3 from scapy.layers.ipsec import ESP
4 from scapy.layers.inet import IP, ICMP, UDP
5 from scapy.layers.inet6 import IPv6
6 from scapy.layers.l2 import Ether
7 from scapy.packet import Raw
9 from parameterized import parameterized
10 from framework import VppTestRunner
11 from template_ipsec import IpsecTra46Tests, IpsecTun46Tests, TemplateIpsec, \
12 IpsecTcpTests, IpsecTun4Tests, IpsecTra4Tests, config_tra_params, \
13 config_tun_params, IPsecIPv4Params, IPsecIPv6Params, \
14 IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6, \
15 IpsecTun6HandoffTests, IpsecTun4HandoffTests, \
17 from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSA,\
19 from vpp_ip_route import VppIpRoute, VppRoutePath
20 from vpp_ip import DpoProto
21 from vpp_papi import VppEnum
24 engines_supporting_chain_bufs = ["openssl"]
27 class ConfigIpsecESP(TemplateIpsec):
29 tra4_encrypt_node_name = "esp4-encrypt"
30 tra4_decrypt_node_name = "esp4-decrypt"
31 tra6_encrypt_node_name = "esp6-encrypt"
32 tra6_decrypt_node_name = "esp6-decrypt"
33 tun4_encrypt_node_name = "esp4-encrypt"
34 tun4_decrypt_node_name = "esp4-decrypt"
35 tun6_encrypt_node_name = "esp6-encrypt"
36 tun6_decrypt_node_name = "esp6-decrypt"
40 super(ConfigIpsecESP, cls).setUpClass()
43 def tearDownClass(cls):
44 super(ConfigIpsecESP, cls).tearDownClass()
47 super(ConfigIpsecESP, self).setUp()
50 super(ConfigIpsecESP, self).tearDown()
52 def config_network(self, params):
54 self.tun_if = self.pg0
55 self.tra_if = self.pg2
56 self.logger.info(self.vapi.ppcli("show int addr"))
58 self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
59 self.tra_spd.add_vpp_config()
60 self.net_objs.append(self.tra_spd)
61 self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
62 self.tun_spd.add_vpp_config()
63 self.net_objs.append(self.tun_spd)
65 b = VppIpsecSpdItfBinding(self, self.tun_spd,
68 self.net_objs.append(b)
70 b = VppIpsecSpdItfBinding(self, self.tra_spd,
73 self.net_objs.append(b)
76 self.config_esp_tra(p)
77 config_tra_params(p, self.encryption_type)
79 self.config_esp_tun(p)
80 config_tun_params(p, self.encryption_type, self.tun_if)
83 d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4
84 r = VppIpRoute(self, p.remote_tun_if_host, p.addr_len,
85 [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
89 self.net_objs.append(r)
91 self.logger.info(self.vapi.ppcli("show ipsec all"))
93 def unconfig_network(self):
94 for o in reversed(self.net_objs):
98 def config_esp_tun(self, params):
99 addr_type = params.addr_type
100 scapy_tun_sa_id = params.scapy_tun_sa_id
101 scapy_tun_spi = params.scapy_tun_spi
102 vpp_tun_sa_id = params.vpp_tun_sa_id
103 vpp_tun_spi = params.vpp_tun_spi
104 auth_algo_vpp_id = params.auth_algo_vpp_id
105 auth_key = params.auth_key
106 crypt_algo_vpp_id = params.crypt_algo_vpp_id
107 crypt_key = params.crypt_key
108 remote_tun_if_host = params.remote_tun_if_host
109 addr_any = params.addr_any
110 addr_bcast = params.addr_bcast
111 e = VppEnum.vl_api_ipsec_spd_action_t
113 tun_flags = params.tun_flags
117 params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi,
118 auth_algo_vpp_id, auth_key,
119 crypt_algo_vpp_id, crypt_key,
120 self.vpp_esp_protocol,
121 self.tun_if.local_addr[addr_type],
122 self.tun_if.remote_addr[addr_type],
127 params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi,
128 auth_algo_vpp_id, auth_key,
129 crypt_algo_vpp_id, crypt_key,
