7 from hashlib import blake2s
8 from scapy.packet import Packet
9 from scapy.packet import Raw
10 from scapy.layers.l2 import Ether, ARP
11 from scapy.layers.inet import IP, UDP
12 from scapy.contrib.wireguard import Wireguard, WireguardResponse, \
13 WireguardInitiation, WireguardTransport
14 from cryptography.hazmat.primitives.asymmetric.x25519 import \
15 X25519PrivateKey, X25519PublicKey
16 from cryptography.hazmat.primitives.serialization import Encoding, \
17 PrivateFormat, PublicFormat, NoEncryption
18 from cryptography.hazmat.primitives.hashes import BLAKE2s, Hash
19 from cryptography.hazmat.primitives.hmac import HMAC
20 from cryptography.hazmat.backends import default_backend
21 from noise.connection import NoiseConnection, Keypair
23 from vpp_ipip_tun_interface import VppIpIpTunInterface
24 from vpp_interface import VppInterface
25 from vpp_ip_route import VppIpRoute, VppRoutePath
26 from vpp_object import VppObject
27 from framework import VppTestCase
28 from re import compile
31 """ TestWg is a subclass of VPPTestCase classes.
38 def private_key_bytes(k):
39 return k.private_bytes(Encoding.Raw,
44 def public_key_bytes(k):
45 return k.public_bytes(Encoding.Raw,
49 class VppWgInterface(VppInterface):
51 VPP WireGuard interface
54 def __init__(self, test, src, port):
55 super(VppWgInterface, self).__init__(test)
59 self.private_key = X25519PrivateKey.generate()
60 self.public_key = self.private_key.public_key()
62 def public_key_bytes(self):
63 return public_key_bytes(self.public_key)
65 def private_key_bytes(self):
66 return private_key_bytes(self.private_key)
68 def add_vpp_config(self):
69 r = self.test.vapi.wireguard_interface_create(interface={
70 'user_instance': 0xffffffff,
73 'private_key': private_key_bytes(self.private_key),
76 self.set_sw_if_index(r.sw_if_index)
77 self.test.registry.register(self, self.test.logger)
80 def remove_vpp_config(self):
81 self.test.vapi.wireguard_interface_delete(
82 sw_if_index=self._sw_if_index)
84 def query_vpp_config(self):
85 ts = self.test.vapi.wireguard_interface_dump(sw_if_index=0xffffffff)
87 if t.interface.sw_if_index == self._sw_if_index and \
88 str(t.interface.src_ip) == self.src and \
89 t.interface.port == self.port and \
90 t.interface.private_key == private_key_bytes(self.private_key):
95 return self.object_id()
98 return "wireguard-%d" % self._sw_if_index
101 def find_route(test, prefix, table_id=0):
102 routes = test.vapi.ip_route_dump(table_id, False)
105 if table_id == e.route.table_id \
106 and str(e.route.prefix) == str(prefix):
111 NOISE_HANDSHAKE_NAME = b"Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s"
112 NOISE_IDENTIFIER_NAME = b"WireGuard v1 zx2c4 Jason@zx2c4.com"
115 class VppWgPeer(VppObject):
123 persistent_keepalive=15):
126 self.endpoint = endpoint
128 self.allowed_ips = allowed_ips
129 self.persistent_keepalive = persistent_keepalive
131 # remote peer's public
132 self.private_key = X25519PrivateKey.generate()
133 self.public_key = self.private_key.public_key()
135 self.noise = NoiseConnection.from_name(NOISE_HANDSHAKE_NAME)
137 def add_vpp_config(self):
138 rv = self._test.vapi.wireguard_peer_add(
140 'public_key': self.public_key_bytes(),
142 'endpoint': self.endpoint,
