X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=test%2Ftest_ipsec_esp.py;h=dbd21f1f5fe931ec26bc6cf840f16b8e00794b87;hb=b438c763a10649a88ba2bed8795abf97af2a0b0d;hp=2eaf705c84ee0c279a9f06933e806e0772179264;hpb=39cf40a700686d9b59a42d45fdfbcc844dbfd905;p=vpp.git

diff --git a/test/test_ipsec_esp.py b/test/test_ipsec_esp.py
index 2eaf705c84e..dbd21f1f5fe 100644
--- a/test/test_ipsec_esp.py
+++ b/test/test_ipsec_esp.py
@@ -1,7 +1,7 @@
 import socket
 import unittest
 from scapy.layers.ipsec import ESP
-from scapy.layers.inet import UDP
+from scapy.layers.inet import IP, ICMP, UDP
 
 from parameterized import parameterized
 from framework import VppTestRunner
@@ -291,7 +291,81 @@ class TemplateIpsecEsp(ConfigIpsecESP):
 class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests,
                     IpsecTun46Tests, IpsecTra6ExtTests):
     """ Ipsec ESP - TUN & TRA tests """
-    pass
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestIpsecEsp1, cls).setUpClass()
+
+    @classmethod
+    def tearDownClass(cls):
+        super(TestIpsecEsp1, cls).tearDownClass()
+
+    def setUp(self):
+        super(TestIpsecEsp1, self).setUp()
+
+    def tearDown(self):
+        super(TestIpsecEsp1, self).tearDown()
+
+    def test_tun_46(self):
+        """ ipsec 4o6 tunnel """
+        # add an SPD entry to direct 2.2.2.2 to the v6 tunnel SA
+        p6 = self.ipv6_params
+        p4 = self.ipv4_params
+
+        p6.remote_tun_if_host4 = "2.2.2.2"
+        e = VppEnum.vl_api_ipsec_spd_action_t
+
+        VppIpsecSpdEntry(self,
+                         self.tun_spd,
+                         p6.scapy_tun_sa_id,
+                         self.pg1.remote_addr[p4.addr_type],
+                         self.pg1.remote_addr[p4.addr_type],
+                         p6.remote_tun_if_host4,
+                         p6.remote_tun_if_host4,
+                         0,
+                         priority=10,
+                         policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+                         is_outbound=1).add_vpp_config()
+        VppIpRoute(self,  p6.remote_tun_if_host4, p4.addr_len,
+                   [VppRoutePath(self.tun_if.remote_addr[p4.addr_type],
+                                 0xffffffff)]).add_vpp_config()
+
+        old_name = self.tun6_encrypt_node_name
+        self.tun6_encrypt_node_name = "esp4-encrypt"
+
+        self.verify_tun_46(p6, count=63)
+        self.tun6_encrypt_node_name = old_name
+
+    def test_tun_64(self):
+        """ ipsec 6o4 tunnel """
+        # add an SPD entry to direct 4444::4 to the v4 tunnel SA
+        p6 = self.ipv6_params
+        p4 = self.ipv4_params
+
+        p4.remote_tun_if_host6 = "4444::4"
+        e = VppEnum.vl_api_ipsec_spd_action_t
+
+        VppIpsecSpdEntry(self,
+                         self.tun_spd,
+                         p4.scapy_tun_sa_id,
+                         self.pg1.remote_addr[p6.addr_type],
+                         self.pg1.remote_addr[p6.addr_type],
+                         p4.remote_tun_if_host6,
+                         p4.remote_tun_if_host6,
+                         0,
+                         priority=10,
+                         policy=e.IPSEC_API_SPD_ACTION_PROTECT,
+                         is_outbound=1).add_vpp_config()
+        d = DpoProto.DPO_PROTO_IP6
+        VppIpRoute(self,  p4.remote_tun_if_host6, p6.addr_len,
+                   [VppRoutePath(self.tun_if.remote_addr[p6.addr_type],
+                                 0xffffffff,
+                                 proto=d)]).add_vpp_config()
+
+        old_name = self.tun4_encrypt_node_name
+        self.tun4_encrypt_node_name = "esp6-encrypt"
+        self.verify_tun_64(p4, count=63)
+        self.tun4_encrypt_node_name = old_name
 
 
 class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
@@ -470,6 +544,8 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
         self.run_a_test(self.engine, self.flag, self.algo)
 
     def run_a_test(self, engine, flag, algo, payload_size=None):
+        if engine == "ia32":
+            engine = "native"
         self.vapi.cli("set crypto handler all %s" % engine)
 
         self.ipv4_params = IPsecIPv4Params()
@@ -505,13 +581,23 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
         self.verify_tra_basic4(count=NUM_PKTS)
         self.verify_tun_66(self.params[socket.AF_INET6],
                            count=NUM_PKTS)
+        #
+        # Use an odd-byte payload size to check for correct padding.
+        #
+        # 49 + 2 == 51 which should pad +1 to 52 for 4 byte alignment, +5
+        # to 56 for 8 byte alignment, and +13 to 64 for 64 byte alignment.
+        # This should catch bugs where the code is incorrectly over-padding
+        # for algorithms that don't require it
+        psz = 49 - len(IP()/ICMP()) if payload_size is None else payload_size
         self.verify_tun_44(self.params[socket.AF_INET],
-                           count=NUM_PKTS)
+                           count=NUM_PKTS, payload_size=psz)
 
         LARGE_PKT_SZ = [
+            1970,  # results in 2 chained buffers entering decrypt node
+                   # but leaving as simple buffer due to ICV removal (tra4)
+            2004,  # footer+ICV will be added to 2nd buffer (tun4)
             4010,  # ICV ends up splitted accross 2 buffers in esp_decrypt
                    # for transport4; transport6 takes normal path
-
             4020,  # same as above but tra4 and tra6 are switched
         ]
         if self.engine in engines_supporting_chain_bufs: