X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=resources%2Flibraries%2Frobot%2Fcrypto%2Fipsec.robot;h=dc1265f43462080cc01d6c9893a9f0ee8b7101e5;hb=f0e964d35af36f0923c6ae0421e74d94022cadba;hp=a37c18db7729d2cf4e1faa04d8bc361db9acaaa0;hpb=a4cad14b7e0b7e94f9e80b1a45cd86b3bc09d0a0;p=csit.git diff --git a/resources/libraries/robot/crypto/ipsec.robot b/resources/libraries/robot/crypto/ipsec.robot index a37c18db77..dc1265f434 100644 --- a/resources/libraries/robot/crypto/ipsec.robot +++ b/resources/libraries/robot/crypto/ipsec.robot @@ -1,4 +1,4 @@ -# Copyright (c) 2019 Cisco and/or its affiliates. +# Copyright (c) 2021 Cisco and/or its affiliates. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: @@ -17,28 +17,28 @@ | Library | resources.libraries.python.IPsecUtil | Library | resources.libraries.python.IPUtil | Library | resources.libraries.python.IPv6Util -| ... +| | Documentation | IPsec keywords. *** Keywords *** | Generate keys for IPSec | | [Documentation] | Generate keys for IPsec. -| | ... +| | | | ... | *Arguments:* | | ... | - crypto_alg - Encryption algorithm. Type: enum | | ... | - integ_alg - Integrity algorithm. Type: enum -| | ... +| | | | ... | _NOTE:_ This KW sets following test case variable: | | ... | - encr_key - Encryption key. Type: string | | ... | - auth_key - Integrity key. Type: string -| | ... +| | | | ... | *Example:* | | ... | \| ${encr_alg}= \| Crypto Alg AES CBC 128 \| | | ... | \| ${auth_alg}= \| Integ Alg SHA1 96 \| | | ... | \| Generate keys for IPSec \| ${encr_alg} \| ${auth_alg} \| -| | ... +| | | | [Arguments] | ${crypto_alg} | ${integ_alg} -| | ... +| | | | ${encr_key_len}= | Get Crypto Alg Key Len | ${crypto_alg} | | ${encr_key}= | Generate Random String | ${encr_key_len} | | ${auth_key_len}= | Get Integ Alg Key Len | ${integ_alg} @@ -46,40 +46,30 @@ | | Set Test Variable | ${encr_key} | | Set Test Variable | ${auth_key} -| Configure path for IPSec test -| | [Documentation] | Setup path for IPsec testing TG<-->DUT1. -| | ... -| | ... | *Example:* -| | ... | \| Configure path for IPSec test \| -| | ... -| | Set Interface State | ${dut1} | ${dut1_if1} | up -| | Set Interface State | ${dut1} | ${dut1_if2} | up -| | Vpp Node Interfaces Ready Wait | ${dut1} - | Configure topology for IPv4 IPsec testing | | [Documentation] | Setup topology for IPv4 IPsec testing. -| | ... +| | | | ... | _NOTE:_ This KW sets following test case variable: | | ... | - dut_tun_ip - DUT tunnel IP address. Type: string | | ... | - dut_src_ip - DUT source IP address. Type: string | | ... | - tg_tun_ip - TG tunnel IP address. Type: string | | ... | - tg_src_ip - TG source IP address. Type: string -| | ... +| | | | ... | *Example:* | | ... | \| Configure topology for IPv4 IPsec testing \| -| | ... -| | Configure path for IPSec test +| | +| | Set interfaces in path up | | VPP Interface Set IP Address -| | ... | ${dut1} | ${dut1_if1} | ${dut_if1_ip4} | ${ip4_plen} +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${dut_if1_ip4} | ${ip4_plen} | | VPP