X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=test%2Ftest_ipsec_ah.py;h=8f8b2bf15509185aa030be6ae3cb6055bad980de;hb=b1c0b9afacb12e8255681db25a01b94f25fed89e;hp=bc539a2bd03cf22f3097e2684e7f9b8e0a6a95a0;hpb=4a56f4e48f39f9e0560833115f85270c0c04b57f;p=vpp.git diff --git a/test/test_ipsec_ah.py b/test/test_ipsec_ah.py index bc539a2bd03..8f8b2bf1550 100644 --- a/test/test_ipsec_ah.py +++ b/test/test_ipsec_ah.py @@ -2,6 +2,10 @@ import socket import unittest from scapy.layers.ipsec import AH +from scapy.layers.inet import IP, UDP +from scapy.layers.inet6 import IPv6 +from scapy.layers.l2 import Ether +from scapy.packet import Raw from framework import VppTestRunner from template_ipsec import TemplateIpsec, IpsecTra46Tests, IpsecTun46Tests, \ @@ -20,32 +24,33 @@ class ConfigIpsecAH(TemplateIpsec): """ Basic test for IPSEC using AH transport and Tunnel mode - TRANSPORT MODE: + TRANSPORT MODE:: - --- encrypt --- - |pg2| <-------> |VPP| - --- decrypt --- + --- encrypt --- + |pg2| <-------> |VPP| + --- decrypt --- - TUNNEL MODE: + TUNNEL MODE:: - --- encrypt --- plain --- - |pg0| <------- |VPP| <------ |pg1| - --- --- --- + --- encrypt --- plain --- + |pg0| <------- |VPP| <------ |pg1| + --- --- --- + + --- decrypt --- plain --- + |pg0| -------> |VPP| ------> |pg1| + --- --- --- - --- decrypt --- plain --- - |pg0| -------> |VPP| ------> |pg1| - --- --- --- """ encryption_type = AH net_objs = [] tra4_encrypt_node_name = "ah4-encrypt" - tra4_decrypt_node_name = "ah4-decrypt" + tra4_decrypt_node_name = ["ah4-decrypt", "ah4-decrypt"] tra6_encrypt_node_name = "ah6-encrypt" - tra6_decrypt_node_name = "ah6-decrypt" + tra6_decrypt_node_name = ["ah6-decrypt", "ah6-decrypt"] tun4_encrypt_node_name = "ah4-encrypt" - tun4_decrypt_node_name = "ah4-decrypt" + tun4_decrypt_node_name = ["ah4-decrypt", "ah4-decrypt"] tun6_encrypt_node_name = "ah6-encrypt" - tun6_decrypt_node_name = "ah6-decrypt" + tun6_decrypt_node_name = ["ah6-decrypt", "ah6-decrypt"] @classmethod def setUpClass(cls): @@ -119,8 +124,11 @@ class ConfigIpsecAH(TemplateIpsec): addr_any = params.addr_any addr_bcast = params.addr_bcast flags = params.flags + tun_flags = params.tun_flags e = VppEnum.vl_api_ipsec_spd_action_t objs = [] + params.outer_hop_limit = 253 + params.outer_flow_label = 0x12345 params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi, auth_algo_vpp_id, auth_key, @@ -128,7 +136,9 @@ class ConfigIpsecAH(TemplateIpsec): self.vpp_ah_protocol, self.tun_if.local_addr[addr_type], self.tun_if.remote_addr[addr_type], - flags=flags) + tun_flags=tun_flags, + flags=flags, + dscp=params.dscp) params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi, auth_algo_vpp_id, auth_key, @@ -136,7 +146,9 @@ class ConfigIpsecAH(TemplateIpsec): self.vpp_ah_protocol, self.tun_if.remote_addr[addr_type], self.tun_if.local_addr[addr_type], - flags=flags) + tun_flags=tun_flags, + flags=flags, + dscp=params.dscp) objs.append(params.tun_sa_in) objs.append(params.tun_sa_out) @@ -259,21 +271,22 @@ class TemplateIpsecAh(ConfigIpsecAH): """ Basic test for IPSEC using AH transport and Tunnel mode - TRANSPORT MODE: + TRANSPORT MODE:: - --- encrypt --- - |pg2| <-------> |VPP| - --- decrypt --- + --- encrypt --- + |pg2| <-------> |VPP| + --- decrypt --- - TUNNEL MODE: + TUNNEL MODE:: - --- encrypt --- plain --- - |pg0| <------- |VPP| <------ |pg1| - --- --- --- + --- encrypt --- plain --- + |pg0| <------- |VPP| <------ |pg1| + --- --- --- + + --- decrypt --- plain --- + |pg0| -------> |VPP| ------> |pg1| + --- --- --- - --- decrypt --- plain --- - |pg0| -------> |VPP| ------> |pg1| - --- --- --- """ @classmethod def setUpClass(cls): @@ -302,6 +315,89 @@ class TestIpsecAh2(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests): pass +class TestIpsecAhTun(TemplateIpsecAh, IpsecTun46Tests): + """ Ipsec AH - TUN encap tests """ + + def setUp(self): + self.ipv4_params = IPsecIPv4Params() + self.ipv6_params = IPsecIPv6Params() + + c = (VppEnum.vl_api_tunnel_encap_decap_flags_t. + TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP) + c1 = c | (VppEnum.vl_api_tunnel_encap_decap_flags_t. + TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN) + + self.ipv4_params.tun_flags = c + self.ipv6_params.tun_flags = c1 + + super(TestIpsecAhTun, self).setUp() + + def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy only DSCP + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IP(src=src, dst=dst, tos=5) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy both + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IPv6(src=src, dst=dst, tc=5) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def verify_encrypted(self, p, sa, rxs): + # just check that only the DSCP is copied + for rx in rxs: + self.assertEqual(rx[IP].tos, 4) + + def verify_encrypted6(self, p, sa, rxs): + # just check that the DSCP & ECN are copied + for rx in rxs: + self.assertEqual(rx[IPv6].tc, 5) + + +class TestIpsecAhTun2(TemplateIpsecAh, IpsecTun46Tests): + """ Ipsec AH - TUN encap tests """ + + def setUp(self): + self.ipv4_params = IPsecIPv4Params() + self.ipv6_params = IPsecIPv6Params() + + self.ipv4_params.dscp = 3 + self.ipv6_params.dscp = 4 + + super(TestIpsecAhTun2, self).setUp() + + def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy only DSCP + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IP(src=src, dst=dst, tos=0) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy both + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IPv6(src=src, dst=dst, tc=0) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def verify_encrypted(self, p, sa, rxs): + # just check that only the DSCP is copied + for rx in rxs: + self.assertEqual(rx[IP].tos, 0xc) + + def verify_encrypted6(self, p, sa, rxs): + # just check that the DSCP & ECN are copied + for rx in rxs: + self.assertEqual(rx[IPv6].tc, 0x10) + + class TestIpsecAhHandoff(TemplateIpsecAh, IpsecTun6HandoffTests, IpsecTun4HandoffTests):