test/test_ipsec_esp.py

   1 import socket
   2 import unittest
   3 from scapy.layers.ipsec import ESP
   4 from scapy.layers.inet import IP, ICMP, UDP
   5 from scapy.layers.inet6 import IPv6
   6 from scapy.layers.l2 import Ether
   7 from scapy.packet import Raw
   8
   9 from parameterized import parameterized
  10 from framework import VppTestRunner
  11 from template_ipsec import IpsecTra46Tests, IpsecTun46Tests, TemplateIpsec, \
  12     IpsecTcpTests, IpsecTun4Tests, IpsecTra4Tests, config_tra_params, \
  13     config_tun_params, IPsecIPv4Params, IPsecIPv6Params, \
  14     IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6, \
  15     IpsecTun6HandoffTests, IpsecTun4HandoffTests, \
  16     IpsecTra6ExtTests
  17 from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSA,\
  18     VppIpsecSpdItfBinding
  19 from vpp_ip_route import VppIpRoute, VppRoutePath
  20 from vpp_ip import DpoProto
  21 from vpp_papi import VppEnum
  22
  23 NUM_PKTS = 67
  24 engines_supporting_chain_bufs = ["openssl"]
  25 engines = ["ia32", "ipsecmb", "openssl"]
  26
  27
  28 class ConfigIpsecESP(TemplateIpsec):
  29     encryption_type = ESP
  30     tra4_encrypt_node_name = "esp4-encrypt"
  31     tra4_decrypt_node_name = ["esp4-decrypt", "esp4-decrypt-post"]
  32     tra6_encrypt_node_name = "esp6-encrypt"
  33     tra6_decrypt_node_name = ["esp6-decrypt", "esp6-decrypt-post"]
  34     tun4_encrypt_node_name = "esp4-encrypt"
  35     tun4_decrypt_node_name = ["esp4-decrypt", "esp4-decrypt-post"]
  36     tun6_encrypt_node_name = "esp6-encrypt"
  37     tun6_decrypt_node_name = ["esp6-decrypt", "esp6-decrypt-post"]
  38
  39     @classmethod
  40     def setUpClass(cls):
  41         super(ConfigIpsecESP, cls).setUpClass()
  42
  43     @classmethod
  44     def tearDownClass(cls):
  45         super(ConfigIpsecESP, cls).tearDownClass()
  46
  47     def setUp(self):
  48         super(ConfigIpsecESP, self).setUp()
  49
  50     def tearDown(self):
  51         super(ConfigIpsecESP, self).tearDown()
  52
  53     def config_network(self, params):
  54         self.net_objs = []
  55         self.tun_if = self.pg0
  56         self.tra_if = self.pg2
  57         self.logger.info(self.vapi.ppcli("show int addr"))
  58
  59         self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
  60         self.tra_spd.add_vpp_config()
  61         self.net_objs.append(self.tra_spd)
  62         self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
  63         self.tun_spd.add_vpp_config()
  64         self.net_objs.append(self.tun_spd)
  65
  66         b = VppIpsecSpdItfBinding(self, self.tun_spd,
  67                                   self.tun_if)
  68         b.add_vpp_config()
  69         self.net_objs.append(b)
  70
  71         b = VppIpsecSpdItfBinding(self, self.tra_spd,
  72                                   self.tra_if)
  73         b.add_vpp_config()
  74         self.net_objs.append(b)
  75
  76         for p in params:
  77             self.config_esp_tra(p)
  78             config_tra_params(p, self.encryption_type)
  79         for p in params:
  80             self.config_esp_tun(p)
  81             config_tun_params(p, self.encryption_type, self.tun_if)
  82
  83         for p in params:
  84             d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4
  85             r = VppIpRoute(self,  p.remote_tun_if_host, p.addr_len,
  86                            [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
  87                                          0xffffffff,
  88                                          proto=d)])
  89             r.add_vpp_config()
  90             self.net_objs.append(r)
  91
  92         self.logger.info(self.vapi.ppcli("show ipsec all"))
  93
  94     def unconfig_network(self):
  95         for o in reversed(self.net_objs):
  96             o.remove_vpp_config()
  97         self.net_objs = []
  98
  99     def config_esp_tun(self, params):
 100         addr_type = params.addr_type
 101         scapy_tun_sa_id = params.scapy_tun_sa_id
 102         scapy_tun_spi = params.scapy_tun_spi
 103         vpp_tun_sa_id = params.vpp_tun_sa_id
 104         vpp_tun_spi = params.vpp_tun_spi
 105         auth_algo_vpp_id = params.auth_algo_vpp_id
 106         auth_key = params.auth_key
 107         crypt_algo_vpp_id = params.crypt_algo_vpp_id
 108         crypt_key = params.crypt_key
 109         remote_tun_if_host = params.remote_tun_if_host
 110         addr_any = params.addr_any
 111         addr_bcast = params.addr_bcast
 112         e = VppEnum.vl_api_ipsec_spd_action_t
 113         flags = params.flags
 114         tun_flags = params.tun_flags
 115         salt = params.salt
 116         objs = []
 117
 118         params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi,
 119                                       auth_algo_vpp_id, auth_key,
 120                                       crypt_algo_vpp_id, crypt_key,
 121                                       self.vpp_esp_protocol,
 122                                       self.tun_if.local_addr[addr_type],
 123                                       self.tun_if.remote_addr[addr_type],
 124                                       tun_flags=tun_flags,
 125                                       dscp=params.dscp,
 126                                       flags=flags,
 127                                       salt=salt,
 128                                       hop_limit=params.outer_hop_limit)
 129         params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi,
 130                                        auth_algo_vpp_id, auth_key,
 131                                        crypt_algo_vpp_id, crypt_key,
 132                                        self.vpp_esp_protocol,
 133                                        self.tun_if.remote_addr[addr_type],
 134                                        self.tun_if.local_addr[addr_type],
 135                                        tun_flags=tun_flags,
 136                                        dscp=params.dscp,
 137                                        flags=flags,
 138                                        salt=salt,
 139                                        hop_limit=params.outer_hop_limit)
 140         objs.append(params.tun_sa_in)
 141         objs.append(params.tun_sa_out)
 142
 143         params.spd_policy_in_any = VppIpsecSpdEntry(self, self.tun_spd,
 144                                                     scapy_tun_sa_id,
 145                                                     addr_any, addr_bcast,
