+ self.logger.info(self.vapi.ppcli("show ipsec all"))
+ self.verify_counters6(p, p, count)
+
+ def verify_keepalive(self, p):
+ # the sizeof Raw is calculated to pad to the minimum ehternet
+ # frame size of 64 btyes
+ pkt = (
+ Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
+ / IPv6(src=p.remote_tun_if_host, dst=self.tun_if.local_ip6)
+ / UDP(sport=333, dport=4500)
+ / Raw(b"\xff")
+ / Padding(0 * 1)
+ )
+ self.send_and_assert_no_replies(self.tun_if, pkt * 31)
+ self.assert_error_counter_equal(
+ "/err/%s/nat_keepalive" % self.tun6_input_node, 31
+ )
+
+ pkt = (
+ Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
+ / IPv6(src=p.remote_tun_if_host, dst=self.tun_if.local_ip6)
+ / UDP(sport=333, dport=4500)
+ / Raw(b"\xfe")
+ )
+ self.send_and_assert_no_replies(self.tun_if, pkt * 31)
+ self.assert_error_counter_equal("/err/%s/too_short" % self.tun6_input_node, 31)
+
+ pkt = (
+ Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
+ / IPv6(src=p.remote_tun_if_host, dst=self.tun_if.local_ip6)
+ / UDP(sport=333, dport=4500)
+ / Raw(b"\xfe")
+ / Padding(0 * 21)
+ )
+ self.send_and_assert_no_replies(self.tun_if, pkt * 31)
+ self.assert_error_counter_equal("/err/%s/too_short" % self.tun6_input_node, 62)
+
+
+class IpsecTun6Tests(IpsecTun6):
+ """UT test methods for Tunnel v6"""
+
+ def test_tun_basic66(self):
+ """ipsec 6o6 tunnel basic test"""
+ self.verify_tun_66(self.params[socket.AF_INET6], count=1)
+
+ def test_tun_reass_basic66(self):
+ """ipsec 6o6 tunnel basic reassembly test"""
+ self.verify_tun_reass_66(self.params[socket.AF_INET6])
+
+ def test_tun_burst66(self):
+ """ipsec 6o6 tunnel burst test"""
+ self.verify_tun_66(self.params[socket.AF_INET6], count=257)
+
+
+class IpsecTun6HandoffTests(IpsecTun6):
+ """UT test methods for Tunnel v6 with multiple workers"""
+
+ vpp_worker_count = 2
+
+ def test_tun_handoff_66(self):
+ """ipsec 6o6 tunnel worker hand-off test"""
+ self.vapi.cli("clear errors")
+ self.vapi.cli("clear ipsec sa")
+
+ N_PKTS = 15
+ p = self.params[socket.AF_INET6]
+
+ # inject alternately on worker 0 and 1. all counts on the SA
+ # should be against worker 0
+ for worker in [0, 1, 0, 1]:
+ send_pkts = self.gen_encrypt_pkts6(
+ p,
+ p.scapy_tun_sa,
+ self.tun_if,
+ src=p.remote_tun_if_host,
+ dst=self.pg1.remote_ip6,
+ count=N_PKTS,
+ )
+ recv_pkts = self.send_and_expect(
+ self.tun_if, send_pkts, self.pg1, worker=worker
+ )
+ self.verify_decrypted6(p, recv_pkts)
+
+ send_pkts = self.gen_pkts6(
+ p,
+ self.pg1,
+ src=self.pg1.remote_ip6,
+ dst=p.remote_tun_if_host,
+ count=N_PKTS,
+ )
+ recv_pkts = self.send_and_expect(
+ self.pg1, send_pkts, self.tun_if, worker=worker
+ )
+ self.verify_encrypted6(p, p.vpp_tun_sa, recv_pkts)
+
+ # all counts against the first worker that was used
+ self.verify_counters6(p, p, 4 * N_PKTS, worker=0)
+
+
+class IpsecTun4HandoffTests(IpsecTun4):
+ """UT test methods for Tunnel v4 with multiple workers"""
+
+ vpp_worker_count = 2
+
+ def test_tun_handooff_44(self):
