1 from vpp_object import VppObject
2 from ipaddress import ip_address
3 from vpp_papi import VppEnum
12 return {'packets': 0, 'bytes': 0}
15 class VppIpsecSpd(VppObject):
20 def __init__(self, test, id):
24 def add_vpp_config(self):
25 self.test.vapi.ipsec_spd_add_del(self.id)
26 self.test.registry.register(self, self.test.logger)
28 def remove_vpp_config(self):
29 self.test.vapi.ipsec_spd_add_del(self.id, is_add=0)
32 return "ipsec-spd-%d" % self.id
34 def query_vpp_config(self):
35 spds = self.test.vapi.ipsec_spds_dump()
37 if spd.spd_id == self.id:
42 class VppIpsecSpdItfBinding(VppObject):
44 VPP SPD DB to interface binding
45 (i.e. this SPD is used on this interface)
48 def __init__(self, test, spd, itf):
53 def add_vpp_config(self):
54 self.test.vapi.ipsec_interface_add_del_spd(self.spd.id,
56 self.test.registry.register(self, self.test.logger)
58 def remove_vpp_config(self):
59 self.test.vapi.ipsec_interface_add_del_spd(self.spd.id,
64 return "bind-%s-to-%s" % (self.spd.id, self.itf)
66 def query_vpp_config(self):
67 bs = self.test.vapi.ipsec_spd_interface_dump()
69 if b.sw_if_index == self.itf.sw_if_index:
74 class VppIpsecSpdEntry(VppObject):
79 def __init__(self, test, spd, sa_id,
80 local_start, local_stop,
81 remote_start, remote_stop,
87 remote_port_stop=65535,
89 local_port_stop=65535):
93 self.local_start = ip_address(text_type(local_start))
94 self.local_stop = ip_address(text_type(local_stop))
95 self.remote_start = ip_address(text_type(remote_start))
96 self.remote_stop = ip_address(text_type(remote_stop))
98 self.is_outbound = is_outbound
99 self.priority = priority
101 self.policy = (VppEnum.vl_api_ipsec_spd_action_t.
102 IPSEC_API_SPD_ACTION_BYPASS)
105 self.is_ipv6 = (0 if self.local_start.version == 4 else 1)
106 self.local_port_start = local_port_start
107 self.local_port_stop = local_port_stop
108 self.remote_port_start = remote_port_start
109 self.remote_port_stop = remote_port_stop
111 def add_vpp_config(self):
112 rv = self.test.vapi.ipsec_spd_entry_add_del(
120 is_ipv6=self.is_ipv6,
121 is_outbound=self.is_outbound,
122 priority=self.priority,
124 local_port_start=self.local_port_start,
125 local_port_stop=self.local_port_stop,
126 remote_port_start=self.remote_port_start,
127 remote_port_stop=self.remote_port_stop)
128 self.stat_index = rv.stat_index
129 self.test.registry.register(self, self.test.logger)
131 def remove_vpp_config(self):
132 self.test.vapi.ipsec_spd_entry_add_del(
140 is_ipv6=self.is_ipv6,
141 is_outbound=self.is_outbound,
142 priority=self.priority,
144 local_port_start=self.local_port_start,
145 local_port_stop=self.local_port_stop,
146 remote_port_start=self.remote_port_start,
147 remote_port_stop=self.remote_port_stop,
151 return "spd-entry-%d-%d-%d-%d-%d-%d" % (self.spd.id,
156 self.remote_port_start)
158 def query_vpp_config(self):
159 ss = self.test.vapi.ipsec_spd_dump(self.spd.id)
161 if s.entry.sa_id == self.sa_id and \
162 s.entry.is_outbound == self.is_outbound and \
163 s.entry.priority == self.priority and \
164 s.entry.policy == self.policy and \
165 s.entry.remote_address_start == self.remote_start and \
166 s.entry.remote_port_start == self.remote_port_start:
170 def get_stats(self, worker=None):
171 c = self.test.statistics.get_counter("/net/ipsec/policy")
175 total['packets'] += t[self.stat_index]['packets']
178 # +1 to skip main thread
179 return c[worker+1][self.stat_index]
182 class VppIpsecSA(VppObject):
187 DEFAULT_UDP_PORT = 4500
189 def __init__(self, test, id, spi,
190 integ_alg, integ_key,
191 crypto_alg, crypto_key,
193 tun_src=None, tun_dst=None,
194 flags=None, salt=0, udp_src=None,