 146                                                     addr_any, addr_bcast,
 147                                                     socket.IPPROTO_ESP)
 148         params.spd_policy_out_any = VppIpsecSpdEntry(self, self.tun_spd,
 149                                                      scapy_tun_sa_id,
 150                                                      addr_any, addr_bcast,
 151                                                      addr_any, addr_bcast,
 152                                                      socket.IPPROTO_ESP,
 153                                                      is_outbound=0)
 154         objs.append(params.spd_policy_out_any)
 155         objs.append(params.spd_policy_in_any)
 156
 157         objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
 158                                      remote_tun_if_host, remote_tun_if_host,
 159                                      self.pg1.remote_addr[addr_type],
 160                                      self.pg1.remote_addr[addr_type],
 161                                      0,
 162                                      priority=10,
 163                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 164                                      is_outbound=0))
 165         objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 166                                      self.pg1.remote_addr[addr_type],
 167                                      self.pg1.remote_addr[addr_type],
 168                                      remote_tun_if_host, remote_tun_if_host,
 169                                      0,
 170                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 171                                      priority=10))
 172         objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
 173                                      remote_tun_if_host, remote_tun_if_host,
 174                                      self.pg0.local_addr[addr_type],
 175                                      self.pg0.local_addr[addr_type],
 176                                      0,
 177                                      priority=20,
 178                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 179                                      is_outbound=0))
 180         objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 181                                      self.pg0.local_addr[addr_type],
 182                                      self.pg0.local_addr[addr_type],
 183                                      remote_tun_if_host, remote_tun_if_host,
 184                                      0,
 185                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 186                                      priority=20))
 187         for o in objs:
 188             o.add_vpp_config()
 189         self.net_objs = self.net_objs + objs
 190
 191     def config_esp_tra(self, params):
 192         addr_type = params.addr_type
 193         scapy_tra_sa_id = params.scapy_tra_sa_id
 194         scapy_tra_spi = params.scapy_tra_spi
 195         vpp_tra_sa_id = params.vpp_tra_sa_id
 196         vpp_tra_spi = params.vpp_tra_spi
 197         auth_algo_vpp_id = params.auth_algo_vpp_id
 198         auth_key = params.auth_key
 199         crypt_algo_vpp_id = params.crypt_algo_vpp_id
 200         crypt_key = params.crypt_key
 201         addr_any = params.addr_any
 202         addr_bcast = params.addr_bcast
 203         flags = (VppEnum.vl_api_ipsec_sad_flags_t.
 204                  IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
 205         e = VppEnum.vl_api_ipsec_spd_action_t
 206         flags = params.flags | flags
 207         salt = params.salt
 208         objs = []
 209
 210         params.tra_sa_in = VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi,
 211                                       auth_algo_vpp_id, auth_key,
 212                                       crypt_algo_vpp_id, crypt_key,
 213                                       self.vpp_esp_protocol,
 214                                       flags=flags,
 215                                       salt=salt)
 216         params.tra_sa_out = VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi,
 217                                        auth_algo_vpp_id, auth_key,
 218                                        crypt_algo_vpp_id, crypt_key,
 219                                        self.vpp_esp_protocol,
 220                                        flags=flags,
 221                                        salt=salt)
 222         objs.append(params.tra_sa_in)
 223         objs.append(params.tra_sa_out)
 224
 225         objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 226                                      addr_any, addr_bcast,
 227                                      addr_any, addr_bcast,
 228                                      socket.IPPROTO_ESP))
 229         objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 230                                      addr_any, addr_bcast,
 231                                      addr_any, addr_bcast,
 232                                      socket.IPPROTO_ESP,
 233                                      is_outbound=0))
 234         objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 235                                      self.tra_if.local_addr[addr_type],
 236                                      self.tra_if.local_addr[addr_type],
 237                                      self.tra_if.remote_addr[addr_type],
 238                                      self.tra_if.remote_addr[addr_type],
 239                                      0, priority=10,
 240                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 241                                      is_outbound=0))
 242         objs.append(VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
 243                                      self.tra_if.local_addr[addr_type],
 244                                      self.tra_if.local_addr[addr_type],
 245                                      self.tra_if.remote_addr[addr_type],
 246                                      self.tra_if.remote_addr[addr_type],
 247                                      0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 248                                      priority=10))
 249         for o in objs:
 250             o.add_vpp_config()
 251         self.net_objs = self.net_objs + objs
 252
 253
 254 class TemplateIpsecEsp(ConfigIpsecESP):
 255     """