Interface Set IP Address -| | ... | ${dut1} | ${dut1_if2} | ${dut_if2_ip4} | ${ip4_plen} +| | ... | ${dut1} | ${DUT1_${int}2}[0] | ${dut_if2_ip4} | ${ip4_plen} | | VPP Add IP Neighbor -| | ... | ${dut1} | ${dut1_if1} | ${tg_if1_ip4} | ${tg_if1_mac} +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${tg_if1_ip4} | ${TG_pf1_mac}[0] | | VPP Add IP Neighbor -| | ... | ${dut1} | ${dut1_if2} | ${tg_if2_ip4} | ${tg_if2_mac} +| | ... | ${dut1} | ${DUT1_${int}2}[0] | ${tg_if2_ip4} | ${TG_pf2_mac}[0] | | Vpp Route Add | | ... | ${dut1} | ${tg_host_ip4} | ${ip4_plen} | gateway=${tg_if1_ip4} -| | ... | interface=${dut1_if1} +| | ... | interface=${DUT1_${int}1}[0] | | Set Test Variable | ${dut_tun_ip} | ${dut_if1_ip4} | | Set Test Variable | ${tg_tun_ip} | ${tg_if1_ip4} | | Set Test Variable | ${tg_src_ip} | ${tg_host_ip4} @@ -87,29 +77,29 @@ | Configure topology for IPv6 IPsec testing | | [Documentation] | Setup topology fo IPv6 IPsec testing. -| | ... +| | | | ... | _NOTE:_ This KW sets following test case variable: | | ... | - dut_tun_ip - DUT tunnel IP address. Type: string | | ... | - dut_src_ip - DUT source IP address. Type: string | | ... | - tg_tun_ip - TG tunnel IP address. Type: string | | ... | - tg_src_ip - TG source IP address. Type: string -| | ... +| | | | ... | *Example:* | | ... | \| Configure topology for IPv6 IPsec testing \| -| | ... -| | Configure path for IPSec test +| | +| | Set interfaces in path up | | VPP Interface Set IP Address -| | ... | ${dut1} | ${dut1_if1} | ${dut_if1_ip6} | ${ip6_plen} +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${dut_if1_ip6} | ${ip6_plen} | | VPP Interface Set IP Address -| | ... | ${dut1} | ${dut1_if2} | ${dut_if2_ip6} | ${ip6_plen} +| | ... | ${dut1} | ${DUT1_${int}2}[0] | ${dut_if2_ip6} | ${ip6_plen} | | VPP Add IP Neighbor -| | ... | ${dut1} | ${dut1_if1} | ${tg_if1_ip6} | ${tg_if1_mac} +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${tg_if1_ip6} | ${TG_pf1_mac}[0] | | VPP Add IP Neighbor -| | ... | ${dut1} | ${dut1_if2} | ${tg_if2_ip6} | ${tg_if2_mac} -| | Vpp All RA Suppress Link Layer | ${nodes} +| | ... | ${dut1} | ${DUT1_${int}2}[0] | ${tg_if2_ip6} | ${TG_pf2_mac}[0] +| | Vpp Interfaces RA Suppress On All Nodes | ${nodes} | | Vpp Route Add | | ... | ${dut1} | ${tg_host_ip6} | ${ip6_plen_rt} | gateway=${tg_if1_ip6} -| | ... | interface=${dut1_if1} +| | ... | interface=${DUT1_${int}1}[0] | | Set Test Variable | ${dut_tun_ip} | ${dut_if1_ip6} | | Set Test Variable | ${tg_tun_ip} | ${tg_if1_ip6} | | Set Test Variable | ${tg_src_ip} | ${tg_host_ip6} @@ -117,7 +107,7 @@ | Configure manual keyed connection for IPSec | | [Documentation] | Setup IPsec manual keyed connection on VPP node. -| | ... +| | | | ... | *Arguments:* | | ... | - node - VPP node to setup IPsec on. Type: dictionary | | ... | - interface - Interface to enable IPsec on. Type: string @@ -131,11 +121,11 @@ | | ... | - r_ip - Remote IP address. Type: string | | ... | - l_tunnel - Local tunnel IP address (optional). Type: string | | ... | - r_tunnel - Remote tunnel IP address (optional). Type: string -| | ... +| | | | ... | _NOTE:_ This KW sets following test case variables: | | ... | - l_sa_id | | ... | - r_sa_id -| | ... +| | | | ... | *Example:* | | ... | \| ${encr_alg}= \| Crypto Alg AES CBC 128 \| | | ... | \| ${auth_alg}= \| Integ Alg SHA1 96 \| @@ -143,12 +133,12 @@ | | ... | \| GigabitEthernet0/8/0 \| ${encr_alg} \| sixteenbytes_key \ | | ... | \| ${auth_alg} \| twentybytessecretkey \| ${1000} \| ${1001} \ | | ... | \| 192.168.4.4 \| 192.168.3.3 \| 192.168.100.3 \| 192.168.100.2 \| -| | ... +| | | | [Arguments] | ${node} | ${interface} | ${crypto_alg} | ${crypto_key} | | ... | ${integ_alg} | ${integ_key} | ${l_spi} | ${r_spi} | ${l_ip} | | ... | ${r_ip} | ${l_tunnel}=${None} | ${r_tunnel}=${None} | | ... | ${is_ipv6}=${FALSE} -| | ... +| | | | Set Test Variable | ${l_sa_id} | ${10} | | Set Test Variable | ${r_sa_id} | ${20} | | ${spd_id}= | Set Variable | ${1} @@ -180,20 +170,102 @@ | Initialize IPSec in 3-node circular topology | | [Documentation] | | ... | Set UP state on VPP interfaces in path on nodes in 3-node circular +| | ... | topology. Get the interface MAC addresses and setup ARP on VPP +| | ... | interfaces towards TG. Setup IPv4 addresses with /24 prefix on DUT-TG +| | ... | links. Set routing for decrypted traffic on both DUT nodes +| | ... | with prefix /8 and next hop of neighbour TG interface IPv4 address. +| | +| | Set interfaces in path up +| | VPP Interface Set IP Address +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${dut1_if1_ip4} | 24 +| | VPP Interface Set IP Address +| | ... | ${dut2} | ${DUT2_${int}2}[0] | ${dut2_if2_ip4} | 24 +| | VPP Add IP Neighbor +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${tg_if1_ip4} | ${TG_pf1_mac}[0] +| | VPP Add IP Neighbor +| | ... | ${dut2} | ${DUT2_${int}2}[0] | ${tg_if2_ip4} | ${TG_pf2_mac}[0] +| | Vpp Route Add | ${dut1} | ${laddr_ip4} | 8 | gateway=${tg_if1_ip4} +| | ... | interface=${DUT1_${int}1}[0] +| | Vpp Route Add | ${dut2} | ${raddr_ip4} | 8 | gateway=${tg_if2_ip4} +| | ... | interface=${DUT2_${int}2}[0] + +| Initialize IPSec in 3-node circular container topology +| | [Documentation] +| | ... | Set UP state on VPP interfaces in path on nodes in 3-node circular | | ... | topology. Get the interface MAC addresses and setup ARP on all VPP | | ... | interfaces. Setup IPv4 addresses with /24 prefix on DUT-TG and | | ... | DUT1-DUT2 links. Set routing for encrypted traffic on both DUT nodes | | ... | with prefix /8 and next hop of neighbour DUT or TG interface IPv4 | | ... | address. -| | ... +| | +| | Set interfaces in path up on DUT | DUT1 +| | VPP Interface Set IP Address +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${dut1_if1_ip4} | 24 +| | VPP Add IP Neighbor +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${tg_if1_ip4} | ${TG_pf1_mac}[0] +| | Vpp Route Add +| | ... | ${dut1} | ${laddr_ip4} | 8 | gateway=${tg_if1_ip4} +| | ... | interface=${DUT1_${int}1}[0] + +| Initialize