143 'n_allowed_ips': len(self.allowed_ips),
144 'allowed_ips': self.allowed_ips,
145 'sw_if_index': self.itf.sw_if_index,
146 'persistent_keepalive': self.persistent_keepalive})
147 self.index = rv.peer_index
148 self.receiver_index = self.index + 1
149 self._test.registry.register(self, self._test.logger)
152 def remove_vpp_config(self):
153 self._test.vapi.wireguard_peer_remove(peer_index=self.index)
156 return ("wireguard-peer-%s" % self.index)
158 def public_key_bytes(self):
159 return public_key_bytes(self.public_key)
161 def query_vpp_config(self):
162 peers = self._test.vapi.wireguard_peers_dump()
165 if p.peer.public_key == self.public_key_bytes() and \
166 p.peer.port == self.port and \
167 str(p.peer.endpoint) == self.endpoint and \
168 p.peer.sw_if_index == self.itf.sw_if_index and \
169 len(self.allowed_ips) == p.peer.n_allowed_ips:
170 self.allowed_ips.sort()
171 p.peer.allowed_ips.sort()
173 for (a1, a2) in zip(self.allowed_ips, p.peer.allowed_ips):
174 if str(a1) != str(a2):
179 def set_responder(self):
180 self.noise.set_as_responder()
182 def mk_tunnel_header(self, tx_itf):
183 return (Ether(dst=tx_itf.local_mac, src=tx_itf.remote_mac) /
184 IP(src=self.endpoint, dst=self.itf.src) /
185 UDP(sport=self.port, dport=self.itf.port))
187 def noise_init(self, public_key=None):
188 self.noise.set_prologue(NOISE_IDENTIFIER_NAME)
189 self.noise.set_psks(psk=bytes(bytearray(32)))
192 public_key = self.itf.public_key
195 self.noise.set_keypair_from_private_bytes(
197 private_key_bytes(self.private_key))
199 self.noise.set_keypair_from_public_bytes(
200 Keypair.REMOTE_STATIC,
201 public_key_bytes(public_key))
203 self.noise.start_handshake()
205 def mk_handshake(self, tx_itf, public_key=None):
206 self.noise.set_as_initiator()
207 self.noise_init(public_key)
209 p = (Wireguard() / WireguardInitiation())
211 p[Wireguard].message_type = 1
212 p[Wireguard].reserved_zero = 0
213 p[WireguardInitiation].sender_index = self.receiver_index
215 # some random data for the message
216 # lifted from the noise protocol's wireguard example
217 now = datetime.datetime.now()
218 tai = struct.pack('!qi', 4611686018427387914 + int(now.timestamp()),
219 int(now.microsecond * 1e3))
220 b = self.noise.write_message(payload=tai)
222 # load noise into init message
223 p[WireguardInitiation].unencrypted_ephemeral = b[0:32]
224 p[WireguardInitiation].encrypted_static = b[32:80]
225 p[WireguardInitiation].encrypted_timestamp = b[80:108]
227 # generate the mac1 hash
228 mac_key = blake2s(b'mac1----' +
229 self.itf.public_key_bytes()).digest()
230 p[WireguardInitiation].mac1 = blake2s(bytes(p)[0:116],
232 key=mac_key).digest()
233 p[WireguardInitiation].mac2 = bytearray(16)
235 p = (self.mk_tunnel_header(tx_itf) / p)
239 def verify_header(self, p):
240 self._test.assertEqual(p[IP].src, self.itf.src)
241 self._test.assertEqual(p[IP].dst, self.endpoint)
242 self._test.assertEqual(p[UDP].sport, self.itf.port)
243 self._test.assertEqual(p[UDP].dport, self.port)
244 self._test.assert_packet_checksums_valid(p)
246 def consume_init(self, p, tx_itf):
247 self.noise.set_as_responder()
248 self.noise_init(self.itf.public_key)
249 self.verify_header(p)
251 init = Wireguard(p[Raw])