+ """ipsec 4o4 tunnel worker hand-off test"""
+ self.vapi.cli("clear errors")
+ self.vapi.cli("clear ipsec sa")
+
+ N_PKTS = 15
+ p = self.params[socket.AF_INET]
+
+ # inject alternately on worker 0 and 1. all counts on the SA
+ # should be against worker 0
+ for worker in [0, 1, 0, 1]:
+ send_pkts = self.gen_encrypt_pkts(
+ p,
+ p.scapy_tun_sa,
+ self.tun_if,
+ src=p.remote_tun_if_host,
+ dst=self.pg1.remote_ip4,
+ count=N_PKTS,
+ )
+ recv_pkts = self.send_and_expect(
+ self.tun_if, send_pkts, self.pg1, worker=worker
+ )
+ self.verify_decrypted(p, recv_pkts)
+
+ send_pkts = self.gen_pkts(
+ self.pg1,
+ src=self.pg1.remote_ip4,
+ dst=p.remote_tun_if_host,
+ count=N_PKTS,
+ )
+ recv_pkts = self.send_and_expect(
+ self.pg1, send_pkts, self.tun_if, worker=worker
+ )
+ self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
+
+ # all counts against the first worker that was used
+ self.verify_counters4(p, 4 * N_PKTS, worker=0)
+
+
+class IpsecTun46Tests(IpsecTun4Tests, IpsecTun6Tests):
+ """UT test methods for Tunnel v6 & v4"""
+
+ pass
+
+
+class IPSecIPv4Fwd(VppTestCase):
+ """Test IPSec by capturing and verifying IPv4 forwarded pkts"""
+
+ @classmethod
+ def setUpConstants(cls):
+ super(IPSecIPv4Fwd, cls).setUpConstants()
+
+ def setUp(self):
+ super(IPSecIPv4Fwd, self).setUp()
+ # store SPD objects so we can remove configs on tear down
+ self.spd_objs = []
+ self.spd_policies = []
+
+ def tearDown(self):
+ # remove SPD policies
+ for obj in self.spd_policies:
+ obj.remove_vpp_config()
+ self.spd_policies = []
+ # remove SPD items (interface bindings first, then SPD)
+ for obj in reversed(self.spd_objs):
+ obj.remove_vpp_config()
+ self.spd_objs = []
+ # close down pg intfs
+ for pg in self.pg_interfaces:
+ pg.unconfig_ip4()
+ pg.admin_down()
+ super(IPSecIPv4Fwd, self).tearDown()
+
+ def create_interfaces(self, num_ifs=2):
+ # create interfaces pg0 ... pg<num_ifs>
+ self.create_pg_interfaces(range(num_ifs))
+ for pg in self.pg_interfaces:
+ # put the interface up
+ pg.admin_up()
+ # configure IPv4 address on the interface
+ pg.config_ip4()
+ # resolve ARP, so that we know VPP MAC
+ pg.resolve_arp()
+ self.logger.info(self.vapi.ppcli("show int addr"))
+
+ def spd_create_and_intf_add(self, spd_id, pg_list):
+ spd = VppIpsecSpd(self, spd_id)
+ spd.add_vpp_config()
+ self.spd_objs.append(spd)
+ for pg in pg_list:
+ spdItf = VppIpsecSpdItfBinding(self, spd, pg)
+ spdItf.add_vpp_config()
+ self.spd_objs.append(spdItf)
+
+ def get_policy(self, policy_type):
+ e = VppEnum.vl_api_ipsec_spd_action_t
+ if policy_type == "protect":
+ return e.IPSEC_API_SPD_ACTION_PROTECT
+ elif policy_type == "bypass":
+ return e.IPSEC_API_SPD_ACTION_BYPASS
+ elif policy_type == "discard":
+ return e.IPSEC_API_SPD_ACTION_DISCARD
+ else:
+ raise Exception("Invalid policy type: %s", policy_type)
+
+ def spd_add_rem_policy(
+ self,
+ spd_id,
+ src_if,
+ dst_if,
+ proto,
+ is_out,
+ priority,
+ policy_type,
+ remove=False,
+ all_ips=False,
+ ip_range=False,
