3 from scapy.layers.ipsec import ESP
4 from scapy.layers.inet import UDP
6 from framework import VppTestRunner
7 from template_ipsec import IpsecTra46Tests, IpsecTun46Tests, TemplateIpsec, \
8 IpsecTcpTests, IpsecTun4Tests, IpsecTra4Tests, config_tra_params, \
9 IPsecIPv4Params, IPsecIPv6Params, \
10 IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6
11 from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSA,\
13 from vpp_ip_route import VppIpRoute, VppRoutePath
14 from vpp_ip import DpoProto
15 from vpp_papi import VppEnum
18 class ConfigIpsecESP(TemplateIpsec):
20 tra4_encrypt_node_name = "esp4-encrypt"
21 tra4_decrypt_node_name = "esp4-decrypt"
22 tra6_encrypt_node_name = "esp6-encrypt"
23 tra6_decrypt_node_name = "esp6-decrypt"
24 tun4_encrypt_node_name = "esp4-encrypt"
25 tun4_decrypt_node_name = "esp4-decrypt"
26 tun6_encrypt_node_name = "esp6-encrypt"
27 tun6_decrypt_node_name = "esp6-decrypt"
31 super(ConfigIpsecESP, cls).setUpClass()
34 def tearDownClass(cls):
35 super(ConfigIpsecESP, cls).tearDownClass()
38 super(ConfigIpsecESP, self).setUp()
41 super(ConfigIpsecESP, self).tearDown()
43 def config_network(self, params):
45 self.tun_if = self.pg0
46 self.tra_if = self.pg2
47 self.logger.info(self.vapi.ppcli("show int addr"))
49 self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
50 self.tra_spd.add_vpp_config()
51 self.net_objs.append(self.tra_spd)
52 self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
53 self.tun_spd.add_vpp_config()
54 self.net_objs.append(self.tun_spd)
56 b = VppIpsecSpdItfBinding(self, self.tun_spd,
59 self.net_objs.append(b)
61 b = VppIpsecSpdItfBinding(self, self.tra_spd,
64 self.net_objs.append(b)
67 self.config_esp_tra(p)
68 config_tra_params(p, self.encryption_type)
70 self.config_esp_tun(p)
73 d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4
74 r = VppIpRoute(self, p.remote_tun_if_host, p.addr_len,
75 [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
80 self.net_objs.append(r)
82 self.logger.info(self.vapi.ppcli("show ipsec all"))
84 def unconfig_network(self):
85 for o in reversed(self.net_objs):
89 def config_esp_tun(self, params):
90 addr_type = params.addr_type
91 scapy_tun_sa_id = params.scapy_tun_sa_id
92 scapy_tun_spi = params.scapy_tun_spi
93 vpp_tun_sa_id = params.vpp_tun_sa_id
94 vpp_tun_spi = params.vpp_tun_spi
95 auth_algo_vpp_id = params.auth_algo_vpp_id
96 auth_key = params.auth_key
97 crypt_algo_vpp_id = params.crypt_algo_vpp_id
98 crypt_key = params.crypt_key
99 remote_tun_if_host = params.remote_tun_if_host
100 addr_any = params.addr_any
101 addr_bcast = params.addr_bcast
102 e = VppEnum.vl_api_ipsec_spd_action_t
107 params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi,
108 auth_algo_vpp_id, auth_key,
109 crypt_algo_vpp_id, crypt_key,
110 self.vpp_esp_protocol,
111 self.tun_if.local_addr[addr_type],
112 self.tun_if.remote_addr[addr_type],
115 params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi,
116 auth_algo_vpp_id, auth_key,
117 crypt_algo_vpp_id, crypt_key,
118 self.vpp_esp_protocol,
119 self.tun_if.remote_addr[addr_type],
120 self.tun_if.local_addr[addr_type],
123 objs.append(params.tun_sa_in)
124 objs.append(params.tun_sa_out)
126 params.spd_policy_in_any = VppIpsecSpdEntry(self, self.tun_spd,
128 addr_any, addr_bcast,
129 addr_any, addr_bcast,
131 params.spd_policy_out_any = VppIpsecSpdEntry(self, self.tun_spd,
133 addr_any, addr_bcast,
134 addr_any, addr_bcast,
137 objs.append(params.spd_policy_out_any)
138 objs.append(params.spd_policy_in_any)
140 objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
141 remote_tun_if_host, remote_tun_if_host,
142 self.pg1.remote_addr[addr_type],
143 self.pg1.remote_addr[addr_type],
146 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
148 objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
149 self.pg1.remote_addr[addr_type],
150 self.pg1.remote_addr[addr_type],
151 remote_tun_if_host, remote_tun_if_host,
153 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
155 objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
156 remote_tun_if_host, remote_tun_if_host,
157 self.pg0.local_addr[addr_type],
158 self.pg0.local_addr[addr_type],
161 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
163 objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
164 self.pg0.local_addr[addr_type],
165 self.pg0.local_addr[addr_type],
166 remote_tun_if_host, remote_tun_if_host,
168 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
172 self.net_objs = self.net_objs + objs
174 def config_esp_tra(self, params):
175 addr_type = params.addr_type
176 scapy_tra_sa_id = params.scapy_tra_sa_id
177 scapy_tra_spi = params.scapy_tra_spi
178 vpp_tra_sa_id = params.vpp_tra_sa_id
179 vpp_tra_spi = params.vpp_tra_spi
180 auth_algo_vpp_id = params.auth_algo_vpp_id
181 auth_key = params.auth_key
182 crypt_algo_vpp_id = params.crypt_algo_vpp_id
183 crypt_key = params.crypt_key
184 addr_any = params.addr_any
185 addr_bcast = params.addr_bcast
186 flags = (VppEnum.vl_api_ipsec_sad_flags_t.