253 self._test.assertEqual(init[Wireguard].message_type, 1)
254 self._test.assertEqual(init[Wireguard].reserved_zero, 0)
256 self.sender = init[WireguardInitiation].sender_index
259 mac_key = blake2s(b'mac1----' +
260 public_key_bytes(self.public_key)).digest()
261 mac1 = blake2s(bytes(init)[0:-32],
263 key=mac_key).digest()
264 self._test.assertEqual(init[WireguardInitiation].mac1, mac1)
266 # this passes only unencrypted_ephemeral, encrypted_static,
267 # encrypted_timestamp fields of the init
268 payload = self.noise.read_message(bytes(init)[8:-32])
271 b = self.noise.write_message()
272 mac_key = blake2s(b'mac1----' +
273 public_key_bytes(self.itf.public_key)).digest()
274 resp = (Wireguard(message_type=2, reserved_zero=0) /
275 WireguardResponse(sender_index=self.receiver_index,
276 receiver_index=self.sender,
277 unencrypted_ephemeral=b[0:32],
278 encrypted_nothing=b[32:]))
279 mac1 = blake2s(bytes(resp)[:-32],
281 key=mac_key).digest()
282 resp[WireguardResponse].mac1 = mac1
284 resp = (self.mk_tunnel_header(tx_itf) / resp)
285 self._test.assertTrue(self.noise.handshake_finished)
289 def consume_response(self, p):
290 self.verify_header(p)
292 resp = Wireguard(p[Raw])
294 self._test.assertEqual(resp[Wireguard].message_type, 2)
295 self._test.assertEqual(resp[Wireguard].reserved_zero, 0)
296 self._test.assertEqual(resp[WireguardResponse].receiver_index,
299 self.sender = resp[Wireguard].sender_index
301 payload = self.noise.read_message(bytes(resp)[12:60])
302 self._test.assertEqual(payload, b'')
303 self._test.assertTrue(self.noise.handshake_finished)
305 def decrypt_transport(self, p):
306 self.verify_header(p)
308 p = Wireguard(p[Raw])
309 self._test.assertEqual(p[Wireguard].message_type, 4)
310 self._test.assertEqual(p[Wireguard].reserved_zero, 0)
311 self._test.assertEqual(p[WireguardTransport].receiver_index,
314 d = self.noise.decrypt(
315 p[WireguardTransport].encrypted_encapsulated_packet)
318 def encrypt_transport(self, p):
319 return self.noise.encrypt(bytes(p))
321 def validate_encapped(self, rxs, tx):
323 rx = IP(self.decrypt_transport(rx))
325 # chech the oringial packet is present
326 self._test.assertEqual(rx[IP].dst, tx[IP].dst)
327 self._test.assertEqual(rx[IP].ttl, tx[IP].ttl-1)
330 class TestWg(VppTestCase):
331 """ Wireguard Test Case """
333 error_str = compile(r"Error")
337 super(TestWg, cls).setUpClass()
339 cls.create_pg_interfaces(range(3))
340 for i in cls.pg_interfaces:
346 super(TestWg, cls).tearDownClass()
350 def tearDownClass(cls):
351 super(TestWg, cls).tearDownClass()
353 def test_wg_interface(self):
354 """ Simple interface creation """
358 wg0 = VppWgInterface(self,
360 port).add_vpp_config()
362 self.logger.info(self.vapi.cli("sh int"))
365 wg0.remove_vpp_config()
367 def test_handshake_hash(self):
368 """ test hashing an init message """
369 # a init packet generated by linux given the key below
370 h = "0100000098b9032b" \
390 b = bytearray.fromhex(h)
393 pubb = base64.b64decode("aRuHFTTxICIQNefp05oKWlJv3zgKxb8+WW7JJMh0jyM=")
394 pub = X25519PublicKey.from_public_bytes(pubb)
396 self.assertEqual(pubb, public_key_bytes(pub))
398 # strip the macs and build a new packet
