+
+ @classmethod
+ def setUpClass(cls):
+ super(TestIpsecEsp1, cls).setUpClass()
+
+ @classmethod
+ def tearDownClass(cls):
+ super(TestIpsecEsp1, cls).tearDownClass()
+
+ def setUp(self):
+ super(TestIpsecEsp1, self).setUp()
+
+ def tearDown(self):
+ super(TestIpsecEsp1, self).tearDown()
+
+ def test_tun_46(self):
+ """ ipsec 4o6 tunnel """
+ # add an SPD entry to direct 2.2.2.2 to the v6 tunnel SA
+ p6 = self.ipv6_params
+ p4 = self.ipv4_params
+
+ p6.remote_tun_if_host4 = "2.2.2.2"
+ e = VppEnum.vl_api_ipsec_spd_action_t
+
+ VppIpsecSpdEntry(self,
+ self.tun_spd,
+ p6.scapy_tun_sa_id,
+ self.pg1.remote_addr[p4.addr_type],
+ self.pg1.remote_addr[p4.addr_type],
+ p6.remote_tun_if_host4,
+ p6.remote_tun_if_host4,
+ 0,
+ priority=10,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=1).add_vpp_config()
+ VppIpRoute(self, p6.remote_tun_if_host4, p4.addr_len,
+ [VppRoutePath(self.tun_if.remote_addr[p4.addr_type],
+ 0xffffffff)]).add_vpp_config()
+
+ old_name = self.tun6_encrypt_node_name
+ self.tun6_encrypt_node_name = "esp4-encrypt"
+
+ self.verify_tun_46(p6, count=63)
+ self.tun6_encrypt_node_name = old_name
+
+ def test_tun_64(self):
+ """ ipsec 6o4 tunnel """
+ # add an SPD entry to direct 4444::4 to the v4 tunnel SA
+ p6 = self.ipv6_params
+ p4 = self.ipv4_params
+
+ p4.remote_tun_if_host6 = "4444::4"
+ e = VppEnum.vl_api_ipsec_spd_action_t
+
+ VppIpsecSpdEntry(self,
+ self.tun_spd,
+ p4.scapy_tun_sa_id,
+ self.pg1.remote_addr[p6.addr_type],
+ self.pg1.remote_addr[p6.addr_type],
+ p4.remote_tun_if_host6,
+ p4.remote_tun_if_host6,
+ 0,
+ priority=10,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=1).add_vpp_config()
+ d = DpoProto.DPO_PROTO_IP6
+ VppIpRoute(self, p4.remote_tun_if_host6, p6.addr_len,
+ [VppRoutePath(self.tun_if.remote_addr[p6.addr_type],
+ 0xffffffff,
+ proto=d)]).add_vpp_config()
+
+ old_name = self.tun4_encrypt_node_name
+ self.tun4_encrypt_node_name = "esp6-encrypt"
+ self.verify_tun_64(p4, count=63)
+ self.tun4_encrypt_node_name = old_name
+
+
+class TestIpsecEspTun(TemplateIpsecEsp, IpsecTun46Tests):
+ """ Ipsec ESP - TUN encap tests """
+
+ def setUp(self):
+ self.ipv4_params = IPsecIPv4Params()
+ self.ipv6_params = IPsecIPv6Params()
+
+ c = (VppEnum.vl_api_tunnel_encap_decap_flags_t.
+ TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
+ c1 = c | (VppEnum.vl_api_tunnel_encap_decap_flags_t.
+ TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
+
+ self.ipv4_params.tun_flags = c
+ self.ipv6_params.tun_flags = c1
+
+ super(TestIpsecEspTun, self).setUp()
+
+ def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
+ # set the DSCP + ECN - flags are set to copy only DSCP
+ return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
+ IP(src=src, dst=dst, tos=5) /
+ UDP(sport=4444, dport=4444) /
+ Raw(b'X' * payload_size)
+ for i in range(count)]
+
+ def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54):
+ # set the DSCP + ECN - flags are set to copy both
+ return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
+ IPv6(src=src, dst=dst, tc=5) /
+ UDP(sport=4444, dport=4444) /
+ Raw(b'X' * payload_size)
+ for i in range(count)]
+
+ def verify_encrypted(self, p, sa, rxs):
+ # just check that only the DSCP is copied
+ for rx in rxs:
+ self.assertEqual(rx[IP].tos, 4)
+
+ def verify_encrypted6(self, p, sa, rxs):
+ # just check that the DSCP & ECN are copied
+ for rx in rxs:
+ self.assertEqual(rx[IPv6].tc, 5)
+
+
+class TestIpsecEspTun2(TemplateIpsecEsp, IpsecTun46Tests):
+ """ Ipsec ESP - TUN DSCP tests """
+
+ def setUp(self):
+ self.ipv4_params = IPsecIPv4Params()
+ self.ipv6_params = IPsecIPv6Params()
+
+ self.ipv4_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF
+ self.ipv6_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11
+
+ super(TestIpsecEspTun2, self).setUp()
+
+ def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
+ return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
+ IP(src=src, dst=dst) /
+ UDP(sport=4444, dport=4444) /
+ Raw(b'X' * payload_size)
+ for i in range(count)]
+
+ def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54):
+ return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
+ IPv6(src=src, dst=dst) /
+ UDP(sport=4444, dport=4444) /
+ Raw(b'X' * payload_size)
+ for i in range(count)]
+
+ def verify_encrypted(self, p, sa, rxs):
+ # just check that only the DSCP is set
+ for rx in rxs:
+ self.assertEqual(rx[IP].tos,
+ VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF << 2)
+
+ def verify_encrypted6(self, p, sa, rxs):
+ # just check that the DSCP is set
+ for rx in rxs:
+ self.assertEqual(rx[IPv6].tc,
+ VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11 << 2)