187 IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
188 e = VppEnum.vl_api_ipsec_spd_action_t
189 flags = params.flags | flags
193 params.tra_sa_in = VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi,
194 auth_algo_vpp_id, auth_key,
195 crypt_algo_vpp_id, crypt_key,
196 self.vpp_esp_protocol,
199 params.tra_sa_out = VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi,
200 auth_algo_vpp_id, auth_key,
201 crypt_algo_vpp_id, crypt_key,
202 self.vpp_esp_protocol,
205 objs.append(params.tra_sa_in)
206 objs.append(params.tra_sa_out)
208 objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
209 addr_any, addr_bcast,
210 addr_any, addr_bcast,
212 objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
213 addr_any, addr_bcast,
214 addr_any, addr_bcast,
217 objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
218 self.tra_if.local_addr[addr_type],
219 self.tra_if.local_addr[addr_type],
220 self.tra_if.remote_addr[addr_type],
221 self.tra_if.remote_addr[addr_type],
223 policy=e.IPSEC_API_SPD_ACTION_PROTECT,
225 objs.append(VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
226 self.tra_if.local_addr[addr_type],
227 self.tra_if.local_addr[addr_type],
228 self.tra_if.remote_addr[addr_type],
229 self.tra_if.remote_addr[addr_type],
230 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
234 self.net_objs = self.net_objs + objs
237 class TemplateIpsecEsp(ConfigIpsecESP):
239 Basic test for ipsec esp sanity - tunnel and transport modes.
241 Below 4 cases are covered as part of this test
242 1) ipsec esp v4 transport basic test - IPv4 Transport mode
243 scenario using HMAC-SHA1-96 integrity algo
244 2) ipsec esp v4 transport burst test
245 Above test for 257 pkts
246 3) ipsec esp 4o4 tunnel basic test - IPv4 Tunnel mode
247 scenario using HMAC-SHA1-96 integrity algo
248 4) ipsec esp 4o4 tunnel burst test
249 Above test for 257 pkts
254 |pg2| <-------> |VPP|
259 --- encrypt --- plain ---
260 |pg0| <------- |VPP| <------ |pg1|
263 --- decrypt --- plain ---
264 |pg0| -------> |VPP| ------> |pg1|
270 super(TemplateIpsecEsp, cls).setUpClass()
273 def tearDownClass(cls):
274 super(TemplateIpsecEsp, cls).tearDownClass()
277 super(TemplateIpsecEsp, self).setUp()
278 self.config_network(self.params.values())
281 self.unconfig_network()
282 super(TemplateIpsecEsp, self).tearDown()
285 class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests, IpsecTun46Tests):
286 """ Ipsec ESP - TUN & TRA tests """
290 class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
291 """ Ipsec ESP - TCP tests """
295 class TemplateIpsecEspUdp(ConfigIpsecESP):
302 super(TemplateIpsecEspUdp, cls).setUpClass()
305 def tearDownClass(cls):
306 super(TemplateIpsecEspUdp, cls).tearDownClass()
309 super(TemplateIpsecEspUdp, self).setUp()
311 self.tun_if = self.pg0
312 self.tra_if = self.pg2
313 self.logger.info(self.vapi.ppcli("show int addr"))
316 p.flags = (VppEnum.vl_api_ipsec_sad_flags_t.
