import socket
import unittest
from scapy.layers.ipsec import ESP
-from scapy.layers.inet import UDP
+from scapy.layers.inet import IP, ICMP, UDP
from parameterized import parameterized
from framework import VppTestRunner
class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests,
IpsecTun46Tests, IpsecTra6ExtTests):
""" Ipsec ESP - TUN & TRA tests """
- pass
+
+ @classmethod
+ def setUpClass(cls):
+ super(TestIpsecEsp1, cls).setUpClass()
+
+ @classmethod
+ def tearDownClass(cls):
+ super(TestIpsecEsp1, cls).tearDownClass()
+
+ def setUp(self):
+ super(TestIpsecEsp1, self).setUp()
+
+ def tearDown(self):
+ super(TestIpsecEsp1, self).tearDown()
+
+ def test_tun_46(self):
+ """ ipsec 4o6 tunnel """
+ # add an SPD entry to direct 2.2.2.2 to the v6 tunnel SA
+ p6 = self.ipv6_params
+ p4 = self.ipv4_params
+
+ p6.remote_tun_if_host4 = "2.2.2.2"
+ e = VppEnum.vl_api_ipsec_spd_action_t
+
+ VppIpsecSpdEntry(self,
+ self.tun_spd,
+ p6.scapy_tun_sa_id,
+ self.pg1.remote_addr[p4.addr_type],
+ self.pg1.remote_addr[p4.addr_type],
+ p6.remote_tun_if_host4,
+ p6.remote_tun_if_host4,
+ 0,
+ priority=10,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=1).add_vpp_config()
+ VppIpRoute(self, p6.remote_tun_if_host4, p4.addr_len,
+ [VppRoutePath(self.tun_if.remote_addr[p4.addr_type],
+ 0xffffffff)]).add_vpp_config()
+
+ old_name = self.tun6_encrypt_node_name
+ self.tun6_encrypt_node_name = "esp4-encrypt"
+
+ self.verify_tun_46(p6, count=63)
+ self.tun6_encrypt_node_name = old_name
+
+ def test_tun_64(self):
+ """ ipsec 6o4 tunnel """
+ # add an SPD entry to direct 4444::4 to the v4 tunnel SA
+ p6 = self.ipv6_params
+ p4 = self.ipv4_params
+
+ p4.remote_tun_if_host6 = "4444::4"
+ e = VppEnum.vl_api_ipsec_spd_action_t
+
+ VppIpsecSpdEntry(self,
+ self.tun_spd,
+ p4.scapy_tun_sa_id,
+ self.pg1.remote_addr[p6.addr_type],
+ self.pg1.remote_addr[p6.addr_type],
+ p4.remote_tun_if_host6,
+ p4.remote_tun_if_host6,
+ 0,
+ priority=10,
+ policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+ is_outbound=1).add_vpp_config()
+ d = DpoProto.DPO_PROTO_IP6
+ VppIpRoute(self, p4.remote_tun_if_host6, p6.addr_len,
+ [VppRoutePath(self.tun_if.remote_addr[p6.addr_type],
+ 0xffffffff,
+ proto=d)]).add_vpp_config()
+
+ old_name = self.tun4_encrypt_node_name
+ self.tun4_encrypt_node_name = "esp6-encrypt"
+ self.verify_tun_64(p4, count=63)
+ self.tun4_encrypt_node_name = old_name
class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
self.run_a_test(self.engine, self.flag, self.algo)
def run_a_test(self, engine, flag, algo, payload_size=None):
+ if engine == "ia32":
+ engine = "native"
self.vapi.cli("set crypto handler all %s" % engine)
self.ipv4_params = IPsecIPv4Params()
self.verify_tra_basic4(count=NUM_PKTS)
self.verify_tun_66(self.params[socket.AF_INET6],
count=NUM_PKTS)
+ #
+ # Use an odd-byte payload size to check for correct padding.
+ #
+ # 49 + 2 == 51 which should pad +1 to 52 for 4 byte alignment, +5
+ # to 56 for 8 byte alignment, and +13 to 64 for 64 byte alignment.
+ # This should catch bugs where the code is incorrectly over-padding
+ # for algorithms that don't require it
+ psz = 49 - len(IP()/ICMP()) if payload_size is None else payload_size
self.verify_tun_44(self.params[socket.AF_INET],
- count=NUM_PKTS)
+ count=NUM_PKTS, payload_size=psz)
LARGE_PKT_SZ = [
1970, # results in 2 chained buffers entering decrypt node
# but leaving as simple buffer due to ICV removal (tra4)
+ 2004, # footer+ICV will be added to 2nd buffer (tun4)
4010, # ICV ends up splitted accross 2 buffers in esp_decrypt
# for transport4; transport6 takes normal path
4020, # same as above but tra4 and tra6 are switched