class IPsecSadFlags(IntEnum):
"""IPsec Security Association Database flags."""
- IPSEC_API_SAD_FLAG_NONE = 0,
+ IPSEC_API_SAD_FLAG_NONE = 0
# Enable extended sequence numbers
- IPSEC_API_SAD_FLAG_USE_ESN = 0x01,
+ IPSEC_API_SAD_FLAG_USE_ESN = 0x01
# Enable Anti - replay
- IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY = 0x02,
+ IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY = 0x02
# IPsec tunnel mode if non-zero, else transport mode
- IPSEC_API_SAD_FLAG_IS_TUNNEL = 0x04,
+ IPSEC_API_SAD_FLAG_IS_TUNNEL = 0x04
# IPsec tunnel mode is IPv6 if non-zero, else IPv4 tunnel
# only valid if is_tunnel is non-zero
- IPSEC_API_SAD_FLAG_IS_TUNNEL_V6 = 0x08,
+ IPSEC_API_SAD_FLAG_IS_TUNNEL_V6 = 0x08
# Enable UDP encapsulation for NAT traversal
- IPSEC_API_SAD_FLAG_UDP_ENCAP = 0x10,
+ IPSEC_API_SAD_FLAG_UDP_ENCAP = 0x10
# IPsec SA is or inbound traffic
IPSEC_API_SAD_FLAG_IS_INBOUND = 0x40
def get_integ_alg_key_len(integ_alg):
"""Return integrity algorithm key length.
+ None argument is accepted, returning zero.
+
:param integ_alg: Integrity algorithm.
- :type integ_alg: IntegAlg
+ :type integ_alg: Optional[IntegAlg]
:returns: Key length.
:rtype: int
"""
- return integ_alg.key_len
+ return 0 if integ_alg is None else integ_alg.key_len
@staticmethod
def get_integ_alg_scapy_name(integ_alg):
:type spi: int
:type crypto_alg: CryptoAlg
:type crypto_key: str
- :type integ_alg: IntegAlg
+ :type integ_alg: Optional[IntegAlg]
:type integ_key: str
:type tunnel_src: str
:type tunnel_dst: str
:type spi: int
:type crypto_alg: CryptoAlg
:type crypto_key: str
- :type integ_alg: IntegAlg
+ :type integ_alg: Optional[IntegAlg]
:type integ_key: str
:type tunnel_src: str
:type tunnel_dst: str
integ = f"integ-alg {integ_alg.alg_name} " \
f"integ-key {integ_key.hex()}" \
if integ_alg else u""
- tunnel = f"tunnel-src {src_addr + i * addr_incr} " \
- f"tunnel-dst {dst_addr + i * addr_incr}" \
+ tunnel = f"tunnel src {src_addr + i * addr_incr} " \
+ f"tunnel dst {dst_addr + i * addr_incr}" \
if tunnel_src and tunnel_dst else u""
conf = f"exec ipsec sa add {sad_id + i} esp spi {spi + i} "\
f"crypto-alg {crypto_alg.alg_name} " \
@staticmethod
def vpp_ipsec_set_ip_route(
node, n_tunnels, tunnel_src, traffic_addr, tunnel_dst, interface,
- raddr_range):
+ raddr_range, dst_mac=None):
"""Set IP address and route on interface.
:param node: VPP node to add config on.
:param raddr_range: Mask specifying range of Policy selector Remote IP
addresses. Valid values are from 1 to 32 in case of IPv4 and to 128
in case of IPv6.
+ :param dst_mac: The MAC address of destination tunnels.
