X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=test%2Ftest_ikev2.py;h=438a674977f77bab7f93a94a6e3bf336d0083d3d;hb=b59f63b0e71c879331280b721ec72ff0b4699540;hp=175fa0ab9be967754bf78c1e6708dd935d21aaee;hpb=1eaaba41982861b59f0b70470604f6d111c68fa6;p=vpp.git

diff --git a/test/test_ikev2.py b/test/test_ikev2.py
index 175fa0ab9be..438a674977f 100644
--- a/test/test_ikev2.py
+++ b/test/test_ikev2.py
@@ -802,9 +802,9 @@ class IkePeer(VppTestCase):
         self.assertEqual(sa.i_id.type, self.sa.id_type)
         self.assertEqual(sa.r_id.type, self.sa.id_type)
         self.assertEqual(sa.i_id.data_len, len(self.sa.i_id))
-        self.assertEqual(sa.r_id.data_len, len(self.sa.r_id))
+        self.assertEqual(sa.r_id.data_len, len(self.idr))
         self.assertEqual(bytes(sa.i_id.data, 'ascii'), self.sa.i_id)
-        self.assertEqual(bytes(sa.r_id.data, 'ascii'), self.sa.r_id)
+        self.assertEqual(bytes(sa.r_id.data, 'ascii'), self.idr)
 
         r = self.vapi.ikev2_child_sa_dump(sa_index=sa.sa_index)
         self.assertEqual(len(r), 1)
@@ -1003,9 +1003,12 @@ class TemplateInitiator(IkePeer):
         self.sa.msg_id += 1
         plain = self.sa.hmac_and_decrypt(ih)
         idi = ikev2.IKEv2_payload_IDi(plain)
-        idr = ikev2.IKEv2_payload_IDr(idi.payload)
         self.assertEqual(idi.load, self.sa.i_id)
-        self.assertEqual(idr.load, self.sa.r_id)
+        if self.no_idr_auth:
+            self.assertEqual(idi.next_payload, 39)  # AUTH
+        else:
+            idr = ikev2.IKEv2_payload_IDr(idi.payload)
+            self.assertEqual(idr.load, self.sa.r_id)
         prop = idi[ikev2.IKEv2_payload_Proposal]
         c = self.sa.child_sas[0]
         c.ispi = prop.SPI
@@ -1264,10 +1267,15 @@ class TemplateResponder(IkePeer):
                      proto='ESP', SPI=c.ispi))
         else:
             first_payload = 'IDi'
-            ids = (ikev2.IKEv2_payload_IDi(next_payload='IDr',
-                   IDtype=self.sa.id_type, load=self.sa.i_id) /
-                   ikev2.IKEv2_payload_IDr(next_payload='AUTH',
-                   IDtype=self.sa.id_type, load=self.sa.r_id))
+            if self.no_idr_auth:
+                ids = ikev2.IKEv2_payload_IDi(next_payload='AUTH',
+                                              IDtype=self.sa.id_type,
+                                              load=self.sa.i_id)
+            else:
+                ids = (ikev2.IKEv2_payload_IDi(next_payload='IDr',
+                       IDtype=self.sa.id_type, load=self.sa.i_id) /
+                       ikev2.IKEv2_payload_IDr(next_payload='AUTH',
+                       IDtype=self.sa.id_type, load=self.sa.r_id))
             plain = ids / plain
         return plain, first_payload
 
@@ -1394,15 +1402,23 @@ class Ikev2Params(object):
 
         is_init = True if 'is_initiator' not in params else\
             params['is_initiator']
+        self.no_idr_auth = params.get('no_idr_in_auth', False)
 
         idr = {'id_type': 'fqdn', 'data': b'vpp.home'}
         idi = {'id_type': 'fqdn', 'data': b'roadwarrior.example.com'}
+        r_id = self.idr = idr['data']
+        i_id = self.idi = idi['data']
         if is_init:
+            # scapy is initiator, VPP is responder
             self.p.add_local_id(**idr)
             self.p.add_remote_id(**idi)
+            if self.no_idr_auth:
+                r_id = None
         else:
+            # VPP is initiator, scapy is responder
             self.p.add_local_id(**idi)
-            self.p.add_remote_id(**idr)
+            if not self.no_idr_auth:
+                self.p.add_remote_id(**idr)
 
         loc_ts = {'start_addr': '10.10.10.0', 'end_addr': '10.10.10.255'} if\
             'loc_ts' not in params else params['loc_ts']
@@ -1436,13 +1452,15 @@ class Ikev2Params(object):
                                                self.pg0.remote_ip4)
             self.vapi.cli(cmd)
 
-        self.sa = IKEv2SA(self, i_id=idi['data'], r_id=idr['data'],
+        self.sa = IKEv2SA(self, i_id=i_id, r_id=r_id,
                           is_initiator=is_init,
                           id_type=self.p.local_id['id_type'],
                           i_natt=i_natt, r_natt=r_natt,
                           priv_key=client_priv, auth_method=auth_method,
+                          nonce=params.get('nonce'),
                           auth_data=auth_data, udp_encap=udp_encap,
                           local_ts=self.p.remote_ts, remote_ts=self.p.local_ts)
+
         if is_init:
             ike_crypto = ('AES-CBC', 32) if 'ike-crypto' not in params else\
                 params['ike-crypto']
@@ -1817,7 +1835,8 @@ class TestInitiatorDelSAFromResponder(TemplateInitiator, Ikev2Params):
                 'crypto_alg': 12,  # "aes-cbc"
                 'crypto_key_size': 256,
                 # "hmac-sha2-256-128"
-                'integ_alg': 12}})
+                'integ_alg': 12},
+            'no_idr_in_auth': True})
 
 
 @tag_fixme_vpp_workers
@@ -1955,7 +1974,9 @@ class Test_IKE_AES_CBC_128_SHA256_128_MODP2048_ESP_AES_CBC_192_SHA_384_192\
             'ike-integ': 'SHA2-256-128',
             'esp-crypto': ('AES-CBC', 24),
             'esp-integ': 'SHA2-384-192',
-            'ike-dh': '2048MODPgr'})
+            'ike-dh': '2048MODPgr',
+            'nonce': os.urandom(256),
+            'no_idr_in_auth': True})
 
 
 @tag_fixme_vpp_workers