 256     Basic test for ipsec esp sanity - tunnel and transport modes.
 257
 258     Below 4 cases are covered as part of this test
 259     1) ipsec esp v4 transport basic test  - IPv4 Transport mode
 260         scenario using HMAC-SHA1-96 integrity algo
 261     2) ipsec esp v4 transport burst test
 262         Above test for 257 pkts
 263     3) ipsec esp 4o4 tunnel basic test    - IPv4 Tunnel mode
 264         scenario using HMAC-SHA1-96 integrity algo
 265     4) ipsec esp 4o4 tunnel burst test
 266         Above test for 257 pkts
 267
 268     TRANSPORT MODE:
 269
 270      ---   encrypt   ---
 271     |pg2| <-------> |VPP|
 272      ---   decrypt   ---
 273
 274     TUNNEL MODE:
 275
 276      ---   encrypt   ---   plain   ---
 277     |pg0| <-------  |VPP| <------ |pg1|
 278      ---             ---           ---
 279
 280      ---   decrypt   ---   plain   ---
 281     |pg0| ------->  |VPP| ------> |pg1|
 282      ---             ---           ---
 283     """
 284
 285     @classmethod
 286     def setUpClass(cls):
 287         super(TemplateIpsecEsp, cls).setUpClass()
 288
 289     @classmethod
 290     def tearDownClass(cls):
 291         super(TemplateIpsecEsp, cls).tearDownClass()
 292
 293     def setUp(self):
 294         super(TemplateIpsecEsp, self).setUp()
 295         self.config_network(self.params.values())
 296
 297     def tearDown(self):
 298         self.unconfig_network()
 299         super(TemplateIpsecEsp, self).tearDown()
 300
 301
 302 class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests,
 303                     IpsecTun46Tests, IpsecTra6ExtTests):
 304     """ Ipsec ESP - TUN & TRA tests """
 305
 306     @classmethod
 307     def setUpClass(cls):
 308         super(TestIpsecEsp1, cls).setUpClass()
 309
 310     @classmethod
 311     def tearDownClass(cls):
 312         super(TestIpsecEsp1, cls).tearDownClass()
 313
 314     def setUp(self):
 315         super(TestIpsecEsp1, self).setUp()
 316
 317     def tearDown(self):
 318         super(TestIpsecEsp1, self).tearDown()
 319
 320     def test_tun_46(self):
 321         """ ipsec 4o6 tunnel """
 322         # add an SPD entry to direct 2.2.2.2 to the v6 tunnel SA
 323         p6 = self.ipv6_params
 324         p4 = self.ipv4_params
 325
 326         p6.remote_tun_if_host4 = "2.2.2.2"
 327         e = VppEnum.vl_api_ipsec_spd_action_t
 328
 329         VppIpsecSpdEntry(self,
 330                          self.tun_spd,
 331                          p6.scapy_tun_sa_id,
 332                          self.pg1.remote_addr[p4.addr_type],
 333                          self.pg1.remote_addr[p4.addr_type],
 334                          p6.remote_tun_if_host4,
 335                          p6.remote_tun_if_host4,
 336                          0,
 337                          priority=10,
 338                          policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 339                          is_outbound=1).add_vpp_config()
 340         VppIpRoute(self,  p6.remote_tun_if_host4, p4.addr_len,
 341                    [VppRoutePath(self.tun_if.remote_addr[p4.addr_type],
 342                                  0xffffffff)]).add_vpp_config()
 343
 344         old_name = self.tun6_encrypt_node_name
 345         self.tun6_encrypt_node_name = "esp4-encrypt"
 346
 347         self.verify_tun_46(p6, count=63)
 348         self.tun6_encrypt_node_name = old_name
 349
 350     def test_tun_64(self):
 351         """ ipsec 6o4 tunnel """
 352         # add an SPD entry to direct 4444::4 to the v4 tunnel SA
 353         p6 = self.ipv6_params
 354         p4 = self.ipv4_params
 355
 356         p4.remote_tun_if_host6 = "4444::4"
 357         e = VppEnum.vl_api_ipsec_spd_action_t
 358
 359         VppIpsecSpdEntry(self,
 360                          self.tun_spd,
 361                          p4.scapy_tun_sa_id,
 362                          self.pg1.remote_addr[p6.addr_type],
 363                          self.pg1.remote_addr[p6.addr_type],
 364                          p4.remote_tun_if_host6,
 365                          p4.remote_tun_if_host6,
 366                          0,
 367                          priority=10,
 368                          policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 369                          is_outbound=1).add_vpp_config()
 370         d = DpoProto.DPO_PROTO_IP6
 371         VppIpRoute(self,  p4.remote_tun_if_host6, p6.addr_len,
 372                    [VppRoutePath(self.tun_if.remote_addr[p6.addr_type],
 373                                  0xffffffff,
 374                                  proto=d)]).add_vpp_config()
 375
 376         old_name = self.tun4_encrypt_node_name
 377         self.tun4_encrypt_node_name = "esp6-encrypt"
 378         self.verify_tun_64(p4, count=63)
 379         self.tun4_encrypt_node_name = old_name
 380
 381
 382 class TestIpsecEspTun(TemplateIpsecEsp, IpsecTun46Tests):
 383     """ Ipsec ESP - TUN encap tests """
 384
 385     def setUp(self):
 386         self.ipv4_params = IPsecIPv4Params()
 387         self.ipv6_params = IPsecIPv6Params()
 388
 389         c = (VppEnum.vl_api_tunnel_encap_decap_flags_t.
 390              TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
 391         c1 = c | (VppEnum.vl_api_tunnel_encap_decap_flags_t.