:type node: dict
:type n_tunnels: int
:type tunnel_src: str
:type tunnel_dst: str
:type interface: str
:type raddr_range: int
+ :type dst_mac: str
"""
tunnel_src = ip_address(tunnel_src)
tunnel_dst = ip_address(tunnel_dst)
f"exec ip route add {traffic_addr + i}/" \
f"{128 if traffic_addr.version == 6 else 32} " \
f"via {tunnel_dst + i * addr_incr} {if_name}\n"
+ if dst_mac:
+ conf = f"{conf}exec set ip neighbor {if_name} " \
+ f"{tunnel_dst + i * addr_incr} {dst_mac}\n"
tmp_file.write(conf)
+
VatExecutor().execute_script(
tmp_filename, node, timeout=300, json_out=False,
copy_on_execute=True
is_multipath=0,
route=None
)
- err_msg = f"Failed to configure IP addresses and IP routes " \
- f"on interface {interface} on host {node[u'host']}"
+ cmd3 = u"ip_neighbor_add_del"
+ args3 = dict(
+ is_add=True,
+ neighbor=dict(
+ sw_if_index=Topology.get_interface_sw_index(node, interface),
+ flags=0,
+ mac_address=str(dst_mac),
+ ip_address=None
+ )
+ )
+ err_msg = f"Failed to configure IP addresses, IP routes and " \
+ f"IP neighbor on interface {interface} on host {node[u'host']}" \
+ if dst_mac \
+ else f"Failed to configure IP addresses and IP routes " \
+ f"on interface {interface} on host {node[u'host']}"
with PapiSocketExecutor(node) as papi_exec:
for i in range(n_tunnels):
history = bool(not 1 < i < n_tunnels - 2)
papi_exec.add(cmd1, history=history, **args1).\
add(cmd2, history=history, **args2)
+ if dst_mac:
+ args3[u"neighbor"][u"ip_address"] = ip_address(
+ tunnel_dst + i * addr_incr
+ )
+ papi_exec.add(cmd3, history=history, **args3)
papi_exec.get_replies(err_msg)
@staticmethod
raddr_ip2, addr_incr, spi_d, existing_tunnels=0):
"""Create multiple IPsec tunnel interfaces on DUT1 node using VAT.
+ Generate random keys and return them (so DUT2 or TG can decrypt).
+
:param nodes: VPP nodes to create tunnel interfaces.
:param tun_ips: Dictionary with VPP node 1 ipsec tunnel interface
IPv4/IPv6 address (ip1) and VPP node 2 ipsec tunnel interface
:type if2_key: str
:type n_tunnels: int
:type crypto_alg: CryptoAlg
- :type integ_alg: IntegAlg
+ :type integ_alg: Optional[IntegAlg]
:type raddr_ip2: IPv4Address or IPv6Address
:type addr_incr: int
:type spi_d: dict
:type existing_tunnels: int
+ :returns: Generated ckeys and ikeys.
+ :rtype: List[bytes], List[bytes]
"""
tmp_fn1 = u"/tmp/ipsec_create_tunnel_dut1.config"
if1_n = Topology.get_interface_name(nodes[u"DUT1"], if1_key)
ckeys.append(
gen_key(IPsecUtil.get_crypto_alg_key_len(crypto_alg))
)
+ ikeys.append(
+ gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg))
+ )
if integ_alg:
- ikeys.append(
- gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg))
- )
integ = f"integ-alg {integ_alg.alg_name} " \
f"integ-key {ikeys[i].hex()} "
else:
ikeys, raddr_ip1, addr_incr, spi_d, existing_tunnels=0):
"""Create multiple IPsec tunnel interfaces on DUT2 node using VAT.
+ This method accesses keys generated by DUT1 method
+ and does not return anything.
+
:param nodes: VPP nodes to create tunnel interfaces.
:param tun_ips: Dictionary with VPP node 1 ipsec tunnel interface
IPv4/IPv6 address (ip1) and VPP node 2 ipsec tunnel interface
:type if2_key: str
:type n_tunnels: int
:type crypto_alg: CryptoAlg
- :type ckeys: list
- :type integ_alg: IntegAlg
- :type ikeys: list
+ :type ckeys: Sequence[bytes]
+ :type integ_alg: Optional[IntegAlg]
+ :type ikeys: Sequence[bytes]
:type addr_incr: int
:type spi_d: dict
:type existing_tunnels: int
raddr_ip2, addr_incr, spi_d, existing_tunnels=0):
"""Create multiple IPsec tunnel interfaces on DUT1 node using PAPI.
+ Generate random keys and return them (so DUT2 or TG can decrypt).
+
:param nodes: VPP nodes to create tunnel interfaces.
:param tun_ips: Dictionary with VPP node 1 ipsec tunnel interface
IPv4/IPv6 address (ip1) and VPP node 2 ipsec tunnel interface
:type if2_key: str
:type n_tunnels: int
:type crypto_alg: CryptoAlg
- :type integ_alg: IntegAlg
+ :type integ_alg: Optional[IntegAlg]
:type raddr_ip2: IPv4Address or IPv6Address
:type addr_incr: int
:type spi_d: dict
:type existing_tunnels: int
+ :returns: Generated ckeys and ikeys.