+ local_ip_start=ip_address("0.0.0.0"),
+ local_ip_stop=ip_address("255.255.255.255"),
+ remote_ip_start=ip_address("0.0.0.0"),
+ remote_ip_stop=ip_address("255.255.255.255"),
+ remote_port_start=0,
+ remote_port_stop=65535,
+ local_port_start=0,
+ local_port_stop=65535,
+ ):
+ spd = VppIpsecSpd(self, spd_id)
+
+ if all_ips:
+ src_range_low = ip_address("0.0.0.0")
+ src_range_high = ip_address("255.255.255.255")
+ dst_range_low = ip_address("0.0.0.0")
+ dst_range_high = ip_address("255.255.255.255")
+
+ elif ip_range:
+ src_range_low = local_ip_start
+ src_range_high = local_ip_stop
+ dst_range_low = remote_ip_start
+ dst_range_high = remote_ip_stop
+
+ else:
+ src_range_low = src_if.remote_ip4
+ src_range_high = src_if.remote_ip4
+ dst_range_low = dst_if.remote_ip4
+ dst_range_high = dst_if.remote_ip4
+
+ spdEntry = VppIpsecSpdEntry(
+ self,
+ spd,
+ 0,
+ src_range_low,
+ src_range_high,
+ dst_range_low,
+ dst_range_high,
+ proto,
+ priority=priority,
+ policy=self.get_policy(policy_type),
+ is_outbound=is_out,
+ remote_port_start=remote_port_start,
+ remote_port_stop=remote_port_stop,
+ local_port_start=local_port_start,
+ local_port_stop=local_port_stop,
+ )
+
+ if remove is False:
+ spdEntry.add_vpp_config()
+ self.spd_policies.append(spdEntry)
+ else:
+ spdEntry.remove_vpp_config()
+ self.spd_policies.remove(spdEntry)
+ self.logger.info(self.vapi.ppcli("show ipsec all"))
+ return spdEntry
+
+ def create_stream(
+ self, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678, proto="UDP"
+ ):
+ packets = []
+ # create SA
+ sa = SecurityAssociation(
+ ESP,
+ spi=1000,
+ crypt_algo="AES-CBC",
+ crypt_key=b"JPjyOWBeVEQiMe7h",
+ auth_algo="HMAC-SHA1-96",
+ auth_key=b"C91KUR9GYMm5GfkEvNjX",
+ tunnel_header=IP(src=src_if.remote_ip4, dst=dst_if.remote_ip4),
+ nat_t_header=UDP(sport=src_prt, dport=dst_prt),
+ )
+ for i in range(pkt_count):
+ # create packet info stored in the test case instance
+ info = self.create_packet_info(src_if, dst_if)
+ # convert the info into packet payload
+ payload = self.info_to_payload(info)
+ # create the packet itself
+ p = []
+ if proto == "UDP-ESP":
+ p = Ether(dst=src_if.local_mac, src=src_if.remote_mac) / sa.encrypt(
+ IP(src=src_if.remote_ip4, dst=dst_if.remote_ip4)
+ / UDP(sport=src_prt, dport=dst_prt)
+ / Raw(payload)
+ )
+ elif proto == "UDP":
+ p = (
+ Ether(dst=src_if.local_mac, src=src_if.remote_mac)
+ / IP(src=src_if.remote_ip4, dst=dst_if.remote_ip4)
+ / UDP(sport=src_prt, dport=dst_prt)
+ / Raw(payload)
+ )
+ elif proto == "TCP":
+ p = (
+ Ether(dst=src_if.local_mac, src=src_if.remote_mac)
+ / IP(src=src_if.remote_ip4, dst=dst_if.remote_ip4)
+ / TCP(sport=src_prt, dport=dst_prt)
+ / Raw(payload)
+ )
+ # store a copy of the packet in the packet info
+ info.data = p.copy()
+ # append the packet to the list
+ packets.append(p)
+ # return the created packet list
+ return packets
+
+ def verify_capture(self, src_if, dst_if, capture):
+ packet_info = None
+ for packet in capture:
+ try:
+ ip = packet[IP]
+ udp = packet[UDP]
+ # convert the payload to packet info object
+ payload_info = self.payload_to_info(packet)
+ # make sure the indexes match
+ self.assert_equal(
+ payload_info.src, src_if.sw_if_index, "source sw_if_index"
+ )
+ self.assert_equal(
+ payload_info.dst, dst_if.sw_if_index, "destination sw_if_index"
+ )
+ packet_info = self.get_next_packet_info_for_interface2(
+ src_if.sw_if_index, dst_if.sw_if_index, packet_info
+ )
+ # make sure we didn't run out of saved packets
+ self.assertIsNotNone(packet_info)
+ self.assert_equal(
+ payload_info.index, packet_info.index, "packet info index"
+ )
+ saved_packet = packet_info.data # fetch the saved packet
+ # assert the values match
+ self.assert_equal(ip.src, saved_packet[IP].src, "IP source address")
+ # ... more assertions here
+ self.assert_equal(udp.sport, saved_packet[UDP].sport, "UDP source port")
+ except Exception as e:
+ self.logger.error(ppp("Unexpected or invalid packet:", packet))
+ raise
+ remaining_packet = self.get_next_packet_info_for_interface2(
+ src_if.sw_if_index, dst_if.sw_if_index, packet_info
+ )
+ self.assertIsNone(
+ remaining_packet,
+ "Interface %s: Packet expected from interface "
+ "%s didn't arrive" % (dst_if.name, src_if.name),
+ )
+
+ def verify_policy_match(self, pkt_count, spdEntry):
+ self.logger.info("XXXX %s %s", str(spdEntry), str(spdEntry.get_stats()))
+ matched_pkts = spdEntry.get_stats().get("packets")
+ self.logger.info("Policy %s matched: %d pkts", str(spdEntry), matched_pkts)
+ self.assert_equal(pkt_count, matched_pkts)
+
+ # Method verify_l3_l4_capture() will verify network and transport layer
+ # fields of the packet sa.encrypt() gives interface number garbadge.
+ # thus interface validation get failed (scapy bug?). However our intent
+ # is to verify IP layer and above and that is covered.
+
+ def verify_l3_l4_capture(
+ self, src_if, dst_if, capture, tcp_port_in=1234, udp_port_in=5678
+ ):
+ for packet in capture:
+ try:
+ self.assert_packet_checksums_valid(packet)
+ self.assert_equal(
+ packet[IP].src,
+ src_if.remote_ip4,
+ "decrypted packet source address",
+ )
+ self.assert_equal(
+ packet[IP].dst,
+ dst_if.remote_ip4,
+ "decrypted packet destination address",
+ )
+ if packet.haslayer(TCP):
+ self.assertFalse(
+ packet.haslayer(UDP),
+ "unexpected UDP header in decrypted packet",
+ )
+ elif packet.haslayer(UDP):
+ if packet[UDP].payload:
+ self.assertFalse(
+ packet[UDP][1].haslayer(UDP),
+ "unexpected UDP header in decrypted packet",
+ )
+ else:
+ self.assertFalse(
+ packet.haslayer(UDP),
+ "unexpected UDP header in decrypted packet",
+ )
+ self.assert_equal(
+ packet[ICMP].id, self.icmp_id_in, "decrypted packet ICMP ID"
+ )
+ except Exception:
+ self.logger.error(ppp("Unexpected or invalid plain packet:", packet))
+ raise
+
+
+class SpdFlowCacheTemplate(IPSecIPv4Fwd):
+ @classmethod
+ def setUpConstants(cls):
+ super(SpdFlowCacheTemplate, cls).setUpConstants()
+ # Override this method with required cmdline parameters e.g.
+ # cls.vpp_cmdline.extend(["ipsec", "{",
+ # "ipv4-outbound-spd-flow-cache on",
+ # "}"])
+ # cls.logger.info("VPP modified cmdline is %s" % " "
+ # .join(cls.vpp_cmdline))
+
+ def setUp(self):
+ super(SpdFlowCacheTemplate, self).setUp()
+
+ def tearDown(self):
+ super(SpdFlowCacheTemplate, self).tearDown()
+
+ def get_spd_flow_cache_entries(self, outbound):
+ """'show ipsec spd' output:
+ ipv4-inbound-spd-flow-cache-entries: 0
+ ipv4-outbound-spd-flow-cache-entries: 0
+ """
+ show_ipsec_reply = self.vapi.cli("show ipsec spd")
+ # match the relevant section of 'show ipsec spd' output
+ if outbound:
+ regex_match = re.search(
+ "ipv4-outbound-spd-flow-cache-entries: (.*)",
+ show_ipsec_reply,
+ re.DOTALL,
+ )
+ else:
+ regex_match = re.search(
+ "ipv4-inbound-spd-flow-cache-entries: (.*)", show_ipsec_reply, re.DOTALL
+ )
+ if regex_match is None:
+ raise Exception(
+ "Unable to find spd flow cache entries \
+ in 'show ipsec spd' CLI output - regex failed to match"
+ )
+ else:
+ try:
+ num_entries = int(regex_match.group(1))
+ except ValueError:
+ raise Exception(
+ "Unable to get spd flow cache entries \
+ from 'show ipsec spd' string: %s",
+ regex_match.group(0),
+ )
+ self.logger.info("%s", regex_match.group(0))
+ return num_entries
+
+ def verify_num_outbound_flow_cache_entries(self, expected_elements):
+ self.assertEqual(
+ self.get_spd_flow_cache_entries(outbound=True), expected_elements
+ )
+
+ def verify_num_inbound_flow_cache_entries(self, expected_elements):
+ self.assertEqual(
+ self.get_spd_flow_cache_entries(outbound=False), expected_elements
+ )
+
+ def crc32_supported(self):
+ # lscpu is part of util-linux package, available on all Linux Distros
+ stream = os.popen("lscpu")
+ cpu_info = stream.read()
+ # feature/flag "crc32" on Aarch64 and "sse4_2" on x86
+ # see vppinfra/crc32.h
+ if "crc32" or "sse4_2" in cpu_info:
+ self.logger.info("\ncrc32 supported:\n" + cpu_info)
+ return True
+ else:
+ self.logger.info("\ncrc32 NOT supported:\n" + cpu_info)
+ return False
+
+ def create_stream(
+ cls, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678, proto="UDP-ESP"
+ ):
+ packets = []
+ packets = super(SpdFlowCacheTemplate, cls).create_stream(
+ src_if, dst_if, pkt_count, src_prt, dst_prt, proto
+ )
+ return packets
+
+ def verify_capture(
+ self, src_if, dst_if, capture, tcp_port_in=1234, udp_port_in=5678
+ ):
+ super(SpdFlowCacheTemplate, self).verify_l3_l4_capture(
+ src_if, dst_if, capture, tcp_port_in, udp_port_in
+ )
+
+
+class SpdFastPathTemplate(IPSecIPv4Fwd):
+ @classmethod
+ def setUpConstants(cls):
+ super(SpdFastPathTemplate, cls).setUpConstants()
+ # Override this method with required cmdline parameters e.g.