 392                   TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
 393
 394         self.ipv4_params.tun_flags = c
 395         self.ipv6_params.tun_flags = c1
 396
 397         super(TestIpsecEspTun, self).setUp()
 398
 399     def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
 400         # set the DSCP + ECN - flags are set to copy only DSCP
 401         return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
 402                 IP(src=src, dst=dst, tos=5) /
 403                 UDP(sport=4444, dport=4444) /
 404                 Raw(b'X' * payload_size)
 405                 for i in range(count)]
 406
 407     def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54):
 408         # set the DSCP + ECN - flags are set to copy both
 409         return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
 410                 IPv6(src=src, dst=dst, tc=5) /
 411                 UDP(sport=4444, dport=4444) /
 412                 Raw(b'X' * payload_size)
 413                 for i in range(count)]
 414
 415     def verify_encrypted(self, p, sa, rxs):
 416         # just check that only the DSCP is copied
 417         for rx in rxs:
 418             self.assertEqual(rx[IP].tos, 4)
 419
 420     def verify_encrypted6(self, p, sa, rxs):
 421         # just check that the DSCP & ECN are copied
 422         for rx in rxs:
 423             self.assertEqual(rx[IPv6].tc, 5)
 424
 425
 426 class TestIpsecEspTun2(TemplateIpsecEsp, IpsecTun46Tests):
 427     """ Ipsec ESP - TUN DSCP tests """
 428
 429     def setUp(self):
 430         self.ipv4_params = IPsecIPv4Params()
 431         self.ipv6_params = IPsecIPv6Params()
 432
 433         self.ipv4_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF
 434         self.ipv6_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11
 435
 436         super(TestIpsecEspTun2, self).setUp()
 437
 438     def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
 439         return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
 440                 IP(src=src, dst=dst) /
 441                 UDP(sport=4444, dport=4444) /
 442                 Raw(b'X' * payload_size)
 443                 for i in range(count)]
 444
 445     def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54):
 446         return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
 447                 IPv6(src=src, dst=dst) /
 448                 UDP(sport=4444, dport=4444) /
 449                 Raw(b'X' * payload_size)
 450                 for i in range(count)]
 451
 452     def verify_encrypted(self, p, sa, rxs):
 453         # just check that only the DSCP is set
 454         for rx in rxs:
 455             self.assertEqual(rx[IP].tos,
 456                              VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF << 2)
 457
 458     def verify_encrypted6(self, p, sa, rxs):
 459         # just check that the DSCP is set
 460         for rx in rxs:
 461             self.assertEqual(rx[IPv6].tc,
 462                              VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11 << 2)
 463
 464
 465 class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
 466     """ Ipsec ESP - TCP tests """
 467     pass
 468
 469
 470 class TestIpsecEspAsync(TemplateIpsecEsp):
 471     """ Ipsec ESP - Aysnc tests """
 472
 473     worker_config = "workers 2"
 474
 475     def setUp(self):
 476         super(TestIpsecEspAsync, self).setUp()
 477
 478         self.p_sync = IPsecIPv4Params()
 479
 480         self.p_sync.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t.
 481                                          IPSEC_API_CRYPTO_ALG_AES_CBC_256)
 482         self.p_sync.crypt_algo = 'AES-CBC'  # scapy name
 483         self.p_sync.crypt_key = b'JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h'
 484
 485         self.p_sync.scapy_tun_sa_id += 0xf0000
 486         self.p_sync.scapy_tun_spi += 0xf0000
 487         self.p_sync.vpp_tun_sa_id += 0xf0000
 488         self.p_sync.vpp_tun_spi += 0xf0000
 489         self.p_sync.remote_tun_if_host = "2.2.2.2"
 490         e = VppEnum.vl_api_ipsec_spd_action_t
 491
 492         self.p_sync.sa = VppIpsecSA(
 493             self,
 494             self.p_sync.vpp_tun_sa_id,
 495             self.p_sync.vpp_tun_spi,
 496             self.p_sync.auth_algo_vpp_id,
 497             self.p_sync.auth_key,
 498             self.p_sync.crypt_algo_vpp_id,
 499             self.p_sync.crypt_key,
 500             self.vpp_esp_protocol,
 501             self.tun_if.local_addr[self.p_sync.addr_type],
 502             self.tun_if.remote_addr[self.p_sync.addr_type]).add_vpp_config()
 503         self.p_sync.spd = VppIpsecSpdEntry(
 504             self,
 505             self.tun_spd,
 506             self.p_sync.vpp_tun_sa_id,
 507             self.pg1.remote_addr[self.p_sync.addr_type],
 508             self.pg1.remote_addr[self.p_sync.addr_type],
 509             self.p_sync.remote_tun_if_host,
 510             self.p_sync.remote_tun_if_host,
 511             0,
 512             priority=1,
 513             policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 514             is_outbound=1).add_vpp_config()
 515         VppIpRoute(self,
 516                    self.p_sync.remote_tun_if_host,
 517                    self.p_sync.addr_len,
 518                    [VppRoutePath(
 519                        self.tun_if.remote_addr[self.p_sync.addr_type],
 520                        0xffffffff)]).add_vpp_config()
 521         config_tun_params(self.p_sync, self.encryption_type, self.tun_if)
 522
 523         self.p_async = IPsecIPv4Params()
 524
 525         self.p_async.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t.
