 dst_range_high = dst_if.remote_ip4
2782 spdEntry = VppIpsecSpdEntry(
2792 policy=self.get_policy(policy_type),
2794 remote_port_start=remote_port_start,
2795 remote_port_stop=remote_port_stop,
2796 local_port_start=local_port_start,
2797 local_port_stop=local_port_stop,
2801 spdEntry.add_vpp_config()
2802 self.spd_policies.append(spdEntry)
2804 spdEntry.remove_vpp_config()
2805 self.spd_policies.remove(spdEntry)
2806 self.logger.info(self.vapi.ppcli("show ipsec all"))
2809 def create_stream(self, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678):
2811 for i in range(pkt_count):
2812 # create packet info stored in the test case instance
2813 info = self.create_packet_info(src_if, dst_if)
2814 # convert the info into packet payload
2815 payload = self.info_to_payload(info)
2816 # create the packet itself
2818 Ether(dst=src_if.local_mac, src=src_if.remote_mac)
2819 / IP(src=src_if.remote_ip4, dst=dst_if.remote_ip4)
2820 / UDP(sport=src_prt, dport=dst_prt)
2823 # store a copy of the packet in the packet info
2824 info.data = p.copy()
2825 # append the packet to the list
2827 # return the created packet list
2830 def verify_capture(self, src_if, dst_if, capture):
2832 for packet in capture:
2836 # convert the payload to packet info object
2837 payload_info = self.payload_to_info(packet)
2838 # make sure the indexes match
2840 payload_info.src, src_if.sw_if_index, "source sw_if_index"
2843 payload_info.dst, dst_if.sw_if_index, "destination sw_if_index"
2845 packet_info = self.get_next_packet_info_for_interface2(
2846 src_if.sw_if_index, dst_if.sw_if_index, packet_info
2848 # make sure we didn't run out of saved packets
2849 self.assertIsNotNone(packet_info)
2851 payload_info.index, packet_info.index, "packet info index"
2853 saved_packet = packet_info.data # fetch the saved packet
2854 # assert the values match
2855 self.assert_equal(ip.src, saved_packet[IP].src, "IP source address")
2856 # ... more assertions here
2857 self.assert_equal(udp.sport, saved_packet[UDP].sport, "UDP source port")
2858 except Exception as e:
2859 self.logger.error(ppp("Unexpected or invalid packet:", packet))
2861 remaining_packet = self.get_next_packet_info_for_interface2(
2862 src_if.sw_if_index, dst_if.sw_if_index, packet_info
2866 "Interface %s: Packet expected from interface "
2867 "%s didn't arrive" % (dst_if.name, src_if.name),
2870 def verify_policy_match(self, pkt_count, spdEntry):
2871 self.logger.info("XXXX %s %s", str(spdEntry), str(spdEntry.get_stats()))
2872 matched_pkts = spdEntry.get_stats().get("packets")
2873 self.logger.info("Policy %s matched: %d pkts", str(spdEntry), matched_pkts)
2874 self.assert_equal(pkt_count, matched_pkts)
2877 class SpdFlowCacheTemplate(IPSecIPv4Fwd):
2879 def setUpConstants(cls):
2880 super(SpdFlowCacheTemplate, cls).setUpConstants()
2881 # Override this method with required cmdline parameters e.g.
