feat(api): Use newest API messages after rls2402

[csit.git] / resources / libraries / python / IPsecUtil.py

diff --git a/resources/libraries/python/IPsecUtil.py b/resources/libraries/python/IPsecUtil.py
index 873b6af..214764d 100644 (file)
--- a/resources/libraries/python/IPsecUtil.py
+++ b/resources/libraries/python/IPsecUtil.py
@@ -1,5 +1,5 @@
-# Copyright (c) 2023 Cisco and/or its affiliates.
-# Copyright (c) 2023 PANTHEON.tech s.r.o.
+# Copyright (c) 2024 Cisco and/or its affiliates.
+# Copyright (c) 2024 PANTHEON.tech s.r.o.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at:
@@ -14,8 +14,6 @@
 
 """IPsec utilities library."""
 
-import os
-
 from enum import Enum, IntEnum
 from io import open
 from ipaddress import ip_network, ip_address
@@ -38,7 +36,8 @@ from resources.libraries.python.VPPUtil import VPPUtil
 from resources.libraries.python.FlowUtil import FlowUtil
 
 
-IPSEC_UDP_PORT_NONE = 0xffff
+IPSEC_UDP_PORT_DEFAULT = 4500
+IPSEC_REPLAY_WINDOW_DEFAULT = 64
 
 
 def gen_key(length):
@@ -452,7 +451,7 @@ class IPsecUtil:
             src_addr = u""
             dst_addr = u""
 
-        cmd = u"ipsec_sad_entry_add"
+        cmd = u"ipsec_sad_entry_add_v2"
         err_msg = f"Failed to add Security Association Database entry " \
             f"on host {node[u'host']}"
         sad_entry = dict(
@@ -473,8 +472,9 @@ class IPsecUtil:
                 dscp=int(IpDscp.IP_API_DSCP_CS0),
             ),
             protocol=int(IPsecProto.IPSEC_API_PROTO_ESP),
-            udp_src_port=4500,  # default value in api
-            udp_dst_port=4500  # default value in api
+            udp_src_port=IPSEC_UDP_PORT_DEFAULT,
+            udp_dst_port=IPSEC_UDP_PORT_DEFAULT,
+            anti_replay_window_size=IPSEC_REPLAY_WINDOW_DEFAULT,
         )
         args = dict(entry=sad_entry)
         with PapiSocketExecutor(node) as papi_exec:
@@ -483,7 +483,7 @@ class IPsecUtil:
     @staticmethod
     def vpp_ipsec_add_sad_entries(
             node, n_entries, sad_id, spi, crypto_alg, crypto_key,
-            integ_alg=None, integ_key=u"", tunnel_src=None,tunnel_dst=None,
+            integ_alg=None, integ_key=u"", tunnel_src=None, tunnel_dst=None,
             tunnel_addr_incr=True):
         """Create multiple Security Association Database entries on VPP node.
 
@@ -549,7 +549,7 @@ class IPsecUtil:
                     IPsecSadFlags.IPSEC_API_SAD_FLAG_IS_TUNNEL_V6
                 )
 
-        cmd = u"ipsec_sad_entry_add"
+        cmd = u"ipsec_sad_entry_add_v2"
         err_msg = f"Failed to add Security Association Database entry " \
             f"on host {node[u'host']}"
 
