from framework import VppTestRunner
from template_ipsec import IpsecTra46Tests, IpsecTun46Tests, TemplateIpsec, \
IpsecTcpTests, IpsecTun4Tests, IpsecTra4Tests, config_tra_params, \
- IPsecIPv4Params, IPsecIPv6Params, \
- IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6
+ config_tun_params, IPsecIPv4Params, IPsecIPv6Params, \
+ IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6, \
+ IpsecTun6HandoffTests, IpsecTun4HandoffTests, \
+ IpsecTra6ExtTests
from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSA,\
VppIpsecSpdItfBinding
from vpp_ip_route import VppIpRoute, VppRoutePath
from vpp_papi import VppEnum
NUM_PKTS = 67
+engines_supporting_chain_bufs = ["openssl"]
class ConfigIpsecESP(TemplateIpsec):
config_tra_params(p, self.encryption_type)
for p in params:
self.config_esp_tun(p)
+ config_tun_params(p, self.encryption_type, self.tun_if)
for p in params:
d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4
super(TemplateIpsecEsp, self).tearDown()
-class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests, IpsecTun46Tests):
+class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests,
+ IpsecTun46Tests, IpsecTra6ExtTests):
""" Ipsec ESP - TUN & TRA tests """
pass
pass
+class TestIpsecEspHandoff(TemplateIpsecEsp,
+ IpsecTun6HandoffTests,
+ IpsecTun4HandoffTests):
+ """ Ipsec ESP - handoff tests """
+ pass
+
+
class TemplateIpsecEspUdp(ConfigIpsecESP):
"""
UDP encapped ESP
IPSEC_API_INTEG_ALG_NONE),
'scapy-crypto': "AES-GCM",
'scapy-integ': "NULL",
- 'key': "JPjyOWBeVEQiMe7h",
+ 'key': b"JPjyOWBeVEQiMe7h",
'salt': 0},
'AES-GCM-192/NONE': {
'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
IPSEC_API_INTEG_ALG_NONE),
'scapy-crypto': "AES-GCM",
'scapy-integ': "NULL",
- 'key': "JPjyOWBeVEQiMe7h01234567",
+ 'key': b"JPjyOWBeVEQiMe7h01234567",
'salt': 1010},
'AES-GCM-256/NONE': {
'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
IPSEC_API_INTEG_ALG_NONE),
'scapy-crypto': "AES-GCM",
'scapy-integ': "NULL",
- 'key': "JPjyOWBeVEQiMe7h0123456787654321",
+ 'key': b"JPjyOWBeVEQiMe7h0123456787654321",
'salt': 2020},
'AES-CBC-128/MD5-96': {
'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
'scapy-crypto': "AES-CBC",
'scapy-integ': "HMAC-MD5-96",
'salt': 0,
- 'key': "JPjyOWBeVEQiMe7h"},
+ 'key': b"JPjyOWBeVEQiMe7h"},
'AES-CBC-192/SHA1-96': {
'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
IPSEC_API_CRYPTO_ALG_AES_CBC_192),
'scapy-crypto': "AES-CBC",
'scapy-integ': "HMAC-SHA1-96",
'salt': 0,
- 'key': "JPjyOWBeVEQiMe7hJPjyOWBe"},
+ 'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"},
'AES-CBC-256/SHA1-96': {
'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
IPSEC_API_CRYPTO_ALG_AES_CBC_256),
'scapy-crypto': "AES-CBC",
'scapy-integ': "HMAC-SHA1-96",
'salt': 0,
- 'key': "JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"},
+ 'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"},
'3DES-CBC/SHA1-96': {
'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
IPSEC_API_CRYPTO_ALG_3DES_CBC),
'scapy-crypto': "3DES",
'scapy-integ': "HMAC-SHA1-96",
'salt': 0,
- 'key': "JPjyOWBeVEQiMe7h00112233"},
+ 'key': b"JPjyOWBeVEQiMe7h00112233"},
'NONE/SHA1-96': {
'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
IPSEC_API_CRYPTO_ALG_NONE),
'scapy-crypto': "NULL",
'scapy-integ': "HMAC-SHA1-96",
'salt': 0,
- 'key': "JPjyOWBeVEQiMe7h00112233"}}
+ 'key': b"JPjyOWBeVEQiMe7h00112233"}}
class RunTestIpsecEspAll(ConfigIpsecESP,
def run_test(self):
self.run_a_test(self.engine, self.flag, self.algo)
- def run_a_test(self, engine, flag, algo):
+ def run_a_test(self, engine, flag, algo, payload_size=None):
self.vapi.cli("set crypto handler all %s" % engine)
self.ipv4_params = IPsecIPv4Params()
self.verify_tun_44(self.params[socket.AF_INET],
count=NUM_PKTS)
+ LARGE_PKT_SZ = [
+ 4010, # ICV ends up splitted accross 2 buffers in esp_decrypt
+ # for transport4; transport6 takes normal path
+
+ 4020, # same as above but tra4 and tra6 are switched
+ ]
+ if self.engine in engines_supporting_chain_bufs:
+ for sz in LARGE_PKT_SZ:
+ self.verify_tra_basic4(count=NUM_PKTS, payload_size=sz)
+ self.verify_tra_basic6(count=NUM_PKTS, payload_size=sz)
+ self.verify_tun_66(self.params[socket.AF_INET6],
+ count=NUM_PKTS, payload_size=sz)
+ self.verify_tun_44(self.params[socket.AF_INET],
+ count=NUM_PKTS, payload_size=sz)
+
#
# remove the SPDs, SAs, etc
#