400 mac_key = blake2s(b'mac1----' + public_key_bytes(pub)).digest()
401 init += blake2s(init,
403 key=mac_key).digest()
406 act = Wireguard(init)
408 self.assertEqual(tgt, act)
410 def test_wg_peer_resp(self):
411 """ Send handshake response """
412 wg_output_node_name = '/err/wg-output-tun/'
413 wg_input_node_name = '/err/wg-input/'
418 wg0 = VppWgInterface(self,
420 port).add_vpp_config()
424 self.pg_enable_capture(self.pg_interfaces)
427 peer_1 = VppWgPeer(self,
431 ["10.11.3.0/24"]).add_vpp_config()
432 self.assertEqual(len(self.vapi.wireguard_peers_dump()), 1)
434 r1 = VppIpRoute(self, "10.11.3.0", 24,
435 [VppRoutePath("10.11.3.1",
436 wg0.sw_if_index)]).add_vpp_config()
438 # wait for the peer to send a handshake
439 rx = self.pg1.get_capture(1, timeout=2)
441 # consume the handshake in the noise protocol and
442 # generate the response
443 resp = peer_1.consume_init(rx[0], self.pg1)
445 # send the response, get keepalive
446 rxs = self.send_and_expect(self.pg1, [resp], self.pg1)
449 b = peer_1.decrypt_transport(rx)
450 self.assertEqual(0, len(b))
452 # send a packets that are routed into the tunnel
453 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
454 IP(src=self.pg0.remote_ip4, dst="10.11.3.2") /
455 UDP(sport=555, dport=556) /
458 rxs = self.send_and_expect(self.pg0, p * 255, self.pg1)
460 peer_1.validate_encapped(rxs, p)
462 # send packets into the tunnel, expect to receive them on
464 p = [(peer_1.mk_tunnel_header(self.pg1) /
465 Wireguard(message_type=4, reserved_zero=0) /
467 receiver_index=peer_1.sender,
469 encrypted_encapsulated_packet=peer_1.encrypt_transport(
470 (IP(src="10.11.3.1", dst=self.pg0.remote_ip4, ttl=20) /
471 UDP(sport=222, dport=223) /
472 Raw())))) for ii in range(255)]
474 rxs = self.send_and_expect(self.pg1, p, self.pg0)
477 self.assertEqual(rx[IP].dst, self.pg0.remote_ip4)
478 self.assertEqual(rx[IP].ttl, 19)
480 r1.remove_vpp_config()
481 peer_1.remove_vpp_config()
482 wg0.remove_vpp_config()
484 def test_wg_peer_init(self):
485 """ Send handshake init """
486 wg_output_node_name = '/err/wg-output-tun/'
487 wg_input_node_name = '/err/wg-input/'
492 wg0 = VppWgInterface(self,
494 port).add_vpp_config()
498 peer_1 = VppWgPeer(self,
502 ["10.11.3.0/24"]).add_vpp_config()
503 self.assertEqual(len(self.vapi.wireguard_peers_dump()), 1)
505 r1 = VppIpRoute(self, "10.11.3.0", 24,
506 [VppRoutePath("10.11.3.1",
507 wg0.sw_if_index)]).add_vpp_config()
509 # route a packet into the wg interface
510 # use the allowed-ip prefix
511 # this is dropped because the peer is not initiated
512 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
513 IP(src=self.pg0.remote_ip4, dst="10.11.3.2") /
514 UDP(sport=555, dport=556) /
516 self.send_and_assert_no_replies(self.pg0, [p])
518 kp_error = wg_output_node_name + "Keypair error"
519 self.assertEqual(1, self.statistics.get_err_counter(kp_error))
521 # send a handsake from the peer with an invalid MAC
522 p = peer_1.mk_handshake(self.pg1)
523 p[WireguardInitiation].mac1 = b'foobar'
524 self.send_and_assert_no_replies(self.pg1, [p])
525 self.assertEqual(1, self.statistics.get_err_counter(
526 wg_input_node_name + "Invalid MAC handshake"))
528 # send a handsake from the peer but signed by the wrong key.
