+ VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
+ remote_tun_if_host,
+ remote_tun_if_host,
+ self.pg1.remote_addr[addr_type],
+ self.pg1.remote_addr[addr_type],
+ 0, priority=10,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=0).add_vpp_config()
+ VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
+ self.pg1.remote_addr[addr_type],
+ self.pg1.remote_addr[addr_type],
+ remote_tun_if_host,
+ remote_tun_if_host,
+ 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ priority=10).add_vpp_config()
+
+ VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
+ remote_tun_if_host,
+ remote_tun_if_host,
+ self.pg0.local_addr[addr_type],
+ self.pg0.local_addr[addr_type],
+ 0, priority=20,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=0).add_vpp_config()
+ VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
+ self.pg0.local_addr[addr_type],
+ self.pg0.local_addr[addr_type],
+ remote_tun_if_host,
+ remote_tun_if_host,
+ 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ priority=20).add_vpp_config()
+
+ def config_ah_tra(self, params):
+ addr_type = params.addr_type
+ scapy_tra_sa_id = params.scapy_tra_sa_id
+ scapy_tra_spi = params.scapy_tra_spi
+ vpp_tra_sa_id = params.vpp_tra_sa_id
+ vpp_tra_spi = params.vpp_tra_spi
+ auth_algo_vpp_id = params.auth_algo_vpp_id
+ auth_key = params.auth_key
+ crypt_algo_vpp_id = params.crypt_algo_vpp_id
+ crypt_key = params.crypt_key
+ addr_any = params.addr_any
+ addr_bcast = params.addr_bcast
+ flags = params.flags | (VppEnum.vl_api_ipsec_sad_flags_t.
+ IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
+ e = VppEnum.vl_api_ipsec_spd_action_t
+
+ params.tra_sa_in = VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi,
+ auth_algo_vpp_id, auth_key,
+ crypt_algo_vpp_id, crypt_key,
+ self.vpp_ah_protocol,
+ flags=flags)
+ params.tra_sa_in.add_vpp_config()
+ params.tra_sa_out = VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi,
+ auth_algo_vpp_id, auth_key,
+ crypt_algo_vpp_id, crypt_key,
+ self.vpp_ah_protocol,
+ flags=flags)
+ params.tra_sa_out.add_vpp_config()
+
+ VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
+ addr_any, addr_bcast,
+ addr_any, addr_bcast,
+ socket.IPPROTO_AH).add_vpp_config()
+ VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
+ addr_any, addr_bcast,
+ addr_any, addr_bcast,
+ socket.IPPROTO_AH,
+ is_outbound=0).add_vpp_config()
+
+ VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
+ self.tra_if.local_addr[addr_type],
+ self.tra_if.local_addr[addr_type],
+ self.tra_if.remote_addr[addr_type],
+ self.tra_if.remote_addr[addr_type],
+ 0, priority=10,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=0).add_vpp_config()
+ VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
+ self.tra_if.local_addr[addr_type],
+ self.tra_if.local_addr[addr_type],
+ self.tra_if.remote_addr[addr_type],
+ self.tra_if.remote_addr[addr_type],
+ 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ priority=10).add_vpp_config()
+
+
+class TestIpsecAh1(TemplateIpsecAh, IpsecTcpTests):
+ """ Ipsec AH - TCP tests """
+ pass
+
+
+class TestIpsecAh2(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests):
+ """ Ipsec AH w/ SHA1 """
+ tra4_encrypt_node_name = "ah4-encrypt"
+ tra4_decrypt_node_name = "ah4-decrypt"
+ tra6_encrypt_node_name = "ah6-encrypt"
+ tra6_decrypt_node_name = "ah6-decrypt"
+ tun4_encrypt_node_name = "ah4-encrypt"
+ tun4_decrypt_node_name = "ah4-decrypt"
+ tun6_encrypt_node_name = "ah6-encrypt"
+ tun6_decrypt_node_name = "ah6-decrypt"
+
+
+class TestIpsecAh3(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests):
+ """ Ipsec AH w/ SHA1 & ESN """
+
+ tra4_encrypt_node_name = "ah4-encrypt"
+ tra4_decrypt_node_name = "ah4-decrypt"
+ tra6_encrypt_node_name = "ah6-encrypt"
+ tra6_decrypt_node_name = "ah6-decrypt"
+ tun4_encrypt_node_name = "ah4-encrypt"
+ tun4_decrypt_node_name = "ah4-decrypt"
+ tun6_encrypt_node_name = "ah6-encrypt"
+ tun6_decrypt_node_name = "ah6-decrypt"
+
+ def setup_params(self):
+ self.ipv4_params = IPsecIPv4Params()
+ self.ipv6_params = IPsecIPv6Params()
+ self.params = {self.ipv4_params.addr_type: self.ipv4_params,
+ self.ipv6_params.addr_type: self.ipv6_params}
+ for _, p in self.params.items():
+ p.flags = (VppEnum.vl_api_ipsec_sad_flags_t.