 526                                           IPSEC_API_CRYPTO_ALG_AES_GCM_256)
 527         self.p_async.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
 528                                          IPSEC_API_INTEG_ALG_NONE)
 529         self.p_async.crypt_algo = 'AES-GCM'  # scapy name
 530         self.p_async.crypt_key = b'JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h'
 531         self.p_async.auth_algo = 'NULL'
 532
 533         self.p_async.scapy_tun_sa_id += 0xe0000
 534         self.p_async.scapy_tun_spi += 0xe0000
 535         self.p_async.vpp_tun_sa_id += 0xe0000
 536         self.p_async.vpp_tun_spi += 0xe0000
 537         self.p_async.remote_tun_if_host = "2.2.2.3"
 538
 539         iflags = VppEnum.vl_api_ipsec_sad_flags_t
 540         self.p_async.flags = (iflags.IPSEC_API_SAD_FLAG_USE_ESN |
 541                               iflags.IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY |
 542                               iflags.IPSEC_API_SAD_FLAG_ASYNC)
 543
 544         self.p_async.sa = VppIpsecSA(
 545             self,
 546             self.p_async.vpp_tun_sa_id,
 547             self.p_async.vpp_tun_spi,
 548             self.p_async.auth_algo_vpp_id,
 549             self.p_async.auth_key,
 550             self.p_async.crypt_algo_vpp_id,
 551             self.p_async.crypt_key,
 552             self.vpp_esp_protocol,
 553             self.tun_if.local_addr[self.p_async.addr_type],
 554             self.tun_if.remote_addr[self.p_async.addr_type],
 555             flags=self.p_async.flags).add_vpp_config()
 556         self.p_async.spd = VppIpsecSpdEntry(
 557             self,
 558             self.tun_spd,
 559             self.p_async.vpp_tun_sa_id,
 560             self.pg1.remote_addr[self.p_async.addr_type],
 561             self.pg1.remote_addr[self.p_async.addr_type],
 562             self.p_async.remote_tun_if_host,
 563             self.p_async.remote_tun_if_host,
 564             0,
 565             priority=2,
 566             policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 567             is_outbound=1).add_vpp_config()
 568         VppIpRoute(self,
 569                    self.p_async.remote_tun_if_host,
 570                    self.p_async.addr_len,
 571                    [VppRoutePath(
 572                        self.tun_if.remote_addr[self.p_async.addr_type],
 573                        0xffffffff)]).add_vpp_config()
 574         config_tun_params(self.p_async, self.encryption_type, self.tun_if)
 575
 576     def test_dual_stream(self):
 577         """ Alternating SAs """
 578         p = self.params[self.p_sync.addr_type]
 579         self.vapi.ipsec_set_async_mode(async_enable=True)
 580
 581         pkts = [(Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 582                  IP(src=self.pg1.remote_ip4,
 583                     dst=self.p_sync.remote_tun_if_host) /
 584                  UDP(sport=4444, dport=4444) /
 585                  Raw(b'0x0' * 200)),
 586                 (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 587                  IP(src=self.pg1.remote_ip4,
 588                     dst=p.remote_tun_if_host) /
 589                  UDP(sport=4444, dport=4444) /
 590                  Raw(b'0x0' * 200))]
 591         pkts *= 1023
 592
 593         rxs = self.send_and_expect(self.pg1, pkts, self.pg0)
 594
 595         self.assertEqual(len(rxs), len(pkts))
 596
 597         for rx in rxs:
 598             if rx[ESP].spi == p.scapy_tun_spi:
 599                 decrypted = p.vpp_tun_sa.decrypt(rx[IP])
 600             elif rx[ESP].spi == self.p_sync.vpp_tun_spi:
 601                 decrypted = self.p_sync.scapy_tun_sa.decrypt(rx[IP])
 602             else:
 603                 rx.show()
 604                 self.assertTrue(False)
 605
 606         self.p_sync.spd.remove_vpp_config()
 607         self.p_sync.sa.remove_vpp_config()
 608         self.p_async.spd.remove_vpp_config()
 609         self.p_async.sa.remove_vpp_config()
 610         self.vapi.ipsec_set_async_mode(async_enable=False)
 611
 612     def test_sync_async_noop_stream(self):
 613         """ Alternating SAs sync/async/noop """
 614         p = self.params[self.p_sync.addr_type]
 615
 616         # first pin the default/noop SA to worker 0
 617         pkts = [(Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 618                  IP(src=self.pg1.remote_ip4,
 619                     dst=p.remote_tun_if_host) /
 620                  UDP(sport=4444, dport=4444) /
 621                  Raw(b'0x0' * 200))]
 622         rxs = self.send_and_expect(self.pg1, pkts, self.pg0, worker=0)
 623
 624         self.logger.info(self.vapi.cli("sh ipsec sa"))
 625         self.logger.info(self.vapi.cli("sh crypto async status"))
 626
 627         # then use all the other SAs on worker 1.
 628         # some will handoff, other take the sync and async paths
 629         pkts = [(Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 630                  IP(src=self.pg1.remote_ip4,
 631                     dst=self.p_sync.remote_tun_if_host) /
 632                  UDP(sport=4444, dport=4444) /
 633                  Raw(b'0x0' * 200)),
 634                 (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 635                  IP(src=self.pg1.remote_ip4,
 636                     dst=p.remote_tun_if_host) /
 637                  UDP(sport=4444, dport=4444) /
 638                  Raw(b'0x0' * 200)),
 639                 (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 640                  IP(src=self.pg1.remote_ip4,
 641                     dst=self.p_async.remote_tun_if_host) /
 642                  UDP(sport=4444, dport=4444) /
 643                  Raw(b'0x0' * 200))]
 644         pkts *= 1023
 645
 646         rxs = self.send_and_expect(self.pg1, pkts, self.pg0, worker=1)
 647
 648         self.assertEqual(len(rxs), len(pkts))
 649
 650         for rx in rxs:
 651             if rx[ESP].spi == p.scapy_tun_spi:
 652                 decrypted = p.vpp_tun_sa.decrypt(rx[IP])
 653             elif rx[ESP].spi == self.p_sync.vpp_tun_spi:
 654                 decrypted = self.p_sync.scapy_tun_sa.decrypt(rx[IP])
 655             elif rx[ESP].spi == self.p_async.vpp_tun_spi:
 656                 decrypted = self.p_async.scapy_tun_sa.decrypt(rx[IP])
 657             else:
 658                 rx.show()
 659                 self.assertTrue(False)
 660
 661         self.p_sync.spd.remove_vpp_config()
 662         self.p_sync.sa.remove_vpp_config()
 663         self.p_async.spd.remove_vpp_config()
 664         self.p_async.sa.remove_vpp_config()
 665
 666         # async mode should have been disabled now that there are
 667         # no async SAs. there's no API for this, so a reluctant
 668         # screen scrape.
 669         self.assertTrue("DISABLED" in self.vapi.cli("sh crypto async status"))
 670
 671
 672 class TestIpsecEspHandoff(TemplateIpsecEsp,
 673                           IpsecTun6HandoffTests,
 674                           IpsecTun4HandoffTests):
 675     """ Ipsec ESP - handoff tests """
 676     pass
 677
 678
 679 class TemplateIpsecEspUdp(ConfigIpsecESP):
 680     """
 681     UDP encapped ESP
 682     """
 683
 684     @classmethod
 685     def setUpClass(cls):
 686         super(TemplateIpsecEspUdp, cls).setUpClass()
 687
 688     @classmethod
 689     def tearDownClass(cls):
 690         super(TemplateIpsecEspUdp, cls).tearDownClass()
 691
 692     def setUp(self):
 693         super(TemplateIpsecEspUdp, self).setUp()
 694         self.net_objs = []
 695         self.tun_if = self.pg0
 696         self.tra_if = self.pg2
 697         self.logger.info(self.vapi.ppcli("show int addr"))
 698
 699         p = self.ipv4_params
 700         p.flags = (VppEnum.vl_api_ipsec_sad_flags_t.