529 p = peer_1.mk_handshake(self.pg1,
530 X25519PrivateKey.generate().public_key())
531 self.send_and_assert_no_replies(self.pg1, [p])
532 self.assertEqual(1, self.statistics.get_err_counter(
533 wg_input_node_name + "Peer error"))
535 # send a valid handsake init for which we expect a response
536 p = peer_1.mk_handshake(self.pg1)
538 rx = self.send_and_expect(self.pg1, [p], self.pg1)
540 peer_1.consume_response(rx[0])
542 # route a packet into the wg interface
543 # this is dropped because the peer is still not initiated
544 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
545 IP(src=self.pg0.remote_ip4, dst="10.11.3.2") /
546 UDP(sport=555, dport=556) /
548 self.send_and_assert_no_replies(self.pg0, [p])
549 self.assertEqual(2, self.statistics.get_err_counter(kp_error))
551 # send a data packet from the peer through the tunnel
552 # this completes the handshake
553 p = (IP(src="10.11.3.1", dst=self.pg0.remote_ip4, ttl=20) /
554 UDP(sport=222, dport=223) /
556 d = peer_1.encrypt_transport(p)
557 p = (peer_1.mk_tunnel_header(self.pg1) /
558 (Wireguard(message_type=4, reserved_zero=0) /
559 WireguardTransport(receiver_index=peer_1.sender,
561 encrypted_encapsulated_packet=d)))
562 rxs = self.send_and_expect(self.pg1, [p], self.pg0)
565 self.assertEqual(rx[IP].dst, self.pg0.remote_ip4)
566 self.assertEqual(rx[IP].ttl, 19)
568 # send a packets that are routed into the tunnel
569 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
570 IP(src=self.pg0.remote_ip4, dst="10.11.3.2") /
571 UDP(sport=555, dport=556) /
574 rxs = self.send_and_expect(self.pg0, p * 255, self.pg1)
577 rx = IP(peer_1.decrypt_transport(rx))
579 # chech the oringial packet is present
580 self.assertEqual(rx[IP].dst, p[IP].dst)
581 self.assertEqual(rx[IP].ttl, p[IP].ttl-1)
583 # send packets into the tunnel, expect to receive them on
585 p = [(peer_1.mk_tunnel_header(self.pg1) /
586 Wireguard(message_type=4, reserved_zero=0) /
588 receiver_index=peer_1.sender,
590 encrypted_encapsulated_packet=peer_1.encrypt_transport(
591 (IP(src="10.11.3.1", dst=self.pg0.remote_ip4, ttl=20) /
592 UDP(sport=222, dport=223) /
593 Raw())))) for ii in range(255)]
595 rxs = self.send_and_expect(self.pg1, p, self.pg0)
598 self.assertEqual(rx[IP].dst, self.pg0.remote_ip4)
599 self.assertEqual(rx[IP].ttl, 19)
601 r1.remove_vpp_config()
602 peer_1.remove_vpp_config()
603 wg0.remove_vpp_config()
605 def test_wg_multi_peer(self):
606 """ multiple peer setup """
610 wg0 = VppWgInterface(self,
612 port).add_vpp_config()
613 wg1 = VppWgInterface(self,
615 port+1).add_vpp_config()
620 self.assertEqual(len(self.vapi.wireguard_peers_dump()), 0)
622 self.pg_enable_capture(self.pg_interfaces)
625 # Create many peers on sencond interface
627 self.pg2.generate_remote_hosts(NUM_PEERS)
628 self.pg2.configure_ipv4_neighbors()
629 self.pg1.generate_remote_hosts(NUM_PEERS)
630 self.pg1.configure_ipv4_neighbors()
636 for i in range(NUM_PEERS):
637 peers_1.append(VppWgPeer(self,
639 self.pg1.remote_hosts[i].ip4,
641 ["10.0.%d.4/32" % i]).add_vpp_config())
642 routes_1.append(VppIpRoute(self, "10.0.%d.4" % i, 32,