+ :rtype: List[bytes], List[bytes]
"""
if not existing_tunnels:
loop_sw_if_idx = IPsecUtil._ipsec_create_loopback_dut1_papi(
ckeys.append(
gen_key(IPsecUtil.get_crypto_alg_key_len(crypto_alg))
)
- if integ_alg:
- ikeys.append(
- gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg))
- )
+ ikeys.append(
+ gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg))
+ )
# SAD entry for outband / tx path
args[u"entry"][u"sad_id"] = i
args[u"entry"][u"spi"] = spi_d[u"spi_1"] + i
ikeys, raddr_ip1, addr_incr, spi_d, existing_tunnels=0):
"""Create multiple IPsec tunnel interfaces on DUT2 node using PAPI.
+ This method accesses keys generated by DUT1 method
+ and does not return anything.
+
:param nodes: VPP nodes to create tunnel interfaces.
:param tun_ips: Dictionary with VPP node 1 ipsec tunnel interface
IPv4/IPv6 address (ip1) and VPP node 2 ipsec tunnel interface
:type if2_key: str
:type n_tunnels: int
:type crypto_alg: CryptoAlg
- :type ckeys: list
- :type integ_alg: IntegAlg
- :type ikeys: list
+ :type ckeys: Sequence[bytes]
+ :type integ_alg: Optional[IntegAlg]
+ :type ikeys: Sequence[bytes]
:type addr_incr: int
:type spi_d: dict
:type existing_tunnels: int
ckeys.append(
gen_key(IPsecUtil.get_crypto_alg_key_len(crypto_alg))
)
- if integ_alg:
- ikeys.append(
- gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg))
- )
+ ikeys.append(
+ gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg))
+ )
# SAD entry for outband / tx path
args[u"entry"][u"sad_id"] = 100000 + i
args[u"entry"][u"spi"] = spi_d[u"spi_2"] + i
def vpp_ipsec_create_tunnel_interfaces(
nodes, tun_if1_ip_addr, tun_if2_ip_addr, if1_key, if2_key,
n_tunnels, crypto_alg, integ_alg, raddr_ip1, raddr_ip2, raddr_range,
- existing_tunnels=0):
+ existing_tunnels=0, return_keys=False):
"""Create multiple IPsec tunnel interfaces between two VPP nodes.
+ Some deployments (e.g. devicetest) need to know the generated keys.
+ But other deployments (e.g. scale perf test) would get spammed
+ if we returned keys every time.
+
:param nodes: VPP nodes to create tunnel interfaces.
:param tun_if1_ip_addr: VPP node 1 ipsec tunnel interface IPv4/IPv6
address.
and to 128 in case of IPv6.
:param existing_tunnels: Number of tunnel interfaces before creation.
Useful mainly for reconf tests. Default 0.
+ :param return_keys: Whether generated keys should be returned.
:type nodes: dict
:type tun_if1_ip_addr: str
:type tun_if2_ip_addr: str
:type if2_key: str
:type n_tunnels: int
:type crypto_alg: CryptoAlg
- :type integ_alg: IntegAlg
+ :type integ_alg: Optonal[IntegAlg]
:type raddr_ip1: string
:type raddr_ip2: string
:type raddr_range: int
:type existing_tunnels: int
+ :type return_keys: bool
+ :returns: Ckeys, ikeys, spi_1, spi_2.