+ # cls.vpp_cmdline.extend(["ipsec", "{",
+ # "ipv4-outbound-spd-flow-cache on",
+ # "}"])
+ # cls.logger.info("VPP modified cmdline is %s" % " "
+ # .join(cls.vpp_cmdline))
+
+ def setUp(self):
+ super(SpdFastPathTemplate, self).setUp()
+
+ def tearDown(self):
+ super(SpdFastPathTemplate, self).tearDown()
+
+ def create_stream(
+ cls, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678, proto="UDP-ESP"
+ ):
+ packets = []
+ packets = super(SpdFastPathTemplate, cls).create_stream(
+ src_if, dst_if, pkt_count, src_prt, dst_prt, proto
+ )
+ return packets
+
+ def verify_capture(
+ self, src_if, dst_if, capture, tcp_port_in=1234, udp_port_in=5678
+ ):
+ super(SpdFastPathTemplate, self).verify_l3_l4_capture(
+ src_if, dst_if, capture, tcp_port_in, udp_port_in
+ )
+
+
+class IpsecDefaultTemplate(IPSecIPv4Fwd):
+ @classmethod
+ def setUpConstants(cls):
+ super(IpsecDefaultTemplate, cls).setUpConstants()
+
+ def setUp(self):
+ super(IpsecDefaultTemplate, self).setUp()
+
+ def tearDown(self):
+ super(IpsecDefaultTemplate, self).tearDown()
+
+ def create_stream(
+ cls, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678, proto="UDP-ESP"
+ ):
+ packets = []
+ packets = super(IpsecDefaultTemplate, cls).create_stream(
+ src_if, dst_if, pkt_count, src_prt, dst_prt, proto
+ )
+ return packets
+
+ def verify_capture(
+ self, src_if, dst_if, capture, tcp_port_in=1234, udp_port_in=5678
+ ):
+ super(IpsecDefaultTemplate, self).verify_l3_l4_capture(
+ src_if, dst_if, capture, tcp_port_in, udp_port_in
+ )
+
+
+class IPSecIPv6Fwd(VppTestCase):
+ """Test IPSec by capturing and verifying IPv6 forwarded pkts"""
+
+ @classmethod
+ def setUpConstants(cls):
+ super(IPSecIPv6Fwd, cls).setUpConstants()
+
+ def setUp(self):
+ super(IPSecIPv6Fwd, self).setUp()
+ # store SPD objects so we can remove configs on tear down
+ self.spd_objs = []
+ self.spd_policies = []
+
+ def tearDown(self):
+ # remove SPD policies
+ for obj in self.spd_policies:
+ obj.remove_vpp_config()
+ self.spd_policies = []
+ # remove SPD items (interface bindings first, then SPD)
+ for obj in reversed(self.spd_objs):
+ obj.remove_vpp_config()
+ self.spd_objs = []
+ # close down pg intfs
+ for pg in self.pg_interfaces:
+ pg.unconfig_ip6()
+ pg.admin_down()
+ super(IPSecIPv6Fwd, self).tearDown()
+
+ def create_interfaces(self, num_ifs=2):
+ # create interfaces pg0 ... pg<num_ifs>
+ self.create_pg_interfaces(range(num_ifs))
+ for pg in self.pg_interfaces:
+ # put the interface up
+ pg.admin_up()
+ # configure IPv6 address on the interface
+ pg.config_ip6()
+ pg.resolve_ndp()
+ self.logger.info(self.vapi.ppcli("show int addr"))
+
+ def spd_create_and_intf_add(self, spd_id, pg_list):
+ spd = VppIpsecSpd(self, spd_id)
+ spd.add_vpp_config()
+ self.spd_objs.append(spd)
+ for pg in pg_list:
+ spdItf = VppIpsecSpdItfBinding(self, spd, pg)
+ spdItf.add_vpp_config()
+ self.spd_objs.append(spdItf)
+
+ def get_policy(self, policy_type):
+ e = VppEnum.vl_api_ipsec_spd_action_t
+ if policy_type == "protect":
+ return e.IPSEC_API_SPD_ACTION_PROTECT
+ elif policy_type == "bypass":
+ return e.IPSEC_API_SPD_ACTION_BYPASS
+ elif policy_type == "discard":
+ return e.IPSEC_API_SPD_ACTION_DISCARD
+ else:
+ raise Exception("Invalid policy type: %s", policy_type)
+
+ def spd_add_rem_policy(
+ self,
+ spd_id,
+ src_if,
+ dst_if,
+ proto,
+ is_out,
+ priority,
+ policy_type,
+ remove=False,
+ all_ips=False,
+ ip_range=False,
+ local_ip_start=ip_address("0::0"),
+ local_ip_stop=ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"),
+ remote_ip_start=ip_address("0::0"),
+ remote_ip_stop=ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"),
+ remote_port_start=0,
