3 from scapy.layers.ipsec import ESP
5 from framework import VppTestRunner
6 from template_ipsec import IpsecTraTests, IpsecTunTests
7 from template_ipsec import TemplateIpsec, IpsecTcpTests
8 from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSA,\
10 from vpp_ip_route import VppIpRoute, VppRoutePath
11 from vpp_ip import DpoProto
12 from vpp_papi import VppEnum
15 class TemplateIpsecEsp(TemplateIpsec):
17 Basic test for ipsec esp sanity - tunnel and transport modes.
19 Below 4 cases are covered as part of this test
20 1) ipsec esp v4 transport basic test - IPv4 Transport mode
21 scenario using HMAC-SHA1-96 intergrity algo
22 2) ipsec esp v4 transport burst test
23 Above test for 257 pkts
24 3) ipsec esp 4o4 tunnel basic test - IPv4 Tunnel mode
25 scenario using HMAC-SHA1-96 intergrity algo
26 4) ipsec esp 4o4 tunnel burst test
27 Above test for 257 pkts
37 --- encrypt --- plain ---
38 |pg0| <------- |VPP| <------ |pg1|
41 --- decrypt --- plain ---
42 |pg0| -------> |VPP| ------> |pg1|
47 super(TemplateIpsecEsp, self).setUp()
48 self.encryption_type = ESP
49 self.tun_if = self.pg0
50 self.tra_if = self.pg2
51 self.logger.info(self.vapi.ppcli("show int addr"))
53 self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
54 self.tra_spd.add_vpp_config()
55 VppIpsecSpdItfBinding(self, self.tra_spd,
56 self.tra_if).add_vpp_config()
58 for _, p in self.params.items():
59 self.config_esp_tra(p)
60 self.configure_sa_tra(p)
61 self.logger.info(self.vapi.ppcli("show ipsec"))
63 self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
64 self.tun_spd.add_vpp_config()
65 VppIpsecSpdItfBinding(self, self.tun_spd,
66 self.tun_if).add_vpp_config()
68 for _, p in self.params.items():
69 self.config_esp_tun(p)
70 self.logger.info(self.vapi.ppcli("show ipsec"))
72 for _, p in self.params.items():
73 d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4
74 VppIpRoute(self, p.remote_tun_if_host, p.addr_len,
75 [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
78 is_ip6=p.is_ipv6).add_vpp_config()
81 super(TemplateIpsecEsp, self).tearDown()
83 self.vapi.cli("show hardware")
85 def config_esp_tun(self, params):
86 addr_type = params.addr_type
87 scapy_tun_sa_id = params.scapy_tun_sa_id
88 scapy_tun_spi = params.scapy_tun_spi
89 vpp_tun_sa_id = params.vpp_tun_sa_id
90 vpp_tun_spi = params.vpp_tun_spi
91 auth_algo_vpp_id = params.auth_algo_vpp_id
92 auth_key = params.auth_key
93 crypt_algo_vpp_id = params.crypt_algo_vpp_id
94 crypt_key = params.crypt_key
95 remote_tun_if_host = params.remote_tun_if_host
96 addr_any = params.addr_any
97 addr_bcast = params.addr_bcast
98 e = VppEnum.vl_api_ipsec_spd_action_t
100 params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi,
101 auth_algo_vpp_id, auth_key,
102 crypt_algo_vpp_id, crypt_key,
103 self.vpp_esp_protocol,
104 self.tun_if.local_addr[addr_type],
105 self.tun_if.remote_addr[addr_type])
106 params.tun_sa_in.add_vpp_config()
107 params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi,
108 auth_algo_vpp_id, auth_key,
109 crypt_algo_vpp_id, crypt_key,
110 self.vpp_esp_protocol,
111 self.tun_if.remote_addr[addr_type],
112 self.tun_if.local_addr[addr_type])
113 params.tun_sa_out.add_vpp_config()
115 params.spd_policy_in_any = VppIpsecSpdEntry(self, self.tun_spd,
117 addr_any, addr_bcast,
118 addr_any, addr_bcast,
120 params.spd_policy_in_any.add_vpp_config()
121 params.spd_policy_out_any = VppIpsecSpdEntry(self, self.tun_spd,
123 addr_any, addr_bcast,
124 addr_any, addr_bcast,
127 params.spd_policy_out_any.add_vpp_config()
129 VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