130 self.vpp_esp_protocol,
131 self.tun_if.remote_addr[addr_type],
132 self.tun_if.local_addr[addr_type],
137 objs.append(params.tun_sa_in)
138 objs.append(params.tun_sa_out)
140 params.spd_policy_in_any = VppIpsecSpdEntry(self, self.tun_spd,
142 addr_any, addr_bcast,
143 addr_any, addr_bcast,
145 params.spd_policy_out_any = VppIpsecSpdEntry(self, self.tun_spd,
147 addr_any, addr_bcast,
148 addr_any, addr_bcast,
151 objs.append(params.spd_policy_out_any)
152 objs.append(params.spd_policy_in_any)
154 objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
155 remote_tun_if_host, remote_tun_if_host,
156 self.pg1.remote_addr[addr_type],
157 self.pg1.remote_addr[addr_type],
160 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
162 objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
163 self.pg1.remote_addr[addr_type],
164 self.pg1.remote_addr[addr_type],
165 remote_tun_if_host, remote_tun_if_host,
167 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
169 objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
170 remote_tun_if_host, remote_tun_if_host,
171 self.pg0.local_addr[addr_type],
172 self.pg0.local_addr[addr_type],
175 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
177 objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
178 self.pg0.local_addr[addr_type],
179 self.pg0.local_addr[addr_type],
180 remote_tun_if_host, remote_tun_if_host,
182 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
186 self.net_objs = self.net_objs + objs
188 def config_esp_tra(self, params):
189 addr_type = params.addr_type
190 scapy_tra_sa_id = params.scapy_tra_sa_id
191 scapy_tra_spi = params.scapy_tra_spi
192 vpp_tra_sa_id = params.vpp_tra_sa_id
193 vpp_tra_spi = params.vpp_tra_spi
194 auth_algo_vpp_id = params.auth_algo_vpp_id
195 auth_key = params.auth_key
196 crypt_algo_vpp_id = params.crypt_algo_vpp_id
197 crypt_key = params.crypt_key
198 addr_any = params.addr_any
199 addr_bcast = params.addr_bcast
200 flags = (VppEnum.vl_api_ipsec_sad_flags_t.
201 IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
202 e = VppEnum.vl_api_ipsec_spd_action_t
203 flags = params.flags | flags
207 params.tra_sa_in = VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi,
208 auth_algo_vpp_id, auth_key,
209 crypt_algo_vpp_id, crypt_key,
210 self.vpp_esp_protocol,
213 params.tra_sa_out = VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi,
214 auth_algo_vpp_id, auth_key,
215 crypt_algo_vpp_id, crypt_key,
216 self.vpp_esp_protocol,
219 objs.append(params.tra_sa_in)
220 objs.append(params.tra_sa_out)
222 objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
223 addr_any, addr_bcast,
224 addr_any, addr_bcast,
226 objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
227 addr_any, addr_bcast,
228 addr_any, addr_bcast,
231 objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
232 self.tra_if.local_addr[addr_type],
233 self.tra_if.local_addr[addr_type],
234 self.tra_if.remote_addr[addr_type],
235 self.tra_if.remote_addr[addr_type],
237 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
239 objs.append(VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
240 self.tra_if.local_addr[addr_type],
241 self.tra_if.local_addr[addr_type],
242 self.tra_if.remote_addr[addr_type],
243 self.tra_if.remote_addr[addr_type],
244 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
248 self.net_objs = self.net_objs + objs
251 class TemplateIpsecEsp(ConfigIpsecESP):