+ :rtype: Optional[List[bytes], List[bytes], int, int]
"""
n_tunnels = int(n_tunnels)
existing_tunnels = int(existing_tunnels)
nodes, tun_ips, if1_key, if2_key, n_tunnels, crypto_alg,
integ_alg, raddr_ip2, addr_incr, spi_d, existing_tunnels
)
- if u"DUT2" not in nodes.keys():
- return ckeys[0], ikeys[0], spi_d[u"spi_1"], spi_d[u"spi_2"]
- IPsecUtil._ipsec_create_tunnel_interfaces_dut2_vat(
- nodes, tun_ips, if2_key, n_tunnels, crypto_alg, ckeys,
- integ_alg, ikeys, raddr_ip1, addr_incr, spi_d, existing_tunnels
- )
+ if u"DUT2" in nodes.keys():
+ IPsecUtil._ipsec_create_tunnel_interfaces_dut2_vat(
+ nodes, tun_ips, if2_key, n_tunnels, crypto_alg, ckeys,
+ integ_alg, ikeys, raddr_ip1, addr_incr, spi_d,
+ existing_tunnels
+ )
else:
ckeys, ikeys = IPsecUtil._ipsec_create_tunnel_interfaces_dut1_papi(
nodes, tun_ips, if1_key, if2_key, n_tunnels, crypto_alg,
integ_alg, raddr_ip2, addr_incr, spi_d, existing_tunnels
)
- if u"DUT2" not in nodes.keys():
- return ckeys[0], ikeys[0], spi_d[u"spi_1"], spi_d[u"spi_2"]
- IPsecUtil._ipsec_create_tunnel_interfaces_dut2_papi(
- nodes, tun_ips, if2_key, n_tunnels, crypto_alg, ckeys,
- integ_alg, ikeys, raddr_ip1, addr_incr, spi_d, existing_tunnels
- )
+ if u"DUT2" in nodes.keys():
+ IPsecUtil._ipsec_create_tunnel_interfaces_dut2_papi(
+ nodes, tun_ips, if2_key, n_tunnels, crypto_alg, ckeys,
+ integ_alg, ikeys, raddr_ip1, addr_incr, spi_d,
+ existing_tunnels
+ )
- return None, None, None, None
+ if return_keys:
+ return ckeys, ikeys, spi_d[u"spi_1"], spi_d[u"spi_2"]
+ return None
@staticmethod
def _create_ipsec_script_files(dut, instances):
:type if2_ip_addr: str
:type n_tunnels: int
:type crypto_alg: CryptoAlg
- :type integ_alg: IntegAlg
+ :type integ_alg: Optional[IntegAlg]
:type raddr_ip1: string
:type raddr_ip2: string
:type raddr_range: int
gen_key(IPsecUtil.get_crypto_alg_key_len(crypto_alg)), u"hex"
)
integ = u""
+ ikey = getattr(
+ gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg)), u"hex"
+ )
if integ_alg:
- ikey = getattr(
- gen_key(IPsecUtil.get_integ_alg_key_len(integ_alg)), u"hex"
- )
integ = (
f"integ-alg {integ_alg.alg_name} "
f"local-integ-key {ikey} "
:type interface2: str or int
:type n_tunnels: int
:type crypto_alg: CryptoAlg
- :type integ_alg: IntegAlg
+ :type integ_alg: Optional[IntegAlg]
:type tunnel_ip1: str
:type tunnel_ip2: str
:type raddr_ip1: string
IPsecUtil.get_integ_alg_key_len(integ_alg)
).decode() if integ_alg else u""
+ rmac = Topology.get_interface_mac(nodes[u"DUT2"], interface2) \
+ if u"DUT2" in nodes.keys() \
+ else Topology.get_interface_mac(nodes[u"TG"], interface2)
IPsecUtil.vpp_ipsec_set_ip_route(
nodes[u"DUT1"], n_tunnels, tunnel_ip1, raddr_ip2, tunnel_ip2,
- interface1, raddr_range)
- IPsecUtil.vpp_ipsec_set_ip_route(
- nodes[u"DUT2"], n_tunnels, tunnel_ip2, raddr_ip1, tunnel_ip1,
- interface2, raddr_range)
+ interface1, raddr_range, rmac)
IPsecUtil.vpp_ipsec_add_spd(nodes[u"DUT1"], spd_id)
