X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=test%2Ftest_ipsec_esp.py;h=178b1d248bf694f53cbe508605b99392d237cd0f;hb=490b92738;hp=7448df1d09ad55ff3a21881a239406aa23213d9f;hpb=fdca4dd1a1a817e65bf44e435261d893fc0c51d6;p=vpp.git diff --git a/test/test_ipsec_esp.py b/test/test_ipsec_esp.py index 7448df1d09a..178b1d248bf 100644 --- a/test/test_ipsec_esp.py +++ b/test/test_ipsec_esp.py @@ -1,7 +1,10 @@ import socket import unittest from scapy.layers.ipsec import ESP -from scapy.layers.inet import UDP +from scapy.layers.inet import IP, ICMP, UDP +from scapy.layers.inet6 import IPv6 +from scapy.layers.l2 import Ether +from scapy.packet import Raw from parameterized import parameterized from framework import VppTestRunner @@ -107,6 +110,7 @@ class ConfigIpsecESP(TemplateIpsec): addr_bcast = params.addr_bcast e = VppEnum.vl_api_ipsec_spd_action_t flags = params.flags + tun_flags = params.tun_flags salt = params.salt objs = [] @@ -116,6 +120,8 @@ class ConfigIpsecESP(TemplateIpsec): self.vpp_esp_protocol, self.tun_if.local_addr[addr_type], self.tun_if.remote_addr[addr_type], + tun_flags=tun_flags, + dscp=params.dscp, flags=flags, salt=salt) params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi, @@ -124,6 +130,8 @@ class ConfigIpsecESP(TemplateIpsec): self.vpp_esp_protocol, self.tun_if.remote_addr[addr_type], self.tun_if.local_addr[addr_type], + tun_flags=tun_flags, + dscp=params.dscp, flags=flags, salt=salt) objs.append(params.tun_sa_in) @@ -368,6 +376,91 @@ class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests, self.tun4_encrypt_node_name = old_name +class TestIpsecEspTun(TemplateIpsecEsp, IpsecTun46Tests): + """ Ipsec ESP - TUN encap tests """ + + def setUp(self): + self.ipv4_params = IPsecIPv4Params() + self.ipv6_params = IPsecIPv6Params() + + c = (VppEnum.vl_api_tunnel_encap_decap_flags_t. + TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP) + c1 = c | (VppEnum.vl_api_tunnel_encap_decap_flags_t. + TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN) + + self.ipv4_params.tun_flags = c + self.ipv6_params.tun_flags = c1 + + super(TestIpsecEspTun, self).setUp() + + def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy only DSCP + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IP(src=src, dst=dst, tos=5) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy both + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IPv6(src=src, dst=dst, tc=5) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def verify_encrypted(self, p, sa, rxs): + # just check that only the DSCP is copied + for rx in rxs: + self.assertEqual(rx[IP].tos, 4) + + def verify_encrypted6(self, p, sa, rxs): + # just check that the DSCP & ECN are copied + for rx in rxs: + self.assertEqual(rx[IPv6].tc, 5) + + +class TestIpsecEspTun2(TemplateIpsecEsp, IpsecTun46Tests): + """ Ipsec ESP - TUN DSCP tests """ + + def setUp(self): + self.ipv4_params = IPsecIPv4Params() + self.ipv6_params = IPsecIPv6Params() + + self.ipv4_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF + self.ipv6_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11 + + super(TestIpsecEspTun2, self).setUp() + + def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy only DSCP + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IP(src=src, dst=dst) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54): + # set the DSCP + ECN - flags are set to copy both + return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / + IPv6(src=src, dst=dst) / + UDP(sport=4444, dport=4444) / + Raw(b'X' * payload_size) + for i in range(count)] + + def verify_encrypted(self, p, sa, rxs): + # just check that only the DSCP is copied + for rx in rxs: + self.assertEqual(rx[IP].tos, + VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF << 2) + + def verify_encrypted6(self, p, sa, rxs): + # just check that the DSCP & ECN are copied + for rx in rxs: + self.assertEqual(rx[IPv6].tc, + VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11 << 2) + + class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests): """ Ipsec ESP - TCP tests """ pass @@ -517,7 +610,34 @@ class MyParameters(): 'scapy-crypto': "NULL", 'scapy-integ': "HMAC-SHA1-96", 'salt': 0, - 'key': b"JPjyOWBeVEQiMe7h00112233"}} + 'key': b"JPjyOWBeVEQiMe7h00112233"}, + 'AES-CTR-128/SHA1-96': { + 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. + IPSEC_API_CRYPTO_ALG_AES_CTR_128), + 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. + IPSEC_API_INTEG_ALG_SHA1_96), + 'scapy-crypto': "AES-CTR", + 'scapy-integ': "HMAC-SHA1-96", + 'salt': 0, + 'key': b"JPjyOWBeVEQiMe7h"}, + 'AES-CTR-192/SHA1-96': { + 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. + IPSEC_API_CRYPTO_ALG_AES_CTR_192), + 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. + IPSEC_API_INTEG_ALG_SHA1_96), + 'scapy-crypto': "AES-CTR", + 'scapy-integ': "HMAC-SHA1-96", + 'salt': 1010, + 'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"}, + 'AES-CTR-256/SHA1-96': { + 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. + IPSEC_API_CRYPTO_ALG_AES_CTR_256), + 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. + IPSEC_API_INTEG_ALG_SHA1_96), + 'scapy-crypto': "AES-CTR", + 'scapy-integ': "HMAC-SHA1-96", + 'salt': 2020, + 'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"}} class RunTestIpsecEspAll(ConfigIpsecESP, @@ -544,6 +664,8 @@ class RunTestIpsecEspAll(ConfigIpsecESP, self.run_a_test(self.engine, self.flag, self.algo) def