253 Basic test for ipsec esp sanity - tunnel and transport modes.
255 Below 4 cases are covered as part of this test
256 1) ipsec esp v4 transport basic test - IPv4 Transport mode
257 scenario using HMAC-SHA1-96 integrity algo
258 2) ipsec esp v4 transport burst test
259 Above test for 257 pkts
260 3) ipsec esp 4o4 tunnel basic test - IPv4 Tunnel mode
261 scenario using HMAC-SHA1-96 integrity algo
262 4) ipsec esp 4o4 tunnel burst test
263 Above test for 257 pkts
268 |pg2| <-------> |VPP|
273 --- encrypt --- plain ---
274 |pg0| <------- |VPP| <------ |pg1|
277 --- decrypt --- plain ---
278 |pg0| -------> |VPP| ------> |pg1|
284 super(TemplateIpsecEsp, cls).setUpClass()
287 def tearDownClass(cls):
288 super(TemplateIpsecEsp, cls).tearDownClass()
291 super(TemplateIpsecEsp, self).setUp()
292 self.config_network(self.params.values())
295 self.unconfig_network()
296 super(TemplateIpsecEsp, self).tearDown()
299 class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests,
300 IpsecTun46Tests, IpsecTra6ExtTests):
301 """ Ipsec ESP - TUN & TRA tests """
305 super(TestIpsecEsp1, cls).setUpClass()
308 def tearDownClass(cls):
309 super(TestIpsecEsp1, cls).tearDownClass()
312 super(TestIpsecEsp1, self).setUp()
315 super(TestIpsecEsp1, self).tearDown()
317 def test_tun_46(self):
318 """ ipsec 4o6 tunnel """
319 # add an SPD entry to direct 2.2.2.2 to the v6 tunnel SA
320 p6 = self.ipv6_params
321 p4 = self.ipv4_params
323 p6.remote_tun_if_host4 = "2.2.2.2"
324 e = VppEnum.vl_api_ipsec_spd_action_t
326 VppIpsecSpdEntry(self,
329 self.pg1.remote_addr[p4.addr_type],
330 self.pg1.remote_addr[p4.addr_type],
331 p6.remote_tun_if_host4,
332 p6.remote_tun_if_host4,
335 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
336 is_outbound=1).add_vpp_config()
337 VppIpRoute(self, p6.remote_tun_if_host4, p4.addr_len,
338 [VppRoutePath(self.tun_if.remote_addr[p4.addr_type],
339 0xffffffff)]).add_vpp_config()
341 old_name = self.tun6_encrypt_node_name
342 self.tun6_encrypt_node_name = "esp4-encrypt"
344 self.verify_tun_46(p6, count=63)
345 self.tun6_encrypt_node_name = old_name
347 def test_tun_64(self):
348 """ ipsec 6o4 tunnel """
349 # add an SPD entry to direct 4444::4 to the v4 tunnel SA
350 p6 = self.ipv6_params
351 p4 = self.ipv4_params
353 p4.remote_tun_if_host6 = "4444::4"
354 e = VppEnum.vl_api_ipsec_spd_action_t
356 VppIpsecSpdEntry(self,
359 self.pg1.remote_addr[p6.addr_type],
360 self.pg1.remote_addr[p6.addr_type],
361 p4.remote_tun_if_host6,
362 p4.remote_tun_if_host6,
365 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
366 is_outbound=1).add_vpp_config()
367 d = DpoProto.DPO_PROTO_IP6
368 VppIpRoute(self, p4.remote_tun_if_host6, p6.addr_len,
369 [VppRoutePath(self.tun_if.remote_addr[p6.addr_type],
371 proto=d)]).add_vpp_config()
373 old_name = self.tun4_encrypt_node_name
374 self.tun4_encrypt_node_name = "esp6-encrypt"
375 self.verify_tun_64(p4, count=63)
376 self.tun4_encrypt_node_name = old_name
379 class TestIpsecEspTun(TemplateIpsecEsp, IpsecTun46Tests):
380 """ Ipsec ESP - TUN encap tests """
383 self.ipv4_params = IPsecIPv4Params()
384 self.ipv6_params = IPsecIPv6Params()
386 c = (VppEnum.vl_api_tunnel_encap_decap_flags_t.
387 TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
388 c1 = c | (VppEnum.vl_api_tunnel_encap_decap_flags_t.
389 TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
391 self.ipv4_params.tun_flags = c
392 self.ipv6_params.tun_flags = c1
394 super(TestIpsecEspTun, self).setUp()
396 def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
397 # set the DSCP + ECN - flags are set to copy only DSCP
398 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
399 IP(src=src, dst=dst, tos=5) /
400 UDP(sport=4444, dport=4444) /
401 Raw(b'X' * payload_size)
402 for i in range(count)]
404 def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54):
405 # set the DSCP + ECN - flags are set to copy both
406 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
407 IPv6(src=src, dst=dst, tc=5) /
408 UDP(sport=4444, dport=4444) /
409 Raw(b'X' * payload_size)
410 for i in range(count)]
412 def verify_encrypted(self, p, sa, rxs):
413 # just check that only the DSCP is copied
415 self.assertEqual(rx[IP].tos, 4)
417 def verify_encrypted6(self, p, sa, rxs):
418 # just check that the DSCP & ECN are copied
420 self.assertEqual(rx[IPv6].tc, 5)
423 class TestIpsecEspTun2(TemplateIpsecEsp, IpsecTun46Tests):
424 """ Ipsec ESP - TUN DSCP tests """
427 self.ipv4_params = IPsecIPv4Params()
428 self.ipv6_params = IPsecIPv6Params()
430 self.ipv4_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF
431 self.ipv6_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11
433 super(TestIpsecEspTun2, self).setUp()
435 def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
436 # set the DSCP + ECN - flags are set to copy only DSCP
437 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
438 IP(src=src, dst=dst) /
439 UDP(sport=4444, dport=4444) /
440 Raw(b'X' * payload_size)
441 for i in range(count)]
443 def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54):
444 # set the DSCP + ECN - flags are set to copy both
445 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
446 IPv6(src=src, dst=dst) /
447 UDP(sport=4444, dport=4444) /
448 Raw(b'X' * payload_size)
449 for i in range(count)]
451 def verify_encrypted(self, p, sa, rxs):
452 # just check that only the DSCP is copied
454 self.assertEqual(rx[IP].tos,
455 VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF << 2)
457 def verify_encrypted6(self, p, sa, rxs):
458 # just check that the DSCP & ECN are copied
460 self.assertEqual(rx[IPv6].tc,
461 VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11 << 2)
464 class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
465 """ Ipsec ESP - TCP tests """
469 class TestIpsecEspHandoff(TemplateIpsecEsp,
470 IpsecTun6HandoffTests,
471 IpsecTun4HandoffTests):
472 """ Ipsec ESP - handoff tests """
476 class TemplateIpsecEspUdp(ConfigIpsecESP):
483 super(TemplateIpsecEspUdp, cls).setUpClass()
486 def tearDownClass(cls):
487 super(TemplateIpsecEspUdp, cls).tearDownClass()
490 super(TemplateIpsecEspUdp, self).setUp()
492 self.tun_if = self.pg0
493 self.tra_if = self.pg2
494 self.logger.info(self.vapi.ppcli("show int addr"))
497 p.flags = (VppEnum.vl_api_ipsec_sad_flags_t.
498 IPSEC_API_SAD_FLAG_UDP_ENCAP)
499 p.nat_header = UDP(sport=5454, dport=4500)
501 self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
502 self.tra_spd.add_vpp_config()
503 VppIpsecSpdItfBinding(self, self.tra_spd,
504 self.tra_if).add_vpp_config()
506 self.config_esp_tra(p)
507 config_tra_params(p, self.encryption_type)
509 self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
510 self.tun_spd.add_vpp_config()
511 VppIpsecSpdItfBinding(self, self.tun_spd,
512 self.tun_if).add_vpp_config()
514 self.config_esp_tun(p)
515 self.logger.info(self.vapi.ppcli("show ipsec all"))
517 d = DpoProto.DPO_PROTO_IP4
518 VppIpRoute(self, p.remote_tun_if_host, p.addr_len,
519 [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
521 proto=d)]).add_vpp_config()
524 super(TemplateIpsecEspUdp, self).tearDown()
526 def show_commands_at_teardown(self):
527 self.logger.info(self.vapi.cli("show hardware"))
530 class TestIpsecEspUdp(TemplateIpsecEspUdp, IpsecTra4Tests):
531 """ Ipsec NAT-T ESP UDP tests """
535 class MyParameters():
537 self.engines = ["ia32", "ipsecmb", "openssl"]