 701                    IPSEC_API_SAD_FLAG_UDP_ENCAP)
 702         p.nat_header = UDP(sport=5454, dport=4500)
 703
 704         self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
 705         self.tra_spd.add_vpp_config()
 706         VppIpsecSpdItfBinding(self, self.tra_spd,
 707                               self.tra_if).add_vpp_config()
 708
 709         self.config_esp_tra(p)
 710         config_tra_params(p, self.encryption_type)
 711
 712         self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
 713         self.tun_spd.add_vpp_config()
 714         VppIpsecSpdItfBinding(self, self.tun_spd,
 715                               self.tun_if).add_vpp_config()
 716
 717         self.config_esp_tun(p)
 718         self.logger.info(self.vapi.ppcli("show ipsec all"))
 719
 720         d = DpoProto.DPO_PROTO_IP4
 721         VppIpRoute(self,  p.remote_tun_if_host, p.addr_len,
 722                    [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
 723                                  0xffffffff,
 724                                  proto=d)]).add_vpp_config()
 725
 726     def tearDown(self):
 727         super(TemplateIpsecEspUdp, self).tearDown()
 728
 729     def show_commands_at_teardown(self):
 730         self.logger.info(self.vapi.cli("show hardware"))
 731
 732
 733 class TestIpsecEspUdp(TemplateIpsecEspUdp, IpsecTra4Tests):
 734     """ Ipsec NAT-T ESP UDP tests """
 735     pass
 736
 737
 738 class MyParameters():
 739     def __init__(self):
 740         flag_esn = VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN
 741         self.flags = [0, flag_esn]
 742         # foreach crypto algorithm
 743         self.algos = {
 744             'AES-GCM-128/NONE': {
 745                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 746                                  IPSEC_API_CRYPTO_ALG_AES_GCM_128),
 747                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 748                                 IPSEC_API_INTEG_ALG_NONE),
 749                   'scapy-crypto': "AES-GCM",
 750                   'scapy-integ': "NULL",
 751                   'key': b"JPjyOWBeVEQiMe7h",
 752                   'salt': 0},
 753             'AES-GCM-192/NONE': {
 754                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 755                                  IPSEC_API_CRYPTO_ALG_AES_GCM_192),
 756                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 757                                 IPSEC_API_INTEG_ALG_NONE),
 758                   'scapy-crypto': "AES-GCM",
 759                   'scapy-integ': "NULL",
 760                   'key': b"JPjyOWBeVEQiMe7h01234567",
 761                   'salt': 1010},
 762             'AES-GCM-256/NONE': {
 763                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 764                                  IPSEC_API_CRYPTO_ALG_AES_GCM_256),
 765                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 766                                 IPSEC_API_INTEG_ALG_NONE),
 767                   'scapy-crypto': "AES-GCM",
 768                   'scapy-integ': "NULL",
 769                   'key': b"JPjyOWBeVEQiMe7h0123456787654321",
 770                   'salt': 2020},
 771             'AES-CBC-128/MD5-96': {
 772                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 773                                  IPSEC_API_CRYPTO_ALG_AES_CBC_128),
 774                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 775                                 IPSEC_API_INTEG_ALG_MD5_96),
 776                   'scapy-crypto': "AES-CBC",
 777                   'scapy-integ': "HMAC-MD5-96",
 778                   'salt': 0,
 779                   'key': b"JPjyOWBeVEQiMe7h"},
 780             'AES-CBC-192/SHA1-96': {
 781                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 782                                  IPSEC_API_CRYPTO_ALG_AES_CBC_192),
 783                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 784                                 IPSEC_API_INTEG_ALG_SHA1_96),
 785                   'scapy-crypto': "AES-CBC",
 786                   'scapy-integ': "HMAC-SHA1-96",
 787                   'salt': 0,
 788                   'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"},
 789             'AES-CBC-256/SHA1-96': {
 790                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 791                                  IPSEC_API_CRYPTO_ALG_AES_CBC_256),
 792                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 793                                 IPSEC_API_INTEG_ALG_SHA1_96),
 794                   'scapy-crypto': "AES-CBC",
 795                   'scapy-integ': "HMAC-SHA1-96",
 796                   'salt': 0,
 797                   'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"},
 798             '3DES-CBC/SHA1-96': {
 799                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 800                                  IPSEC_API_CRYPTO_ALG_3DES_CBC),
 801                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 802                                 IPSEC_API_INTEG_ALG_SHA1_96),
 803                   'scapy-crypto': "3DES",
 804                   'scapy-integ': "HMAC-SHA1-96",
 805                   'salt': 0,
 806                   'key': b"JPjyOWBeVEQiMe7h00112233"},
 807             'NONE/SHA1-96': {
 808                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 809                                  IPSEC_API_CRYPTO_ALG_NONE),
 810                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 811                                 IPSEC_API_INTEG_ALG_SHA1_96),
 812                   'scapy-crypto': "NULL",
 813                   'scapy-integ': "HMAC-SHA1-96",
 814                   'salt': 0,
 815                   'key': b"JPjyOWBeVEQiMe7h00112233"},
 816             'AES-CTR-128/SHA1-96': {
 817                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 818                                  IPSEC_API_CRYPTO_ALG_AES_CTR_128),
 819                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 820                                 IPSEC_API_INTEG_ALG_SHA1_96),
 821                   'scapy-crypto': "AES-CTR",
 822                   'scapy-integ': "HMAC-SHA1-96",
 823                   'salt': 0,
 824                   'key': b"JPjyOWBeVEQiMe7h"},
 825             'AES-CTR-192/SHA1-96': {
 826                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 827                                  IPSEC_API_CRYPTO_ALG_AES_CTR_192),
 828                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 829                                 IPSEC_API_INTEG_ALG_SHA1_96),
 830                   'scapy-crypto': "AES-CTR",
 831                   'scapy-integ': "HMAC-SHA1-96",
 832                   'salt': 1010,
 833                   'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"},
 834             'AES-CTR-256/SHA1-96': {
 835                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 836                                  IPSEC_API_CRYPTO_ALG_AES_CTR_256),
 837                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 838                                 IPSEC_API_INTEG_ALG_SHA1_96),
 839                   'scapy-crypto': "AES-CTR",
 840                   'scapy-integ': "HMAC-SHA1-96",
 841                   'salt': 2020,
 842                   'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"}}
 843
 844
 845 class RunTestIpsecEspAll(ConfigIpsecESP,
 846                          IpsecTra4, IpsecTra6,
 847                          IpsecTun4, IpsecTun6):
 848     """ Ipsec ESP all Algos """
 849
 850     @classmethod
 851     def setUpConstants(cls):
 852         test_args = str.split(cls.__doc__, " ")
 853         engine = test_args[0]
 854         if engine == "async":
 855             cls.worker_config = "workers 2"
 856         super(RunTestIpsecEspAll, cls).setUpConstants()
 857
 858     def setUp(self):
 859         super(RunTestIpsecEspAll, self).setUp()
 860         test_args = str.split(self.__doc__, " ")
 861
 862         params = MyParameters()
 863         self.engine = test_args[0]
 864         self.flag = params.flags[0]
 865         if test_args[1] == 'ESN':
 866             self.flag = params.flags[1]
 867
 868         self.algo = params.algos[test_args[2]]
 869         self.async_mode = False
 870         if self.engine == "async":
 871             self.async_mode = True
 872
 873     def tearDown(self):
 874         super(RunTestIpsecEspAll, self).tearDown()
 875
 876     def run_test(self):
 877         self.run_a_test(self.engine, self.flag, self.algo)
 878
 879     def run_a_test(self, engine, flag, algo, payload_size=None):
 880         if self.async_mode:
 881             self.vapi.cli("set ipsec async mode on")
 882         else:
 883             self.vapi.cli("set crypto handler all %s" % engine)
 884
 885         self.logger.info(self.vapi.cli("show crypto async status"))
 886         self.ipv4_params = IPsecIPv4Params()
 887         self.ipv6_params = IPsecIPv6Params()
 888
 889         self.params = {self.ipv4_params.addr_type:
 890                        self.ipv4_params,
 891                        self.ipv6_params.addr_type:
 892                        self.ipv6_params}
 893
 894         for _, p in self.params.items():
 895             p.auth_algo_vpp_id = algo['vpp-integ']
 896             p.crypt_algo_vpp_id = algo['vpp-crypto']
 897             p.crypt_algo = algo['scapy-crypto']
 898             p.auth_algo = algo['scapy-integ']
 899             p.crypt_key = algo['key']
 900             p.salt = algo['salt']
 901             p.flags = p.flags | flag
 902             p.outer_flow_label = 243224
 903             p.async_mode = self.async_mode
 904
 905         self.reporter.send_keep_alive(self)
 906
 907         #
 908         # configure the SPDs. SAs, etc
 909         #
 910         self.config_network(self.params.values())
 911
 912         #
 913         # run some traffic.
 914         #  An exhautsive 4o6, 6o4 is not necessary
 915         #  for each algo
 916         #
 917         self.verify_tra_basic6(count=NUM_PKTS)
 918         self.verify_tra_basic4(count=NUM_PKTS)
 919         self.verify_tun_66(self.params[socket.AF_INET6],
 920                            count=NUM_PKTS)
 921         #
 922         # Use an odd-byte payload size to check for correct padding.
 923         #
 924         # 49 + 2 == 51 which should pad +1 to 52 for 4 byte alignment, +5
 925         # to 56 for 8 byte alignment, and +13 to 64 for 64 byte alignment.