run_a_test(self, engine, flag, algo, payload_size=None): + if engine == "ia32": + engine = "native" self.vapi.cli("set crypto handler all %s" % engine) self.ipv4_params = IPsecIPv4Params() @@ -579,8 +701,16 @@ class RunTestIpsecEspAll(ConfigIpsecESP, self.verify_tra_basic4(count=NUM_PKTS) self.verify_tun_66(self.params[socket.AF_INET6], count=NUM_PKTS) + # + # Use an odd-byte payload size to check for correct padding. + # + # 49 + 2 == 51 which should pad +1 to 52 for 4 byte alignment, +5 + # to 56 for 8 byte alignment, and +13 to 64 for 64 byte alignment. + # This should catch bugs where the code is incorrectly over-padding + # for algorithms that don't require it + psz = 49 - len(IP()/ICMP()) if payload_size is None else payload_size self.verify_tun_44(self.params[socket.AF_INET], - count=NUM_PKTS) + count=NUM_PKTS, payload_size=psz) LARGE_PKT_SZ = [ 1970, # results in 2 chained buffers entering decrypt node @@ -620,7 +750,8 @@ class RunTestIpsecEspAll(ConfigIpsecESP, # GEN for FLG in noESN ESN; do for ALG in AES-GCM-128/NONE \ # GEN AES-GCM-192/NONE AES-GCM-256/NONE AES-CBC-128/MD5-96 \ # GEN AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96 \ -# GEN 3DES-CBC/SHA1-96 NONE/SHA1-96; do \ +# GEN 3DES-CBC/SHA1-96 NONE/SHA1-96 \ +# GEN AES-CTR-128/SHA1-96 AES-CTR-192/SHA1-96 AES-CTR-256/SHA1-96; do \ # GEN [[ ${FLG} == "ESN" && ${ALG} == *"NONE" ]] && continue # GEN echo -e "\n\nclass Test_${ENG}_${FLG}_${ALG}(RunTestIpsecEspAll):" | # GEN sed -e 's/-/_/g' -e 's#/#_#g' ; \ @@ -678,6 +809,24 @@ class Test_ia32_noESN_NONE_SHA1_96(RunTestIpsecEspAll): self.run_test() +class Test_ia32_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """ia32 noESN AES-CTR-128/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ia32_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """ia32 noESN AES-CTR-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ia32_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """ia32 noESN AES-CTR-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + class Test_ia32_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """ia32 ESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): @@ -708,6 +857,24 @@ class Test_ia32_ESN_NONE_SHA1_96(RunTestIpsecEspAll): self.run_test() +class Test_ia32_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """ia32 ESN AES-CTR-128/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ia32_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """ia32 ESN AES-CTR-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ia32_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """ia32 ESN AES-CTR-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + class Test_ipsecmb_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): """ipsecmb noESN AES-GCM-128/NONE IPSec test""" def test_ipsec(self): @@ -756,6 +923,24 @@ class Test_ipsecmb_noESN_NONE_SHA1_96(RunTestIpsecEspAll): self.run_test() +class Test_ipsecmb_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """ipsecmb noESN AES-CTR-128/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ipsecmb_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """ipsecmb noESN AES-CTR-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ipsecmb_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """ipsecmb noESN AES-CTR-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + class Test_ipsecmb_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """ipsecmb ESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): @@ -786,6 +971,24 @@ class Test_ipsecmb_ESN_NONE_SHA1_96(RunTestIpsecEspAll): self.run_test() +class Test_ipsecmb_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """ipsecmb ESN AES-CTR-128/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ipsecmb_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """ipsecmb ESN AES-CTR-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_ipsecmb_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """ipsecmb ESN AES-CTR-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + class Test_openssl_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): """openssl noESN AES-GCM-128/NONE IPSec test""" def test_ipsec(self): @@ -834,6 +1037,24 @@ class Test_openssl_noESN_NONE_SHA1_96(RunTestIpsecEspAll): self.run_test() +class Test_openssl_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """openssl noESN AES-CTR-128/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_openssl_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """openssl noESN AES-CTR-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_openssl_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """openssl noESN AES-CTR-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + class Test_openssl_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """openssl ESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): @@ -864,5 +1085,23 @@ class Test_openssl_ESN_NONE_SHA1_96(RunTestIpsecEspAll): self.run_test() +class Test_openssl_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """openssl ESN AES-CTR-128/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_openssl_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """openssl ESN AES-CTR-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_openssl_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """openssl ESN AES-CTR-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + if __name__ == '__main__': unittest.main(testRunner=VppTestRunner)