538 flag_esn = VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN
539 self.flags = [0, flag_esn]
540 # foreach crypto algorithm
542 'AES-GCM-128/NONE': {
543 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
544 IPSEC_API_CRYPTO_ALG_AES_GCM_128),
545 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
546 IPSEC_API_INTEG_ALG_NONE),
547 'scapy-crypto': "AES-GCM",
548 'scapy-integ': "NULL",
549 'key': b"JPjyOWBeVEQiMe7h",
551 'AES-GCM-192/NONE': {
552 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
553 IPSEC_API_CRYPTO_ALG_AES_GCM_192),
554 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
555 IPSEC_API_INTEG_ALG_NONE),
556 'scapy-crypto': "AES-GCM",
557 'scapy-integ': "NULL",
558 'key': b"JPjyOWBeVEQiMe7h01234567",
560 'AES-GCM-256/NONE': {
561 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
562 IPSEC_API_CRYPTO_ALG_AES_GCM_256),
563 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
564 IPSEC_API_INTEG_ALG_NONE),
565 'scapy-crypto': "AES-GCM",
566 'scapy-integ': "NULL",
567 'key': b"JPjyOWBeVEQiMe7h0123456787654321",
569 'AES-CBC-128/MD5-96': {
570 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
571 IPSEC_API_CRYPTO_ALG_AES_CBC_128),
572 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
573 IPSEC_API_INTEG_ALG_MD5_96),
574 'scapy-crypto': "AES-CBC",
575 'scapy-integ': "HMAC-MD5-96",
577 'key': b"JPjyOWBeVEQiMe7h"},
578 'AES-CBC-192/SHA1-96': {
579 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
580 IPSEC_API_CRYPTO_ALG_AES_CBC_192),
581 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
582 IPSEC_API_INTEG_ALG_SHA1_96),
583 'scapy-crypto': "AES-CBC",
584 'scapy-integ': "HMAC-SHA1-96",
586 'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"},
587 'AES-CBC-256/SHA1-96': {
588 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
589 IPSEC_API_CRYPTO_ALG_AES_CBC_256),
590 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
591 IPSEC_API_INTEG_ALG_SHA1_96),
592 'scapy-crypto': "AES-CBC",
593 'scapy-integ': "HMAC-SHA1-96",
595 'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"},
596 '3DES-CBC/SHA1-96': {
597 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
598 IPSEC_API_CRYPTO_ALG_3DES_CBC),
599 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
600 IPSEC_API_INTEG_ALG_SHA1_96),
601 'scapy-crypto': "3DES",
602 'scapy-integ': "HMAC-SHA1-96",
604 'key': b"JPjyOWBeVEQiMe7h00112233"},
606 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
607 IPSEC_API_CRYPTO_ALG_NONE),
608 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
609 IPSEC_API_INTEG_ALG_SHA1_96),
610 'scapy-crypto': "NULL",
611 'scapy-integ': "HMAC-SHA1-96",
613 'key': b"JPjyOWBeVEQiMe7h00112233"}}
616 class RunTestIpsecEspAll(ConfigIpsecESP,
617 IpsecTra4, IpsecTra6,
618 IpsecTun4, IpsecTun6):
619 """ Ipsec ESP all Algos """
622 super(RunTestIpsecEspAll, self).setUp()
623 test_args = str.split(self.__doc__, " ")
625 params = MyParameters()
626 self.engine = test_args[0]
627 self.flag = params.flags[0]
628 if test_args[1] == 'ESN':
629 self.flag = params.flags[1]
631 self.algo = params.algos[test_args[2]]
634 super(RunTestIpsecEspAll, self).tearDown()
637 self.run_a_test(self.engine, self.flag, self.algo)
639 def run_a_test(self, engine, flag, algo, payload_size=None):
642 self.vapi.cli("set crypto handler all %s" % engine)
644 self.ipv4_params = IPsecIPv4Params()
645 self.ipv6_params = IPsecIPv6Params()
647 self.params = {self.ipv4_params.addr_type:
649 self.ipv6_params.addr_type:
652 for _, p in self.params.items():
653 p.auth_algo_vpp_id = algo['vpp-integ']
654 p.crypt_algo_vpp_id = algo['vpp-crypto']
655 p.crypt_algo = algo['scapy-crypto']
656 p.auth_algo = algo['scapy-integ']
657 p.crypt_key = algo['key']
658 p.salt = algo['salt']
659 p.flags = p.flags | flag
661 self.reporter.send_keep_alive(self)
664 # configure the SPDs. SAs, etc
666 self.config_network(self.params.values())
670 # An exhautsive 4o6, 6o4 is not necessary
673 self.verify_tra_basic6(count=NUM_PKTS)
674 self.verify_tra_basic4(count=NUM_PKTS)
675 self.verify_tun_66(self.params[socket.AF_INET6],
678 # Use an odd-byte payload size to check for correct padding.