643 [VppRoutePath(self.pg1.remote_hosts[i].ip4,
644 wg0.sw_if_index)]).add_vpp_config())
646 peers_2.append(VppWgPeer(self,
648 self.pg2.remote_hosts[i].ip4,
650 ["10.100.%d.4/32" % i]).add_vpp_config())
651 routes_2.append(VppIpRoute(self, "10.100.%d.4" % i, 32,
652 [VppRoutePath(self.pg2.remote_hosts[i].ip4,
653 wg1.sw_if_index)]).add_vpp_config())
655 self.assertEqual(len(self.vapi.wireguard_peers_dump()), NUM_PEERS*2)
657 self.logger.info(self.vapi.cli("show wireguard peer"))
658 self.logger.info(self.vapi.cli("show wireguard interface"))
659 self.logger.info(self.vapi.cli("show adj 37"))
660 self.logger.info(self.vapi.cli("sh ip fib 172.16.3.17"))
661 self.logger.info(self.vapi.cli("sh ip fib 10.11.3.0"))
665 r.remove_vpp_config()
667 r.remove_vpp_config()
671 self.assertTrue(p.query_vpp_config())
672 p.remove_vpp_config()
674 self.assertTrue(p.query_vpp_config())
675 p.remove_vpp_config()
677 wg0.remove_vpp_config()
678 wg1.remove_vpp_config()
680 def test_wg_multi_interface(self):
681 """ Multi-tunnel on the same port """
684 # Create many wireguard interfaces
686 self.pg1.generate_remote_hosts(NUM_IFS)
687 self.pg1.configure_ipv4_neighbors()
688 self.pg0.generate_remote_hosts(NUM_IFS)
689 self.pg0.configure_ipv4_neighbors()
691 # Create interfaces with a peer on each
695 for i in range(NUM_IFS):
696 # Use the same port for each interface
697 wg0 = VppWgInterface(self,
699 port).add_vpp_config()
703 peers.append(VppWgPeer(self,
705 self.pg1.remote_hosts[i].ip4,
707 ["10.0.%d.0/24" % i]).add_vpp_config())
709 routes.append(VppIpRoute(self, "10.0.%d.0" % i, 24,
710 [VppRoutePath("10.0.%d.4" % i,
711 wg0.sw_if_index)]).add_vpp_config())
713 self.assertEqual(len(self.vapi.wireguard_peers_dump()), NUM_IFS)
715 for i in range(NUM_IFS):
716 # send a valid handsake init for which we expect a response
717 p = peers[i].mk_handshake(self.pg1)
718 rx = self.send_and_expect(self.pg1, [p], self.pg1)
719 peers[i].consume_response(rx[0])
721 # send a data packet from the peer through the tunnel
722 # this completes the handshake
723 p = (IP(src="10.0.%d.4" % i,
724 dst=self.pg0.remote_hosts[i].ip4, ttl=20) /
725 UDP(sport=222, dport=223) /
727 d = peers[i].encrypt_transport(p)
728 p = (peers[i].mk_tunnel_header(self.pg1) /
729 (Wireguard(message_type=4, reserved_zero=0) /
730 WireguardTransport(receiver_index=peers[i].sender,
732 encrypted_encapsulated_packet=d)))
733 rxs = self.send_and_expect(self.pg1, [p], self.pg0)
735 self.assertEqual(rx[IP].dst, self.pg0.remote_hosts[i].ip4)
736 self.assertEqual(rx[IP].ttl, 19)
738 # send a packets that are routed into the tunnel
739 for i in range(NUM_IFS):
740 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
741 IP(src=self.pg0.remote_hosts[i].ip4, dst="10.0.%d.4" % i) /
742 UDP(sport=555, dport=556) /
745 rxs = self.send_and_expect(self.pg0, p * 64, self.pg1)
748 rx = IP(peers[i].decrypt_transport(rx))
750 # check the oringial packet is present
751 self.assertEqual(rx[IP].dst, p[IP].dst)
752 self.assertEqual(rx[IP].ttl, p[IP].ttl-1)
754 # send packets into the tunnel
755 for i in range(NUM_IFS):