2882 # cls.vpp_cmdline.extend(["ipsec", "{",
2883 # "ipv4-outbound-spd-flow-cache on",
2885 # cls.logger.info("VPP modified cmdline is %s" % " "
2886 # .join(cls.vpp_cmdline))
2889 super(SpdFlowCacheTemplate, self).setUp()
2892 super(SpdFlowCacheTemplate, self).tearDown()
2894 def get_spd_flow_cache_entries(self, outbound):
2895 """'show ipsec spd' output:
2896 ipv4-inbound-spd-flow-cache-entries: 0
2897 ipv4-outbound-spd-flow-cache-entries: 0
2899 show_ipsec_reply = self.vapi.cli("show ipsec spd")
2900 # match the relevant section of 'show ipsec spd' output
2902 regex_match = re.search(
2903 "ipv4-outbound-spd-flow-cache-entries: (.*)",
2908 regex_match = re.search(
2909 "ipv4-inbound-spd-flow-cache-entries: (.*)", show_ipsec_reply, re.DOTALL
2911 if regex_match is None:
2913 "Unable to find spd flow cache entries \
2914 in 'show ipsec spd' CLI output - regex failed to match"
2918 num_entries = int(regex_match.group(1))
2921 "Unable to get spd flow cache entries \
2922 from 'show ipsec spd' string: %s",
2923 regex_match.group(0),
2925 self.logger.info("%s", regex_match.group(0))
2928 def verify_num_outbound_flow_cache_entries(self, expected_elements):
2930 self.get_spd_flow_cache_entries(outbound=True), expected_elements
2933 def verify_num_inbound_flow_cache_entries(self, expected_elements):
2935 self.get_spd_flow_cache_entries(outbound=False), expected_elements
2938 def crc32_supported(self):
2939 # lscpu is part of util-linux package, available on all Linux Distros
2940 stream = os.popen("lscpu")
2941 cpu_info = stream.read()
2942 # feature/flag "crc32" on Aarch64 and "sse4_2" on x86
2943 # see vppinfra/crc32.h
2944 if "crc32" or "sse4_2" in cpu_info:
2945 self.logger.info("\ncrc32 supported:\n" + cpu_info)
2948 self.logger.info("\ncrc32 NOT supported:\n" + cpu_info)
2952 class IPSecIPv6Fwd(VppTestCase):
2953 """Test IPSec by capturing and verifying IPv6 forwarded pkts"""
2956 def setUpConstants(cls):
2957 super(IPSecIPv6Fwd, cls).setUpConstants()
2960 super(IPSecIPv6Fwd, self).setUp()
2961 # store SPD objects so we can remove configs on tear down
2963 self.spd_policies = []
2966 # remove SPD policies
2967 for obj in self.spd_policies:
2968 obj.remove_vpp_config()
2969 self.spd_policies = []
2970 # remove SPD items (interface bindings first, then SPD)
2971 for obj in reversed(self.spd_objs):
2972 obj.remove_vpp_config()
2974 # close down pg intfs
2975 for pg in self.pg_interfaces:
2978 super(IPSecIPv6Fwd, self).tearDown()
2980 def create_interfaces(self, num_ifs=2):
2981 # create interfaces pg0 ... pg<num_ifs>
2982 self.create_pg_interfaces(range(num_ifs))
2983 for pg in self.pg_interfaces:
2984 # put the interface up
2986 # configure IPv6 address on the interface
2989 self.logger.info(self.vapi.ppcli("show int addr"))
2991 def spd_create_and_intf_add(self, spd_id, pg_list):
2992 spd = VppIpsecSpd(self, spd_id)
2993 spd.add_vpp_config()
2994 self.spd_objs.append(spd)
2996 spdItf = VppIpsecSpdItfBinding(self, spd, pg)
2997 spdItf.add_vpp_config()
2998 self.spd_objs.append(spdItf)
3000 def get_policy(self, policy_type):
3001 e = VppEnum.vl_api_ipsec_spd_action_t
3002 if policy_type == "protect":
3003 return e.IPSEC_API_SPD_ACTION_PROTECT
3004 elif policy_type == "bypass":
3005 return e.IPSEC_API_SPD_ACTION_BYPASS
3006 elif policy_type == "discard":
3007 return e.IPSEC_API_SPD_ACTION_DISCARD
3009 raise Exception("Invalid policy type: %s", policy_type)
3011 def spd_add_rem_policy(
3023 local_ip_start=ip_address("0::0"),
3024 local_ip_stop=ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"),