680 # 49 + 2 == 51 which should pad +1 to 52 for 4 byte alignment, +5
681 # to 56 for 8 byte alignment, and +13 to 64 for 64 byte alignment.
682 # This should catch bugs where the code is incorrectly over-padding
683 # for algorithms that don't require it
684 psz = 49 - len(IP()/ICMP()) if payload_size is None else payload_size
685 self.verify_tun_44(self.params[socket.AF_INET],
686 count=NUM_PKTS, payload_size=psz)
689 1970, # results in 2 chained buffers entering decrypt node
690 # but leaving as simple buffer due to ICV removal (tra4)
691 2004, # footer+ICV will be added to 2nd buffer (tun4)
692 4010, # ICV ends up splitted accross 2 buffers in esp_decrypt
693 # for transport4; transport6 takes normal path
694 4020, # same as above but tra4 and tra6 are switched
696 if self.engine in engines_supporting_chain_bufs:
697 for sz in LARGE_PKT_SZ:
698 self.verify_tra_basic4(count=NUM_PKTS, payload_size=sz)
699 self.verify_tra_basic6(count=NUM_PKTS, payload_size=sz)
700 self.verify_tun_66(self.params[socket.AF_INET6],
701 count=NUM_PKTS, payload_size=sz)
702 self.verify_tun_44(self.params[socket.AF_INET],
703 count=NUM_PKTS, payload_size=sz)
706 # remove the SPDs, SAs, etc
708 self.unconfig_network()
711 # reconfigure the network and SA to run the
714 self.config_network(self.params.values())
715 self.verify_tra_anti_replay()
716 self.unconfig_network()
719 # To generate test classes, do:
720 # grep '# GEN' test_ipsec_esp.py | sed -e 's/# GEN //g' | bash
722 # GEN for ENG in ia32 ipsecmb openssl; do \
723 # GEN for FLG in noESN ESN; do for ALG in AES-GCM-128/NONE \
724 # GEN AES-GCM-192/NONE AES-GCM-256/NONE AES-CBC-128/MD5-96 \
725 # GEN AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96 \
726 # GEN 3DES-CBC/SHA1-96 NONE/SHA1-96; do \
727 # GEN [[ ${FLG} == "ESN" && ${ALG} == *"NONE" ]] && continue
728 # GEN echo -e "\n\nclass Test_${ENG}_${FLG}_${ALG}(RunTestIpsecEspAll):" |
729 # GEN sed -e 's/-/_/g' -e 's#/#_#g' ; \
730 # GEN echo ' """'$ENG $FLG $ALG IPSec test'"""' ;
731 # GEN echo " def test_ipsec(self):";
732 # GEN echo " self.run_test()";
733 # GEN done; done; done
736 class Test_ia32_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
737 """ia32 noESN AES-GCM-128/NONE IPSec test"""
738 def test_ipsec(self):
742 class Test_ia32_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
743 """ia32 noESN AES-GCM-192/NONE IPSec test"""
744 def test_ipsec(self):
748 class Test_ia32_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
749 """ia32 noESN AES-GCM-256/NONE IPSec test"""
750 def test_ipsec(self):
754 class Test_ia32_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
755 """ia32 noESN AES-CBC-128/MD5-96 IPSec test"""
756 def test_ipsec(self):
760 class Test_ia32_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
761 """ia32 noESN AES-CBC-192/SHA1-96 IPSec test"""
762 def test_ipsec(self):
766 class Test_ia32_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
767 """ia32 noESN AES-CBC-256/SHA1-96 IPSec test"""
768 def test_ipsec(self):
772 class Test_ia32_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
773 """ia32 noESN 3DES-CBC/SHA1-96 IPSec test"""
774 def test_ipsec(self):
778 class Test_ia32_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
779 """ia32 noESN NONE/SHA1-96 IPSec test"""
780 def test_ipsec(self):
784 class Test_ia32_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
785 """ia32 ESN AES-CBC-128/MD5-96 IPSec test"""
786 def test_ipsec(self):
790 class Test_ia32_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
791 """ia32 ESN AES-CBC-192/SHA1-96 IPSec test"""
792 def test_ipsec(self):
796 class Test_ia32_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
797 """ia32 ESN AES-CBC-256/SHA1-96 IPSec test"""
798 def test_ipsec(self):
802 class Test_ia32_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
803 """ia32 ESN 3DES-CBC/SHA1-96 IPSec test"""
804 def test_ipsec(self):
808 class Test_ia32_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
809 """ia32 ESN NONE/SHA1-96 IPSec test"""
810 def test_ipsec(self):
