- self.vapi.ipsec_sad_add_del_entry(scapy_tun_sa_id, scapy_tun_spi,
- auth_algo_vpp_id, auth_key,
- crypt_algo_vpp_id, crypt_key,
- self.vpp_ah_protocol,
- self.tun_if.local_addr_n[addr_type],
- self.tun_if.remote_addr_n[addr_type],
- is_tunnel=1, is_tunnel_ipv6=is_ipv6)
- self.vapi.ipsec_sad_add_del_entry(vpp_tun_sa_id, vpp_tun_spi,
- auth_algo_vpp_id, auth_key,
- crypt_algo_vpp_id, crypt_key,
- self.vpp_ah_protocol,
- self.tun_if.remote_addr_n[addr_type],
- self.tun_if.local_addr_n[addr_type],
- is_tunnel=1, is_tunnel_ipv6=is_ipv6)
- l_startaddr = r_startaddr = socket.inet_pton(addr_type, addr_any)
- l_stopaddr = r_stopaddr = socket.inet_pton(addr_type, addr_bcast)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, is_ipv6=is_ipv6,
- protocol=socket.IPPROTO_AH)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, is_outbound=0,
- is_ipv6=is_ipv6,
- protocol=socket.IPPROTO_AH)
- l_startaddr = l_stopaddr = socket.inet_pton(addr_type,
- remote_tun_if_host)
- r_startaddr = r_stopaddr = self.pg1.remote_addr_n[addr_type]
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, priority=10, policy=3,
- is_outbound=0, is_ipv6=is_ipv6)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id,
- r_startaddr, r_stopaddr, l_startaddr,
- l_stopaddr, priority=10, policy=3,
- is_ipv6=is_ipv6)
- r_startaddr = r_stopaddr = self.pg0.local_addr_n[addr_type]
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, priority=20, policy=3,
- is_outbound=0, is_ipv6=is_ipv6)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id,
- r_startaddr, r_stopaddr, l_startaddr,
- l_stopaddr, priority=20, policy=3,
- is_ipv6=is_ipv6)
-
- def unconfig_ah_tun(self, params):
- addr_type = params.addr_type
- is_ipv6 = params.is_ipv6
- scapy_tun_sa_id = params.scapy_tun_sa_id
- scapy_tun_spi = params.scapy_tun_spi
- vpp_tun_sa_id = params.vpp_tun_sa_id
- vpp_tun_spi = params.vpp_tun_spi
- auth_algo_vpp_id = params.auth_algo_vpp_id
- auth_key = params.auth_key
- crypt_algo_vpp_id = params.crypt_algo_vpp_id
- crypt_key = params.crypt_key
- remote_tun_if_host = params.remote_tun_if_host
- addr_any = params.addr_any
- addr_bcast = params.addr_bcast
- l_startaddr = l_stopaddr = socket.inet_pton(addr_type,
- remote_tun_if_host)
- r_startaddr = r_stopaddr = self.pg0.local_addr_n[addr_type]
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, priority=20, policy=3,
- is_outbound=0, is_ipv6=is_ipv6,
- is_add=0)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id,
- r_startaddr, r_stopaddr, l_startaddr,
- l_stopaddr, priority=20, policy=3,
- is_ipv6=is_ipv6,
- is_add=0)
- r_startaddr = r_stopaddr = self.pg1.remote_addr_n[addr_type]
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, priority=10, policy=3,
- is_outbound=0, is_ipv6=is_ipv6,
- is_add=0)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id,
- r_startaddr, r_stopaddr, l_startaddr,
- l_stopaddr, priority=10, policy=3,
- is_ipv6=is_ipv6, is_add=0)
- l_startaddr = r_startaddr = socket.inet_pton(addr_type, addr_any)
- l_stopaddr = r_stopaddr = socket.inet_pton(addr_type, addr_bcast)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, is_ipv6=is_ipv6,
- protocol=socket.IPPROTO_AH,
- is_add=0)
- self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id,
- l_startaddr, l_stopaddr, r_startaddr,
- r_stopaddr, is_outbound=0,
- is_ipv6=is_ipv6,
- protocol=socket.IPPROTO_AH,
- is_add=0)
- self.vapi.ipsec_sad_add_del_entry(scapy_tun_sa_id, scapy_tun_spi,
- auth_algo_vpp_id, auth_key,
- crypt_algo_vpp_id, crypt_key,
- self.vpp_ah_protocol,
- self.tun_if.local_addr_n[addr_type],
- self.tun_if.remote_addr_n[addr_type],
- is_tunnel=1, is_tunnel_ipv6=is_ipv6,
- is_add=0)
- self.vapi.ipsec_sad_add_del_entry(vpp_tun_sa_id, vpp_tun_spi,
- auth_algo_vpp_id, auth_key,
- crypt_algo_vpp_id, crypt_key,
- self.vpp_ah_protocol,
- self.tun_if.remote_addr_n[addr_type],
- self.tun_if.local_addr_n[addr_type],
- is_tunnel=1, is_tunnel_ipv6=is_ipv6,
- is_add=0)
+ flags = params.flags
+ e = VppEnum.vl_api_ipsec_spd_action_t
+ objs = []
+
+ params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi,
+ auth_algo_vpp_id, auth_key,
+ crypt_algo_vpp_id, crypt_key,
+ self.vpp_ah_protocol,
+ self.tun_if.local_addr[addr_type],
+ self.tun_if.remote_addr[addr_type],
+ flags=flags)
+
+ params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi,
+ auth_algo_vpp_id, auth_key,
+ crypt_algo_vpp_id, crypt_key,
+ self.vpp_ah_protocol,
+ self.tun_if.remote_addr[addr_type],
+ self.tun_if.local_addr[addr_type],
+ flags=flags)
+
+ objs.append(params.tun_sa_in)
+ objs.append(params.tun_sa_out)
+
+ params.spd_policy_in_any = VppIpsecSpdEntry(self, self.tun_spd,
+ vpp_tun_sa_id,
+ addr_any, addr_bcast,
+ addr_any, addr_bcast,
+ socket.IPPROTO_AH)
+ params.spd_policy_out_any = VppIpsecSpdEntry(self, self.tun_spd,
+ vpp_tun_sa_id,
+ addr_any, addr_bcast,
+ addr_any, addr_bcast,
+ socket.IPPROTO_AH,
+ is_outbound=0)
+
+ objs.append(params.spd_policy_out_any)
+ objs.append(params.spd_policy_in_any)
+
+ e1 = VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
+ remote_tun_if_host,
+ remote_tun_if_host,
+ self.pg1.remote_addr[addr_type],
+ self.pg1.remote_addr[addr_type],
+ 0, priority=10,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=0)
+ e2 = VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
+ self.pg1.remote_addr[addr_type],
+ self.pg1.remote_addr[addr_type],
+ remote_tun_if_host,
+ remote_tun_if_host,
+ 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ priority=10)
+ e3 = VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
+ remote_tun_if_host,
+ remote_tun_if_host,
+ self.pg0.local_addr[addr_type],
+ self.pg0.local_addr[addr_type],
+ 0, priority=20,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=0)
+ e4 = VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
+ self.pg0.local_addr[addr_type],
+ self.pg0.local_addr[addr_type],
+ remote_tun_if_host,
+ remote_tun_if_host,
+ 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ priority=20)
+
+ objs = objs + [e1, e2, e3, e4]
+
+ for o in objs:
+ o.add_vpp_config()
+
+ self.net_objs = self.net_objs + objs