130 remote_tun_if_host, remote_tun_if_host,
131 self.pg1.remote_addr[addr_type],
132 self.pg1.remote_addr[addr_type],
135 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
136 is_outbound=0).add_vpp_config()
137 VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
138 self.pg1.remote_addr[addr_type],
139 self.pg1.remote_addr[addr_type],
140 remote_tun_if_host, remote_tun_if_host,
142 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
143 priority=10).add_vpp_config()
145 VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
146 remote_tun_if_host, remote_tun_if_host,
147 self.pg0.local_addr[addr_type],
148 self.pg0.local_addr[addr_type],
151 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
152 is_outbound=0).add_vpp_config()
153 VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
154 self.pg0.local_addr[addr_type],
155 self.pg0.local_addr[addr_type],
156 remote_tun_if_host, remote_tun_if_host,
158 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
159 priority=20).add_vpp_config()
161 def config_esp_tra(self, params):
162 addr_type = params.addr_type
163 scapy_tra_sa_id = params.scapy_tra_sa_id
164 scapy_tra_spi = params.scapy_tra_spi
165 vpp_tra_sa_id = params.vpp_tra_sa_id
166 vpp_tra_spi = params.vpp_tra_spi
167 auth_algo_vpp_id = params.auth_algo_vpp_id
168 auth_key = params.auth_key
169 crypt_algo_vpp_id = params.crypt_algo_vpp_id
170 crypt_key = params.crypt_key
171 addr_any = params.addr_any
172 addr_bcast = params.addr_bcast
173 flags = (VppEnum.vl_api_ipsec_sad_flags_t.
174 IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
175 e = VppEnum.vl_api_ipsec_spd_action_t
177 params.tra_sa_in = VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi,
178 auth_algo_vpp_id, auth_key,
179 crypt_algo_vpp_id, crypt_key,
180 self.vpp_esp_protocol,
182 params.tra_sa_in.add_vpp_config()
183 params.tra_sa_out = VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi,
184 auth_algo_vpp_id, auth_key,
185 crypt_algo_vpp_id, crypt_key,
186 self.vpp_esp_protocol,
188 params.tra_sa_out.add_vpp_config()
190 VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
191 addr_any, addr_bcast,
192 addr_any, addr_bcast,
193 socket.IPPROTO_ESP).add_vpp_config()
194 VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
195 addr_any, addr_bcast,
196 addr_any, addr_bcast,
198 is_outbound=0).add_vpp_config()
200 VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
201 self.tra_if.local_addr[addr_type],
202 self.tra_if.local_addr[addr_type],
203 self.tra_if.remote_addr[addr_type],
204 self.tra_if.remote_addr[addr_type],
206 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
207 is_outbound=0).add_vpp_config()
208 VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
209 self.tra_if.local_addr[addr_type],
210 self.tra_if.local_addr[addr_type],
211 self.tra_if.remote_addr[addr_type],
212 self.tra_if.remote_addr[addr_type],
213 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
214 priority=10).add_vpp_config()
217 class TestIpsecEsp1(TemplateIpsecEsp, IpsecTraTests, IpsecTunTests):
218 """ Ipsec ESP - TUN & TRA tests """
219 tra4_encrypt_node_name = "esp4-encrypt"
220 tra4_decrypt_node_name = "esp4-decrypt"
221 tra6_encrypt_node_name = "esp6-encrypt"
222 tra6_decrypt_node_name = "esp6-decrypt"
223 tun4_encrypt_node_name = "esp4-encrypt"
224 tun4_decrypt_node_name = "esp4-decrypt"
225 tun6_encrypt_node_name = "esp6-encrypt"
226 tun6_decrypt_node_name = "esp6-decrypt"
229 class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
230 """ Ipsec ESP - TCP tests """
234 if __name__ == '__main__':
235 unittest.main(testRunner=VppTestRunner)