814 class Test_ipsecmb_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
815 """ipsecmb noESN AES-GCM-128/NONE IPSec test"""
816 def test_ipsec(self):
820 class Test_ipsecmb_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
821 """ipsecmb noESN AES-GCM-192/NONE IPSec test"""
822 def test_ipsec(self):
826 class Test_ipsecmb_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
827 """ipsecmb noESN AES-GCM-256/NONE IPSec test"""
828 def test_ipsec(self):
832 class Test_ipsecmb_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
833 """ipsecmb noESN AES-CBC-128/MD5-96 IPSec test"""
834 def test_ipsec(self):
838 class Test_ipsecmb_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
839 """ipsecmb noESN AES-CBC-192/SHA1-96 IPSec test"""
840 def test_ipsec(self):
844 class Test_ipsecmb_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
845 """ipsecmb noESN AES-CBC-256/SHA1-96 IPSec test"""
846 def test_ipsec(self):
850 class Test_ipsecmb_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
851 """ipsecmb noESN 3DES-CBC/SHA1-96 IPSec test"""
852 def test_ipsec(self):
856 class Test_ipsecmb_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
857 """ipsecmb noESN NONE/SHA1-96 IPSec test"""
858 def test_ipsec(self):
862 class Test_ipsecmb_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
863 """ipsecmb ESN AES-CBC-128/MD5-96 IPSec test"""
864 def test_ipsec(self):
868 class Test_ipsecmb_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
869 """ipsecmb ESN AES-CBC-192/SHA1-96 IPSec test"""
870 def test_ipsec(self):
874 class Test_ipsecmb_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
875 """ipsecmb ESN AES-CBC-256/SHA1-96 IPSec test"""
876 def test_ipsec(self):
880 class Test_ipsecmb_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
881 """ipsecmb ESN 3DES-CBC/SHA1-96 IPSec test"""
882 def test_ipsec(self):
886 class Test_ipsecmb_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
887 """ipsecmb ESN NONE/SHA1-96 IPSec test"""
888 def test_ipsec(self):
892 class Test_openssl_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
893 """openssl noESN AES-GCM-128/NONE IPSec test"""
894 def test_ipsec(self):
898 class Test_openssl_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
899 """openssl noESN AES-GCM-192/NONE IPSec test"""
900 def test_ipsec(self):
904 class Test_openssl_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
905 """openssl noESN AES-GCM-256/NONE IPSec test"""
906 def test_ipsec(self):
910 class Test_openssl_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
911 """openssl noESN AES-CBC-128/MD5-96 IPSec test"""
912 def test_ipsec(self):
916 class Test_openssl_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
917 """openssl noESN AES-CBC-192/SHA1-96 IPSec test"""
918 def test_ipsec(self):
922 class Test_openssl_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
923 """openssl noESN AES-CBC-256/SHA1-96 IPSec test"""
924 def test_ipsec(self):
928 class Test_openssl_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
929 """openssl noESN 3DES-CBC/SHA1-96 IPSec test"""
930 def test_ipsec(self):
934 class Test_openssl_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
935 """openssl noESN NONE/SHA1-96 IPSec test"""
936 def test_ipsec(self):
940 class Test_openssl_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
941 """openssl ESN AES-CBC-128/MD5-96 IPSec test"""
942 def test_ipsec(self):
946 class Test_openssl_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
947 """openssl ESN AES-CBC-192/SHA1-96 IPSec test"""
948 def test_ipsec(self):
952 class Test_openssl_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
953 """openssl ESN AES-CBC-256/SHA1-96 IPSec test"""
954 def test_ipsec(self):
958 class Test_openssl_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
959 """openssl ESN 3DES-CBC/SHA1-96 IPSec test"""
960 def test_ipsec(self):
964 class Test_openssl_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
965 """openssl ESN NONE/SHA1-96 IPSec test"""
966 def test_ipsec(self):
970 if __name__ == '__main__':
971 unittest.main(testRunner=VppTestRunner)