+ IPSEC_API_SAD_FLAG_USE_ESN)
+
+
+class TestIpsecAh4(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests):
+ """ Ipsec AH w/ SHA256 """
+
+ tra4_encrypt_node_name = "ah4-encrypt"
+ tra4_decrypt_node_name = "ah4-decrypt"
+ tra6_encrypt_node_name = "ah6-encrypt"
+ tra6_decrypt_node_name = "ah6-decrypt"
+ tun4_encrypt_node_name = "ah4-encrypt"
+ tun4_decrypt_node_name = "ah4-decrypt"
+ tun6_encrypt_node_name = "ah6-encrypt"
+ tun6_decrypt_node_name = "ah6-decrypt"
+
+ def setup_params(self):
+ self.ipv4_params = IPsecIPv4Params()
+ self.ipv6_params = IPsecIPv6Params()
+ self.ipv4_params.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
+ IPSEC_API_INTEG_ALG_SHA_256_128)
+ self.ipv4_params.auth_algo = 'SHA2-256-128' # scapy name
+ self.ipv6_params.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
+ IPSEC_API_INTEG_ALG_SHA_256_128)
+ self.ipv6_params.auth_algo = 'SHA2-256-128' # scapy name
+
+ self.params = {self.ipv4_params.addr_type: self.ipv4_params,
+ self.ipv6_params.addr_type: self.ipv6_params}
+
+
+class TestIpsecAh5(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests):
+ """ Ipsec AH w/ SHA384 """
+
+ tra4_encrypt_node_name = "ah4-encrypt"
+ tra4_decrypt_node_name = "ah4-decrypt"
+ tra6_encrypt_node_name = "ah6-encrypt"
+ tra6_decrypt_node_name = "ah6-decrypt"
+ tun4_encrypt_node_name = "ah4-encrypt"
+ tun4_decrypt_node_name = "ah4-decrypt"
+ tun6_encrypt_node_name = "ah6-encrypt"
+ tun6_decrypt_node_name = "ah6-decrypt"
+
+ def setup_params(self):
+ self.ipv4_params = IPsecIPv4Params()
+ self.ipv6_params = IPsecIPv6Params()
+ self.ipv4_params.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
+ IPSEC_API_INTEG_ALG_SHA_384_192)
+ self.ipv4_params.auth_algo = 'SHA2-384-192' # scapy name
+ self.ipv6_params.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
+ IPSEC_API_INTEG_ALG_SHA_384_192)
+ self.ipv6_params.auth_algo = 'SHA2-384-192' # scapy name
+
+ self.params = {self.ipv4_params.addr_type: self.ipv4_params,
+ self.ipv6_params.addr_type: self.ipv6_params}
+
+
+class TestIpsecAh6(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests):
+ """ Ipsec AH w/ SHA512 """
+
+ tra4_encrypt_node_name = "ah4-encrypt"
+ tra4_decrypt_node_name = "ah4-decrypt"
+ tra6_encrypt_node_name = "ah6-encrypt"
+ tra6_decrypt_node_name = "ah6-decrypt"
+ tun4_encrypt_node_name = "ah4-encrypt"
+ tun4_decrypt_node_name = "ah4-decrypt"
+ tun6_encrypt_node_name = "ah6-encrypt"
+ tun6_decrypt_node_name = "ah6-decrypt"
+
+ def setup_params(self):
+ self.ipv4_params = IPsecIPv4Params()
+ self.ipv6_params = IPsecIPv6Params()
+ self.ipv4_params.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
+ IPSEC_API_INTEG_ALG_SHA_512_256)
+ self.ipv4_params.auth_algo = 'SHA2-512-256' # scapy name
+ self.ipv6_params.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
+ IPSEC_API_INTEG_ALG_SHA_512_256)
+ self.ipv6_params.auth_algo = 'SHA2-512-256' # scapy name
+
+ self.params = {self.ipv4_params.addr_type: self.ipv4_params,
+ self.ipv6_params.addr_type: self.ipv6_params}