X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=test%2Ftest_ipsec_ah.py;h=d44492ddd26ab81fb373285d2565ba324b9c4ca5;hb=751bb131e;hp=ec0c5586c2b91f5cb82cd6700f520373476f9e5c;hpb=4f33c80c5de96fccc15a91135099ee437f75f252;p=vpp.git diff --git a/test/test_ipsec_ah.py b/test/test_ipsec_ah.py index ec0c5586c2b..d44492ddd26 100644 --- a/test/test_ipsec_ah.py +++ b/test/test_ipsec_ah.py @@ -2,11 +2,16 @@ import socket import unittest from scapy.layers.ipsec import AH +from scapy.layers.inet import IP, UDP +from scapy.layers.inet6 import IPv6 +from scapy.layers.l2 import Ether +from scapy.packet import Raw from framework import VppTestRunner from template_ipsec import TemplateIpsec, IpsecTra46Tests, IpsecTun46Tests, \ config_tun_params, config_tra_params, IPsecIPv4Params, IPsecIPv6Params, \ - IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6 + IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6, \ + IpsecTun6HandoffTests, IpsecTun4HandoffTests from template_ipsec import IpsecTcpTests from vpp_ipsec import VppIpsecSA, VppIpsecSpd, VppIpsecSpdEntry,\ VppIpsecSpdItfBinding @@ -88,13 +93,13 @@ class ConfigIpsecAH(TemplateIpsec): config_tra_params(p, self.encryption_type) for p in params: self.config_ah_tun(p) + config_tun_params(p, self.encryption_type, self.tun_if) for p in params: d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4 r = VppIpRoute(self, p.remote_tun_if_host, p.addr_len, [VppRoutePath(self.tun_if.remote_addr[p.addr_type], 0xffffffff, - proto=d)], - is_ip6=p.is_ipv6) + proto=d)]) r.add_vpp_config() self.net_objs.append(r) self.logger.info(self.vapi.ppcli("show ipsec all")) @@ -118,6 +123,7 @@ class ConfigIpsecAH(TemplateIpsec): addr_any = params.addr_any addr_bcast = params.addr_bcast flags = params.flags + tun_flags = params.tun_flags e = VppEnum.vl_api_ipsec_spd_action_t objs = [] @@ -127,7 +133,9 @@ class ConfigIpsecAH(TemplateIpsec): self.vpp_ah_protocol, self.tun_if.local_addr[addr_type], self.tun_if.remote_addr[addr_type], - flags=flags) + tun_flags=tun_flags, + flags=flags, + dscp=params.dscp) params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi, auth_algo_vpp_id, auth_key, @@ -135,7 +143,9 @@ class ConfigIpsecAH(TemplateIpsec): self.vpp_ah_protocol, self.tun_if.remote_addr[addr_type], self.tun_if.local_addr[addr_type], - flags=flags) + tun_flags=tun_flags, + flags=flags, + dscp=params.dscp) objs.append(params.tun_sa_in) objs.append(params.tun_sa_out) @@ -301,6 +311,96 @@ class TestIpsecAh2(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests): pass +class TestIpsecAhTun(TemplateIpsecAh, IpsecTun46Tests): + """ Ipsec AH - TUN encap tests """ + + def setUp(self): + self.ipv4_params = IPsecIPv4Params() + self.ipv6_params = IPsecIPv6Params() + + c = (VppEnum.vl_api_tunnel_encap_decap_flags_t. + TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP) + c1 = c | (VppEnum.vl_api_tunnel_encap_decap_flags_t. + TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN) + + self.ipv4_params.tun_flags = c + self.ipv6_params.tun_flags = c1 + + super(TestIpsecAhTun, self).setUp() + + def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy only DSCP + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IP(src=src, dst=dst, tos=5) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy both + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IPv6(src=src, dst=dst, tc=5) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def verify_encrypted(self, p, sa, rxs): + # just check that only the DSCP is copied + for rx in rxs: + self.assertEqual(rx[IP].tos, 4) + + def verify_encrypted6(self, p, sa, rxs): + # just check that the DSCP & ECN are copied + for rx in rxs: + self.assertEqual(rx[IPv6].tc, 5) + + +class TestIpsecAhTun2(TemplateIpsecAh, IpsecTun46Tests): + """ Ipsec AH - TUN encap tests """ + + def setUp(self): + self.ipv4_params = IPsecIPv4Params() + self.ipv6_params = IPsecIPv6Params() + + self.ipv4_params.dscp = 3 + self.ipv6_params.dscp = 4 + + super(TestIpsecAhTun2, self).setUp() + + def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy only DSCP + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IP(src=src, dst=dst, tos=0) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy both + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IPv6(src=src, dst=dst, tc=0) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def verify_encrypted(self, p, sa, rxs): + # just check that only the DSCP is copied + for rx in rxs: + self.assertEqual(rx[IP].tos, 0xc) + + def verify_encrypted6(self, p, sa, rxs): + # just check that the DSCP & ECN are copied + for rx in rxs: + self.assertEqual(rx[IPv6].tc, 0x10) + + +class TestIpsecAhHandoff(TemplateIpsecAh, + IpsecTun6HandoffTests, + IpsecTun4HandoffTests): + """ Ipsec AH Handoff """ + pass + + class TestIpsecAhAll(ConfigIpsecAH, IpsecTra4, IpsecTra6, IpsecTun4, IpsecTun6): @@ -313,7 +413,10 @@ class TestIpsecAhAll(ConfigIpsecAH, super(TestIpsecAhAll, self).tearDown() def test_integ_algs(self): - """SHA1_96, SHA256, SHA394, SHA512 w/ & w/o ESN""" + """All Engines SHA[1_96, 256, 384, 512] w/ & w/o ESN""" + # foreach VPP crypto engine + engines = ["ia32", "ipsecmb", "openssl"] + algos = [{'vpp': VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96, 'scapy': "HMAC-SHA1-96"}, @@ -331,45 +434,50 @@ class TestIpsecAhAll(ConfigIpsecAH, IPSEC_API_SAD_FLAG_USE_ESN)] # - # loop through each of the algorithms + # loop through the VPP engines # - for algo in algos: - # with self.subTest(algo=algo['scapy']): - for flag in flags: - # - # setup up the config paramters - # - self.ipv4_params = IPsecIPv4Params() - self.ipv6_params = IPsecIPv6Params() - - self.params = {self.ipv4_params.addr_type: - self.ipv4_params, - self.ipv6_params.addr_type: - self.ipv6_params} - - for _, p in self.params.items(): - p.auth_algo_vpp_id = algo['vpp'] - p.auth_algo = algo['scapy'] - p.flags = p.flags | flag - - # - # configure the SPDs. SAs, etc - # - self.config_network(self.params.values()) - - # - # run some traffic. - # An exhautsive 4o6, 6o4 is not necessary for each algo - # - self.verify_tra_basic6(count=17) - self.verify_tra_basic4(count=17) - self.verify_tun_66(self.params[socket.AF_INET6], count=17) - self.verify_tun_44(self.params[socket.AF_INET], count=17) - - # - # remove the SPDs, SAs, etc - # - self.unconfig_network() + for engine in engines: + self.vapi.cli("set crypto handler all %s" % engine) + # + # loop through each of the algorithms + # + for algo in algos: + # with self.subTest(algo=algo['scapy']): + for flag in flags: + # + # setup up the config paramters + # + self.ipv4_params = IPsecIPv4Params() + self.ipv6_params = IPsecIPv6Params() + + self.params = {self.ipv4_params.addr_type: + self.ipv4_params, + self.ipv6_params.addr_type: + self.ipv6_params} + + for _, p in self.params.items(): + p.auth_algo_vpp_id = algo['vpp'] + p.auth_algo = algo['scapy'] + p.flags = p.flags | flag + + # + # configure the SPDs. SAs, etc + # + self.config_network(self.params.values()) + + # + # run some traffic. + # An exhautsive 4o6, 6o4 is not necessary for each algo + # + self.verify_tra_basic6(count=17) + self.verify_tra_basic4(count=17) + self.verify_tun_66(self.params[socket.AF_INET6], count=17) + self.verify_tun_44(self.params[socket.AF_INET], count=17) + + # + # remove the SPDs, SAs, etc + # + self.unconfig_network() if __name__ == '__main__':