IPsecUtil.vpp_ipsec_spd_add_if(nodes[u"DUT1"], spd_id, interface1)
proto=50, laddr_range=u"100.0.0.0/8", raddr_range=u"100.0.0.0/8"
)
- IPsecUtil.vpp_ipsec_add_spd(nodes[u"DUT2"], spd_id)
- IPsecUtil.vpp_ipsec_spd_add_if(nodes[u"DUT2"], spd_id, interface2)
- IPsecUtil.vpp_ipsec_policy_add(
- nodes[u"DUT2"], spd_id, p_hi, PolicyAction.BYPASS, inbound=False,
- proto=50, laddr_range=u"100.0.0.0/8", raddr_range=u"100.0.0.0/8"
- )
- IPsecUtil.vpp_ipsec_policy_add(
- nodes[u"DUT2"], spd_id, p_hi, PolicyAction.BYPASS, inbound=True,
- proto=50, laddr_range=u"100.0.0.0/8", raddr_range=u"100.0.0.0/8"
- )
-
IPsecUtil.vpp_ipsec_add_sad_entries(
nodes[u"DUT1"], n_tunnels, sa_id_1, spi_1, crypto_alg, crypto_key,
integ_alg, integ_key, tunnel_ip1, tunnel_ip2
)
IPsecUtil.vpp_ipsec_add_sad_entries(
- nodes[u"DUT2"], n_tunnels, sa_id_1, spi_1, crypto_alg, crypto_key,
- integ_alg, integ_key, tunnel_ip1, tunnel_ip2
+ nodes[u"DUT1"], n_tunnels, sa_id_2, spi_2, crypto_alg, crypto_key,
+ integ_alg, integ_key, tunnel_ip2, tunnel_ip1
)
IPsecUtil.vpp_ipsec_spd_add_entries(
- nodes[u"DUT2"], n_tunnels, spd_id, p_lo, True, sa_id_1, raddr_ip2
+ nodes[u"DUT1"], n_tunnels, spd_id, p_lo, True, sa_id_2, raddr_ip1
)
- IPsecUtil.vpp_ipsec_add_sad_entries(
- nodes[u"DUT2"], n_tunnels, sa_id_2, spi_2, crypto_alg, crypto_key,
- integ_alg, integ_key, tunnel_ip2, tunnel_ip1
- )
+ if u"DUT2" in nodes.keys():
+ IPsecUtil.vpp_ipsec_set_ip_route(
+ nodes[u"DUT2"], n_tunnels, tunnel_ip2, raddr_ip1, tunnel_ip1,
+ interface2, raddr_range)
+
+ IPsecUtil.vpp_ipsec_add_spd(nodes[u"DUT2"], spd_id)
+ IPsecUtil.vpp_ipsec_spd_add_if(nodes[u"DUT2"], spd_id, interface2)
+ IPsecUtil.vpp_ipsec_policy_add(
+ nodes[u"DUT2"], spd_id, p_hi, PolicyAction.BYPASS,
+ inbound=False, proto=50, laddr_range=u"100.0.0.0/8",
+ raddr_range=u"100.0.0.0/8"
+ )
+ IPsecUtil.vpp_ipsec_policy_add(
+ nodes[u"DUT2"], spd_id, p_hi, PolicyAction.BYPASS,
+ inbound=True, proto=50, laddr_range=u"100.0.0.0/8",
+ raddr_range=u"100.0.0.0/8"
+ )
- IPsecUtil.vpp_ipsec_spd_add_entries(
- nodes[u"DUT2"], n_tunnels, spd_id, p_lo, False, sa_id_2, raddr_ip1
- )
+ IPsecUtil.vpp_ipsec_add_sad_entries(
+ nodes[u"DUT2"], n_tunnels, sa_id_1, spi_1, crypto_alg,
+ crypto_key, integ_alg, integ_key, tunnel_ip1, tunnel_ip2
+ )
+ IPsecUtil.vpp_ipsec_spd_add_entries(
+ nodes[u"DUT2"], n_tunnels, spd_id, p_lo, True, sa_id_1,
+ raddr_ip2
+ )
- IPsecUtil.vpp_ipsec_add_sad_entries(
- nodes[u"DUT1"], n_tunnels, sa_id_2, spi_2, crypto_alg, crypto_key,
- integ_alg, integ_key, tunnel_ip2, tunnel_ip1
- )
+ IPsecUtil.vpp_ipsec_add_sad_entries(
+ nodes[u"DUT2"], n_tunnels, sa_id_2, spi_2, crypto_alg,
+ crypto_key, integ_alg, integ_key, tunnel_ip2, tunnel_ip1
+ )
+ IPsecUtil.vpp_ipsec_spd_add_entries(
+ nodes[u"DUT2"], n_tunnels, spd_id, p_lo, False, sa_id_2,
+ raddr_ip1
+ )
- IPsecUtil.vpp_ipsec_spd_add_entries(
- nodes[u"DUT1"], n_tunnels, spd_id, p_lo, True, sa_id_2, raddr_ip1
- )
@staticmethod
def vpp_ipsec_show(node):