756 p = [(peers[i].mk_tunnel_header(self.pg1) /
757 Wireguard(message_type=4, reserved_zero=0) /
759 receiver_index=peers[i].sender,
761 encrypted_encapsulated_packet=peers[i].encrypt_transport(
762 (IP(src="10.0.%d.4" % i,
763 dst=self.pg0.remote_hosts[i].ip4, ttl=20) /
764 UDP(sport=222, dport=223) /
765 Raw())))) for ii in range(64)]
767 rxs = self.send_and_expect(self.pg1, p, self.pg0)
770 self.assertEqual(rx[IP].dst, self.pg0.remote_hosts[i].ip4)
771 self.assertEqual(rx[IP].ttl, 19)
774 r.remove_vpp_config()
776 p.remove_vpp_config()
778 i.remove_vpp_config()
781 class WireguardHandoffTests(TestWg):
782 """ Wireguard Tests in multi worker setup """
785 def test_wg_peer_init(self):
787 wg_output_node_name = '/err/wg-output-tun/'
788 wg_input_node_name = '/err/wg-input/'
793 wg0 = VppWgInterface(self,
795 port).add_vpp_config()
799 peer_1 = VppWgPeer(self,
804 "10.11.3.0/24"]).add_vpp_config()
805 self.assertEqual(len(self.vapi.wireguard_peers_dump()), 1)
807 r1 = VppIpRoute(self, "10.11.3.0", 24,
808 [VppRoutePath("10.11.3.1",
809 wg0.sw_if_index)]).add_vpp_config()
811 # send a valid handsake init for which we expect a response
812 p = peer_1.mk_handshake(self.pg1)
814 rx = self.send_and_expect(self.pg1, [p], self.pg1)
816 peer_1.consume_response(rx[0])
818 # send a data packet from the peer through the tunnel
819 # this completes the handshake and pins the peer to worker 0
820 p = (IP(src="10.11.3.1", dst=self.pg0.remote_ip4, ttl=20) /
821 UDP(sport=222, dport=223) /
823 d = peer_1.encrypt_transport(p)
824 p = (peer_1.mk_tunnel_header(self.pg1) /
825 (Wireguard(message_type=4, reserved_zero=0) /
826 WireguardTransport(receiver_index=peer_1.sender,
828 encrypted_encapsulated_packet=d)))
829 rxs = self.send_and_expect(self.pg1, [p], self.pg0,
833 self.assertEqual(rx[IP].dst, self.pg0.remote_ip4)
834 self.assertEqual(rx[IP].ttl, 19)
836 # send a packets that are routed into the tunnel
837 # and pins the peer tp worker 1
838 pe = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
839 IP(src=self.pg0.remote_ip4, dst="10.11.3.2") /
840 UDP(sport=555, dport=556) /
842 rxs = self.send_and_expect(self.pg0, pe * 255, self.pg1, worker=1)
843 peer_1.validate_encapped(rxs, pe)
845 # send packets into the tunnel, from the other worker
846 p = [(peer_1.mk_tunnel_header(self.pg1) /
847 Wireguard(message_type=4, reserved_zero=0) /
849 receiver_index=peer_1.sender,
851 encrypted_encapsulated_packet=peer_1.encrypt_transport(
852 (IP(src="10.11.3.1", dst=self.pg0.remote_ip4, ttl=20) /
853 UDP(sport=222, dport=223) /
854 Raw())))) for ii in range(255)]
856 rxs = self.send_and_expect(self.pg1, p, self.pg0, worker=1)
859 self.assertEqual(rx[IP].dst, self.pg0.remote_ip4)
860 self.assertEqual(rx[IP].ttl, 19)
862 # send a packets that are routed into the tunnel
864 rxs = self.send_and_expect(self.pg0, pe * 255, self.pg1, worker=0)
866 peer_1.validate_encapped(rxs, pe)
868 r1.remove_vpp_config()
869 peer_1.remove_vpp_config()
870 wg0.remove_vpp_config()
872 @unittest.skip("test disabled")
873 def test_wg_multi_interface(self):
874 """ Multi-tunnel on the same port """