IPSec in 2-node circular topology +| | [Documentation] +| | ... | Set UP state on VPP interfaces in path on node in 2-node circular +| | ... | topology. Get the interface MAC address and setup ARP on VPP +| | ... | interface towards TG. Setup IPv4 address with /24 prefix on one +| | ... | DUT-TG link. Set routing for decrypted traffic on DUT +| | ... | with prefix /8 and next hop of neighbour TG interface IPv4 address. +| | | | Set interfaces in path up -| | VPP Interface Set IP Address | ${dut1} | ${dut1_if1} -| | ... | ${dut1_if1_ip4} | 24 -| | VPP Interface Set IP Address | ${dut2} | ${dut2_if2} -| | ... | ${dut2_if2_ip4} | 24 -| | VPP Add IP Neighbor | ${dut1} | ${dut1_if1} | ${tg_if1_ip4} | ${tg_if1_mac} -| | VPP Add IP Neighbor | ${dut2} | ${dut2_if2} | ${tg_if2_ip4} | ${tg_if2_mac} -| | Vpp Route Add | ${dut1} | ${laddr_ip4} | 8 | gateway=${tg_if1_ip4} -| | ... | interface=${dut1_if1} -| | Vpp Route Add | ${dut2} | ${raddr_ip4} | 8 | gateway=${tg_if2_ip4} -| | ... | interface=${dut2_if2} +| | VPP Interface Set IP Address +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${dut1_if1_ip4} | 24 +| | VPP Add IP Neighbor +| | ... | ${dut1} | ${DUT1_${int}1}[0] | ${tg_if1_ip4} | ${TG_pf1_mac}[0] +| | Vpp Route Add +| | ... | ${dut1} | ${laddr_ip4} | 8 | gateway=${tg_if1_ip4} +| | ... | interface=${DUT1_${int}1}[0] + +| Enable IPSec Async Mode on all VPP DUTs +| | [Documentation] +| | ... | Set IPsec async mode on for all DUT nodes. +| | +| | FOR | ${dut} | IN | @{duts} +| | | VPP Ipsec Set Async Mode | ${nodes['${dut}']} +| | END + +| Disable Crypto Work of VPP Worker Threads on all VPP DUTs +| | [Documentation] +| | ... | Disable crypto work for specified data plane CPU cores +| | ... | on all DUT nodes. +| | ... | Currently only "port" (physical) interfaces are supported. +| | ... | Will need a redesign if virtual interfaces (memif, vhost-user) +| | ... | are present. +| | +| | ... | *Arguments:* +| | ... | - dp_cores - Number of physical cores. Type: integer +| | +| | [Arguments] | ${dp_cores} +| | +| | VPP Round Robin Rx Placement on all DUTs +| | ... | ${nodes} | prefix=port | dp_core_limit=${dp_cores} +| | FOR | ${dut} | IN | @{duts} +| | | Disable Crypto Work of VPP Worker Threads on node +| | | ... | ${dut} | ${dp_cores} +| | END + +| Disable Crypto Work of VPP Worker Threads on node +| | [Documentation] +| | ... | Disable crypto work for specified data plane cores +| | ... | on DUT node. +| | +| | ... | *Arguments:* +| | ... | - dut - DUT node. Type: string +| | ... | - dp_cores - Number of physical cores. Type: integer +| | +| | [Arguments] | ${dut} | ${dp_cores} +| | +| | # Workers From Physical Cores keyword is currently defined in default.robot +| | ${dp_worker_count} = | Workers From Physical Cores | ${dp_cores} +| | FOR | ${worker_index} | IN RANGE | ${dp_worker_count} +| | | VPP IPSec Crypto SW Scheduler Set Worker +| | | ... | ${nodes['${dut}']} | ${worker_index} | crypto_enable=${False} +| | END