@@ -571,8 +571,9 @@ class IPsecUtil:
                 dscp=int(IpDscp.IP_API_DSCP_CS0),
             ),
             protocol=int(IPsecProto.IPSEC_API_PROTO_ESP),
-            udp_src_port=4500,  # default value in api
-            udp_dst_port=4500,  # default value in api
+            udp_src_port=IPSEC_UDP_PORT_DEFAULT,
+            udp_dst_port=IPSEC_UDP_PORT_DEFAULT,
+            anti_replay_window_size=IPSEC_REPLAY_WINDOW_DEFAULT,
         )
         args = dict(entry=sad_entry)
         with PapiSocketExecutor(node, is_async=True) as papi_exec:
@@ -1229,7 +1230,7 @@ class IPsecUtil:
             # Configure IPSec SAD entries
             ckeys = [bytes()] * existing_tunnels
             ikeys = [bytes()] * existing_tunnels
-            cmd = u"ipsec_sad_entry_add"
+            cmd = u"ipsec_sad_entry_add_v2"
             c_key = dict(
                 length=0,
                 data=None
@@ -1257,8 +1258,9 @@ class IPsecUtil:
                     dscp=int(IpDscp.IP_API_DSCP_CS0),
                 ),
                 salt=0,
-                udp_src_port=IPSEC_UDP_PORT_NONE,
-                udp_dst_port=IPSEC_UDP_PORT_NONE,
+                udp_src_port=IPSEC_UDP_PORT_DEFAULT,
+                udp_dst_port=IPSEC_UDP_PORT_DEFAULT,
+                anti_replay_window_size=IPSEC_REPLAY_WINDOW_DEFAULT,
             )
             args = dict(entry=sad_entry)
             for i in range(existing_tunnels, n_tunnels):
@@ -1468,7 +1470,7 @@ class IPsecUtil:
                 ]
             )
             # Configure IPSec SAD entries
-            cmd = u"ipsec_sad_entry_add"
+            cmd = u"ipsec_sad_entry_add_v2"
             c_key = dict(
                 length=0,
                 data=None
@@ -1496,8 +1498,9 @@ class IPsecUtil:
                     dscp=int(IpDscp.IP_API_DSCP_CS0),
                 ),
                 salt=0,
-                udp_src_port=IPSEC_UDP_PORT_NONE,
-                udp_dst_port=IPSEC_UDP_PORT_NONE,
+                udp_src_port=IPSEC_UDP_PORT_DEFAULT,
+                udp_dst_port=IPSEC_UDP_PORT_DEFAULT,
+                anti_replay_window_size=IPSEC_REPLAY_WINDOW_DEFAULT,
             )
             args = dict(entry=sad_entry)
             for i in range(existing_tunnels, n_tunnels):
@@ -1925,10 +1928,10 @@ class IPsecUtil:
         for i in range(n_tunnels//(addr_incr**2)+1):
             dut1_local_outbound_range = \
                 ip_network(f"{ip_address(tunnel_ip1) + i*(addr_incr**3)}/8",
-                False).with_prefixlen
+                           False).with_prefixlen
             dut1_remote_outbound_range = \
                 ip_network(f"{ip_address(tunnel_ip2) + i*(addr_incr**3)}/8",
-                False).with_prefixlen
+                           False).with_prefixlen
 
             IPsecUtil.vpp_ipsec_add_spd_entry(
                 nodes[u"DUT1"], spd_id, p_hi, PolicyAction.BYPASS, inbound=False,
@@ -1975,19 +1978,21 @@ class IPsecUtil:
             for i in range(n_tunnels//(addr_incr**2)+1):
                 dut2_local_outbound_range = \
                     ip_network(f"{ip_address(tunnel_ip1) + i*(addr_incr**3)}/8",
-                    False).with_prefixlen
+                               False).with_prefixlen
                 dut2_remote_outbound_range = \
                     ip_network(f"{ip_address(tunnel_ip2) + i*(addr_incr**3)}/8",
-                    False).with_prefixlen
+                               False).with_prefixlen
 
                 IPsecUtil.vpp_ipsec_add_spd_entry(
                     nodes[u"DUT2"], spd_id, p_hi, PolicyAction.BYPASS,
-                    inbound=False, proto=50, laddr_range=dut2_remote_outbound_range,
+                    inbound=False, proto=50,
+                    laddr_range=dut2_remote_outbound_range,
                     raddr_range=dut2_local_outbound_range
                 )
                 IPsecUtil.vpp_ipsec_add_spd_entry(
                     nodes[u"DUT2"], spd_id, p_hi, PolicyAction.BYPASS,
-                    inbound=True, proto=50, laddr_range=dut2_local_outbound_range,
+                    inbound=True, proto=50,
+                    laddr_range=dut2_local_outbound_range,
                     raddr_range=dut2_remote_outbound_range
                 )
 
@@ -2033,10 +2038,8 @@ class IPsecUtil:
         :param node: DUT node.
         :type node: dict
         """
-        cmds = [
-            u"ipsec_sa_v3_dump"
-        ]
-        PapiSocketExecutor.dump_and_log(node, cmds)
+        cmd = "ipsec_sa_v5_dump"
+        PapiSocketExecutor.dump_and_log(node, [cmd])
 
     @staticmethod
     def vpp_ipsec_flow_enale_rss(node, proto, type, function="default"):
@@ -2082,8 +2085,7 @@ class IPsecUtil:
 
         for i in range(0, n_flows):
             rx_queue = i%rx_queues
-
             spi = spi_start + i
             flow_index = FlowUtil.vpp_create_ip4_ipsec_flow(
-                    node, "ESP", spi, "redirect-to-queue", value=rx_queue)
+                node, "ESP", spi, "redirect-to-queue", value=rx_queue)
             FlowUtil.vpp_flow_enable(node, interface, flow_index)