+ remote_port_stop=65535,
+ local_port_start=0,
+ local_port_stop=65535,
+ ):
+ spd = VppIpsecSpd(self, spd_id)
+
+ if all_ips:
+ src_range_low = ip_address("0::0")
+ src_range_high = ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")
+ dst_range_low = ip_address("0::0")
+ dst_range_high = ip_address("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")
+
+ elif ip_range:
+ src_range_low = local_ip_start
+ src_range_high = local_ip_stop
+ dst_range_low = remote_ip_start
+ dst_range_high = remote_ip_stop
+
+ else:
+ src_range_low = src_if.remote_ip6
+ src_range_high = src_if.remote_ip6
+ dst_range_low = dst_if.remote_ip6
+ dst_range_high = dst_if.remote_ip6
+
+ spdEntry = VppIpsecSpdEntry(
+ self,
+ spd,
+ 0,
+ src_range_low,
+ src_range_high,
+ dst_range_low,
+ dst_range_high,
+ proto,
+ priority=priority,
+ policy=self.get_policy(policy_type),
+ is_outbound=is_out,
+ remote_port_start=remote_port_start,
+ remote_port_stop=remote_port_stop,
+ local_port_start=local_port_start,
+ local_port_stop=local_port_stop,
+ )
+
+ if remove is False:
+ spdEntry.add_vpp_config()
+ self.spd_policies.append(spdEntry)
+ else:
+ spdEntry.remove_vpp_config()
+ self.spd_policies.remove(spdEntry)
+ self.logger.info(self.vapi.ppcli("show ipsec all"))
+ return spdEntry
+
+ def create_stream(self, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678):
+ packets = []
+ for i in range(pkt_count):
+ # create packet info stored in the test case instance
+ info = self.create_packet_info(src_if, dst_if)
+ # convert the info into packet payload
+ payload = self.info_to_payload(info)
+ # create the packet itself
+ p = (
+ Ether(dst=src_if.local_mac, src=src_if.remote_mac)
+ / IPv6(src=src_if.remote_ip6, dst=dst_if.remote_ip6)
+ / UDP(sport=src_prt, dport=dst_prt)
+ / Raw(payload)
+ )
+ # store a copy of the packet in the packet info
+ info.data = p.copy()
+ # append the packet to the list
+ packets.append(p)
+ # return the created packet list
+ return packets
+
+ def verify_capture(self, src_if, dst_if, capture):
+ packet_info = None
+ for packet in capture:
+ try:
+ ip = packet[IPv6]
+ udp = packet[UDP]
+ # convert the payload to packet info object
+ payload_info = self.payload_to_info(packet)
+ # make sure the indexes match
+ self.assert_equal(
+ payload_info.src, src_if.sw_if_index, "source sw_if_index"
+ )
+ self.assert_equal(
+ payload_info.dst, dst_if.sw_if_index, "destination sw_if_index"
+ )
+ packet_info = self.get_next_packet_info_for_interface2(
+ src_if.sw_if_index, dst_if.sw_if_index, packet_info
+ )
+ # make sure we didn't run out of saved packets
+ self.assertIsNotNone(packet_info)
+ self.assert_equal(
+ payload_info.index, packet_info.index, "packet info index"
+ )
+ saved_packet = packet_info.data # fetch the saved packet
+ # assert the values match
+ self.assert_equal(ip.src, saved_packet[IPv6].src, "IP source address")
+ # ... more assertions here
+ self.assert_equal(udp.sport, saved_packet[UDP].sport, "UDP source port")
+ except Exception as e:
+ self.logger.error(ppp("Unexpected or invalid packet:", packet))
+ raise
+ remaining_packet = self.get_next_packet_info_for_interface2(
+ src_if.sw_if_index, dst_if.sw_if_index, packet_info
+ )
+ self.assertIsNone(
+ remaining_packet,
+ "Interface %s: Packet expected from interface "
+ "%s didn't arrive" % (dst_if.name, src_if.name),
+ )
+
+ def verify_policy_match(self, pkt_count, spdEntry):
+ self.logger.info("XXXX %s %s", str(spdEntry), str(spdEntry.get_stats()))
+ matched_pkts = spdEntry.get_stats().get("packets")
+ self.logger.info("Policy %s matched: %d pkts", str(spdEntry), matched_pkts)
+ self.assert_equal(pkt_count, matched_pkts)