3025 remote_ip_start=ip_address("0::0"),
3026 remote_ip_stop=ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"),
3027 remote_port_start=0,
3028 remote_port_stop=65535,
3030 local_port_stop=65535,
3032 spd = VppIpsecSpd(self, spd_id)
3035 src_range_low = ip_address("0::0")
3036 src_range_high = ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")
3037 dst_range_low = ip_address("0::0")
3038 dst_range_high = ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")
3041 src_range_low = local_ip_start
3042 src_range_high = local_ip_stop
3043 dst_range_low = remote_ip_start
3044 dst_range_high = remote_ip_stop
3047 src_range_low = src_if.remote_ip6
3048 src_range_high = src_if.remote_ip6
3049 dst_range_low = dst_if.remote_ip6
3050 dst_range_high = dst_if.remote_ip6
3052 spdEntry = VppIpsecSpdEntry(
3062 policy=self.get_policy(policy_type),
3064 remote_port_start=remote_port_start,
3065 remote_port_stop=remote_port_stop,
3066 local_port_start=local_port_start,
3067 local_port_stop=local_port_stop,
3071 spdEntry.add_vpp_config()
3072 self.spd_policies.append(spdEntry)
3074 spdEntry.remove_vpp_config()
3075 self.spd_policies.remove(spdEntry)
3076 self.logger.info(self.vapi.ppcli("show ipsec all"))
3079 def create_stream(self, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678):
3081 for i in range(pkt_count):
3082 # create packet info stored in the test case instance
3083 info = self.create_packet_info(src_if, dst_if)
3084 # convert the info into packet payload
3085 payload = self.info_to_payload(info)
3086 # create the packet itself
3088 Ether(dst=src_if.local_mac, src=src_if.remote_mac)
3089 / IPv6(src=src_if.remote_ip6, dst=dst_if.remote_ip6)
3090 / UDP(sport=src_prt, dport=dst_prt)
3093 # store a copy of the packet in the packet info
3094 info.data = p.copy()
3095 # append the packet to the list
3097 # return the created packet list
3100 def verify_capture(self, src_if, dst_if, capture):
3102 for packet in capture:
3106 # convert the payload to packet info object
3107 payload_info = self.payload_to_info(packet)
3108 # make sure the indexes match
3110 payload_info.src, src_if.sw_if_index, "source sw_if_index"
3113 payload_info.dst, dst_if.sw_if_index, "destination sw_if_index"
3115 packet_info = self.get_next_packet_info_for_interface2(
3116 src_if.sw_if_index, dst_if.sw_if_index, packet_info
3118 # make sure we didn't run out of saved packets
3119 self.assertIsNotNone(packet_info)
3121 payload_info.index, packet_info.index, "packet info index"
3123 saved_packet = packet_info.data # fetch the saved packet
3124 # assert the values match
3125 self.assert_equal(ip.src, saved_packet[IPv6].src, "IP source address")
3126 # ... more assertions here
3127 self.assert_equal(udp.sport, saved_packet[UDP].sport, "UDP source port")
3128 except Exception as e:
3129 self.logger.error(ppp("Unexpected or invalid packet:", packet))
3131 remaining_packet = self.get_next_packet_info_for_interface2(
3132 src_if.sw_if_index, dst_if.sw_if_index, packet_info
3136 "Interface %s: Packet expected from interface "
3137 "%s didn't arrive" % (dst_if.name, src_if.name),
3140 def verify_policy_match(self, pkt_count, spdEntry):
3141 self.logger.info("XXXX %s %s", str(spdEntry), str(spdEntry.get_stats()))
3142 matched_pkts = spdEntry.get_stats().get("packets")
3143 self.logger.info("Policy %s matched: %d pkts", str(spdEntry), matched_pkts)
3144 self.assert_equal(pkt_count, matched_pkts)
3147 if __name__ == "__main__":
3148 unittest.main(testRunner=VppTestRunner)