196 e = VppEnum.vl_api_ipsec_sad_flags_t
200 self.integ_alg = integ_alg
201 self.integ_key = integ_key
202 self.crypto_alg = crypto_alg
203 self.crypto_key = crypto_key
207 self.tun_src = tun_src
208 self.tun_dst = tun_dst
210 self.flags = e.IPSEC_API_SAD_FLAG_NONE
214 self.tun_src = ip_address(text_type(tun_src))
215 self.flags = self.flags | e.IPSEC_API_SAD_FLAG_IS_TUNNEL
216 if (self.tun_src.version == 6):
217 self.flags = self.flags | e.IPSEC_API_SAD_FLAG_IS_TUNNEL_V6
219 self.tun_dst = ip_address(text_type(tun_dst))
220 self.udp_src = udp_src
221 self.udp_dst = udp_dst
223 def add_vpp_config(self):
227 'integrity_algorithm': self.integ_alg,
229 'length': len(self.integ_key),
230 'data': self.integ_key,
232 'crypto_algorithm': self.crypto_alg,
234 'data': self.crypto_key,
235 'length': len(self.crypto_key),
237 'protocol': self.proto,
238 'tunnel_src': (self.tun_src if self.tun_src else []),
239 'tunnel_dst': (self.tun_dst if self.tun_dst else []),
243 # don't explicitly send the defaults, let papi fill them in
245 entry['udp_src_port'] = self.udp_src
247 entry['udp_dst_port'] = self.udp_dst
248 r = self.test.vapi.ipsec_sad_entry_add_del(is_add=1, entry=entry)
249 self.stat_index = r.stat_index
250 self.test.registry.register(self, self.test.logger)
252 def remove_vpp_config(self):
253 r = self.test.vapi.ipsec_sad_entry_add_del(
258 'integrity_algorithm': self.integ_alg,
260 'length': len(self.integ_key),
261 'data': self.integ_key,
263 'crypto_algorithm': self.crypto_alg,
265 'data': self.crypto_key,
266 'length': len(self.crypto_key),
268 'protocol': self.proto,
269 'tunnel_src': (self.tun_src if self.tun_src else []),
270 'tunnel_dst': (self.tun_dst if self.tun_dst else []),
276 return "ipsec-sa-%d" % self.id
278 def query_vpp_config(self):
279 e = VppEnum.vl_api_ipsec_sad_flags_t
281 bs = self.test.vapi.ipsec_sa_dump()
283 if b.entry.sad_id == self.id:
284 # if udp encap is configured then the ports should match
285 # those configured or the default
286 if (self.flags & e.IPSEC_API_SAD_FLAG_UDP_ENCAP):
287 if not b.entry.flags & e.IPSEC_API_SAD_FLAG_UDP_ENCAP:
290 if self.udp_src != b.entry.udp_src_port:
293 if self.DEFAULT_UDP_PORT != b.entry.udp_src_port:
296 if self.udp_dst != b.entry.udp_dst_port:
299 if self.DEFAULT_UDP_PORT != b.entry.udp_dst_port:
304 def get_stats(self, worker=None):
305 c = self.test.statistics.get_counter("/net/ipsec/sa")
309 total['packets'] += t[self.stat_index]['packets']
312 # +1 to skip main thread
313 return c[worker+1][self.stat_index]
316 class VppIpsecTunProtect(VppObject):
318 VPP IPSEC tunnel protection
321 def __init__(self, test, itf, sa_out, sas_in, nh=None):
326 self.sas_in.append(sa.id)
327 self.sa_out = sa_out.id
332 def update_vpp_config(self, sa_out, sas_in):
335 self.sas_in.append(sa.id)
336 self.sa_out = sa_out.id
337 self.test.vapi.ipsec_tunnel_protect_update(
339 'sw_if_index': self.itf._sw_if_index,
340 'n_sa_in': len(self.sas_in),
341 'sa_out': self.sa_out,
342 'sa_in': self.sas_in,
346 return "ipsec-tun-protect-%s-%s" % (self.itf, self.nh)
348 def add_vpp_config(self):
349 self.test.vapi.ipsec_tunnel_protect_update(
351 'sw_if_index': self.itf._sw_if_index,
352 'n_sa_in': len(self.sas_in),
353 'sa_out': self.sa_out,
354 'sa_in': self.sas_in,
356 self.test.registry.register(self, self.test.logger)
358 def remove_vpp_config(self):
359 self.test.vapi.ipsec_tunnel_protect_del(
360 sw_if_index=self.itf.sw_if_index,
363 def query_vpp_config(self):
364 bs = self.test.vapi.ipsec_tunnel_protect_dump(
365 sw_if_index=self.itf.sw_if_index)
367 if b.tun.sw_if_index == self.itf.sw_if_index and \
368 self.nh == str(b.tun.nh):