317 IPSEC_API_SAD_FLAG_UDP_ENCAP)
318 p.nat_header = UDP(sport=5454, dport=4500)
320 self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
321 self.tra_spd.add_vpp_config()
322 VppIpsecSpdItfBinding(self, self.tra_spd,
323 self.tra_if).add_vpp_config()
325 self.config_esp_tra(p)
326 config_tra_params(p, self.encryption_type)
328 self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
329 self.tun_spd.add_vpp_config()
330 VppIpsecSpdItfBinding(self, self.tun_spd,
331 self.tun_if).add_vpp_config()
333 self.config_esp_tun(p)
334 self.logger.info(self.vapi.ppcli("show ipsec all"))
336 d = DpoProto.DPO_PROTO_IP4
337 VppIpRoute(self, p.remote_tun_if_host, p.addr_len,
338 [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
340 proto=d)]).add_vpp_config()
343 super(TemplateIpsecEspUdp, self).tearDown()
345 def show_commands_at_teardown(self):
346 self.logger.info(self.vapi.cli("show hardware"))
349 class TestIpsecEspUdp(TemplateIpsecEspUdp, IpsecTra4Tests):
350 """ Ipsec NAT-T ESP UDP tests """
354 class TestIpsecEspAll(ConfigIpsecESP,
355 IpsecTra4, IpsecTra6,
356 IpsecTun4, IpsecTun6):
357 """ Ipsec ESP all Algos """
360 super(TestIpsecEspAll, self).setUp()
363 super(TestIpsecEspAll, self).tearDown()
365 def test_crypto_algs(self):
366 """All engines AES-[CBC, GCM]-[128, 192, 256] w/ & w/o ESN"""
368 # foreach VPP crypto engine
369 engines = ["ia32", "ipsecmb", "openssl"]
371 # foreach crypto algorithm
372 algos = [{'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
373 IPSEC_API_CRYPTO_ALG_AES_GCM_128),
374 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
375 IPSEC_API_INTEG_ALG_NONE),
376 'scapy-crypto': "AES-GCM",
377 'scapy-integ': "NULL",
378 'key': "JPjyOWBeVEQiMe7h",
380 {'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
381 IPSEC_API_CRYPTO_ALG_AES_GCM_192),
382 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
383 IPSEC_API_INTEG_ALG_NONE),
384 'scapy-crypto': "AES-GCM",
385 'scapy-integ': "NULL",
386 'key': "JPjyOWBeVEQiMe7h01234567",
388 {'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
389 IPSEC_API_CRYPTO_ALG_AES_GCM_256),
390 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
391 IPSEC_API_INTEG_ALG_NONE),
392 'scapy-crypto': "AES-GCM",
393 'scapy-integ': "NULL",
394 'key': "JPjyOWBeVEQiMe7h0123456787654321",
396 {'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
397 IPSEC_API_CRYPTO_ALG_AES_CBC_128),
398 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
399 IPSEC_API_INTEG_ALG_SHA1_96),
400 'scapy-crypto': "AES-CBC",
401 'scapy-integ': "HMAC-SHA1-96",
403 'key': "JPjyOWBeVEQiMe7h"},
404 {'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
405 IPSEC_API_CRYPTO_ALG_AES_CBC_192),
406 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
407 IPSEC_API_INTEG_ALG_SHA1_96),
408 'scapy-crypto': "AES-CBC",
409 'scapy-integ': "HMAC-SHA1-96",
411 'key': "JPjyOWBeVEQiMe7hJPjyOWBe"},
412 {'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
413 IPSEC_API_CRYPTO_ALG_AES_CBC_256),
414 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
415 IPSEC_API_INTEG_ALG_SHA1_96),
416 'scapy-crypto': "AES-CBC",
417 'scapy-integ': "HMAC-SHA1-96",
419 'key': "JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"}]
421 # with and without ESN
423 VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN]
426 # loop through the VPP engines
428 for engine in engines:
429 self.vapi.cli("set crypto handler all %s" % engine)
431 # loop through each of the algorithms
434 # with self.subTest(algo=algo['scapy']):
437 # setup up the config paramters
439 self.ipv4_params = IPsecIPv4Params()
440 self.ipv6_params = IPsecIPv6Params()
442 self.params = {self.ipv4_params.addr_type:
444 self.ipv6_params.addr_type:
447 for _, p in self.params.items():
448 p.auth_algo_vpp_id = algo['vpp-integ']
449 p.crypt_algo_vpp_id = algo['vpp-crypto']
450 p.crypt_algo = algo['scapy-crypto']
451 p.auth_algo = algo['scapy-integ']
452 p.crypt_key = algo['key']
453 p.salt = algo['salt']
454 p.flags = p.flags | flag
457 # configure the SPDs. SAs, etc
459 self.config_network(self.params.values())
463 # An exhautsive 4o6, 6o4 is not necessary
466 self.verify_tra_basic6(count=17)
467 self.verify_tra_basic4(count=17)
468 self.verify_tun_66(self.params[socket.AF_INET6], 17)
469 self.verify_tun_44(self.params[socket.AF_INET], 17)
472 # remove the SPDs, SAs, etc
474 self.unconfig_network()
477 if __name__ == '__main__':
478 unittest.main(testRunner=VppTestRunner)