 926         # This should catch bugs where the code is incorrectly over-padding
 927         # for algorithms that don't require it
 928         psz = 49 - len(IP()/ICMP()) if payload_size is None else payload_size
 929         self.verify_tun_44(self.params[socket.AF_INET],
 930                            count=NUM_PKTS, payload_size=psz)
 931
 932         LARGE_PKT_SZ = [
 933             1970,  # results in 2 chained buffers entering decrypt node
 934                    # but leaving as simple buffer due to ICV removal (tra4)
 935             2004,  # footer+ICV will be added to 2nd buffer (tun4)
 936             4010,  # ICV ends up splitted accross 2 buffers in esp_decrypt
 937                    # for transport4; transport6 takes normal path
 938             4020,  # same as above but tra4 and tra6 are switched
 939         ]
 940         if self.engine in engines_supporting_chain_bufs:
 941             for sz in LARGE_PKT_SZ:
 942                 self.verify_tra_basic4(count=NUM_PKTS, payload_size=sz)
 943                 self.verify_tra_basic6(count=NUM_PKTS, payload_size=sz)
 944                 self.verify_tun_66(self.params[socket.AF_INET6],
 945                                    count=NUM_PKTS, payload_size=sz)
 946                 self.verify_tun_44(self.params[socket.AF_INET],
 947                                    count=NUM_PKTS, payload_size=sz)
 948
 949         #
 950         # swap the handlers while SAs are up
 951         #
 952         for e in engines:
 953             if e != engine:
 954                 self.vapi.cli("set crypto handler all %s" % e)
 955                 self.verify_tra_basic4(count=NUM_PKTS)
 956
 957         #
 958         # remove the SPDs, SAs, etc
 959         #
 960         self.unconfig_network()
 961
 962         #
 963         # reconfigure the network and SA to run the
 964         # anti replay tests
 965         #
 966         self.config_network(self.params.values())
 967         self.verify_tra_anti_replay()
 968         self.unconfig_network()
 969
 970 #
 971 # To generate test classes, do:
 972 #   grep '# GEN' test_ipsec_esp.py | sed -e 's/# GEN //g' | bash
 973 #
 974 # GEN for ENG in native ipsecmb openssl; do \
 975 # GEN   for FLG in noESN ESN; do for ALG in AES-GCM-128/NONE \
 976 # GEN     AES-GCM-192/NONE AES-GCM-256/NONE AES-CBC-128/MD5-96 \
 977 # GEN     AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96 \
 978 # GEN     3DES-CBC/SHA1-96 NONE/SHA1-96 \
 979 # GEN     AES-CTR-128/SHA1-96 AES-CTR-192/SHA1-96 AES-CTR-256/SHA1-96; do \
 980 # GEN      [[ ${FLG} == "ESN" &&  ${ALG} == *"NONE" ]] && continue
 981 # GEN      echo -e "\n\nclass Test_${ENG}_${FLG}_${ALG}(RunTestIpsecEspAll):" |
 982 # GEN             sed -e 's/-/_/g' -e 's#/#_#g' ; \
 983 # GEN      echo '    """'$ENG $FLG $ALG IPSec test'"""' ;
 984 # GEN      echo "    def test_ipsec(self):";
 985 # GEN      echo "        self.run_test()";
 986 # GEN done; done; done
 987 #
 988 # GEN   for FLG in noESN ESN; do for ALG in \
 989 # GEN     AES-GCM-128/NONE AES-GCM-192/NONE AES-GCM-256/NONE \
 990 # GEN     AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96; do \
 991 # GEN      [[ ${FLG} == "ESN" &&  ${ALG} == *"NONE" ]] && continue
 992 # GEN      echo -e "\n\nclass Test_async_${FLG}_${ALG}(RunTestIpsecEspAll):" |
 993 # GEN             sed -e 's/-/_/g' -e 's#/#_#g' ; \
 994 # GEN      echo '    """'async $FLG $ALG IPSec test'"""' ;
 995 # GEN      echo "    def test_ipsec(self):";
 996 # GEN      echo "        self.run_test()";
 997 # GEN done; done;
 998
 999
1000 class Test_native_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
1001     """native noESN AES-GCM-128/NONE IPSec test"""
1002     def test_ipsec(self):
1003         self.run_test()
1004
1005
1006 class Test_native_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
1007     """native noESN AES-GCM-192/NONE IPSec test"""
1008     def test_ipsec(self):
1009         self.run_test()
1010
1011
1012 class Test_native_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
1013     """native noESN AES-GCM-256/NONE IPSec test"""
1014     def test_ipsec(self):
1015         self.run_test()
1016
1017
1018 class Test_native_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
1019     """native noESN AES-CBC-128/MD5-96 IPSec test"""
1020     def test_ipsec(self):
1021         self.run_test()
1022
1023
1024 class Test_native_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1025     """native noESN AES-CBC-192/SHA1-96 IPSec test"""
1026     def test_ipsec(self):
1027         self.run_test()
1028
1029
1030 class Test_native_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1031     """native noESN AES-CBC-256/SHA1-96 IPSec test"""
1032     def test_ipsec(self):
1033         self.run_test()
1034
1035
1036 class Test_native_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
1037     """native noESN 3DES-CBC/SHA1-96 IPSec test"""
1038     def test_ipsec(self):
1039         self.run_test()
1040
1041
1042 class Test_native_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
1043     """native noESN NONE/SHA1-96 IPSec test"""
1044     def test_ipsec(self):
1045         self.run_test()
1046
1047
1048 class Test_native_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
1049     """native noESN AES-CTR-128/SHA1-96 IPSec test"""
1050     def test_ipsec(self):
1051         self.run_test()
1052
1053
1054 class Test_native_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
1055     """native noESN AES-CTR-192/SHA1-96 IPSec test"""
1056     def test_ipsec(self):
1057         self.run_test()
1058
1059
1060 class Test_native_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
1061     """native noESN AES-CTR-256/SHA1-96 IPSec test"""
1062     def test_ipsec(self):
1063         self.run_test()
1064
1065
1066 class Test_native_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
1067     """native ESN AES-CBC-128/MD5-96 IPSec test"""
1068     def test_ipsec(self):
1069         self.run_test()
1070
1071
1072 class Test_native_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1073     """native ESN AES-CBC-192/SHA1-96 IPSec test"""
1074     def test_ipsec(self):
1075         self.run_test()
1076
1077
1078 class Test_native_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1079     """native ESN AES-CBC-256/SHA1-96 IPSec test"""
1080     def test_ipsec(self):
1081         self.run_test()
1082
1083
1084 class Test_native_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
1085     """native ESN 3DES-CBC/SHA1-96 IPSec test"""
1086     def test_ipsec(self):
1087         self.run_test()
1088
1089
1090 class Test_native_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
1091     """native ESN NONE/SHA1-96 IPSec test"""
1092     def test_ipsec(self):
1093         self.run_test()
1094
1095
1096 class Test_native_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
1097     """native ESN AES-CTR-128/SHA1-96 IPSec test"""
1098     def test_ipsec(self):
1099         self.run_test()
1100
1101
1102 class Test_native_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
1103     """native ESN AES-CTR-192/SHA1-96 IPSec test"""
1104     def test_ipsec(self):
1105         self.run_test()
1106
1107
1108 class Test_native_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
1109     """native ESN AES-CTR-256/SHA1-96 IPSec test"""
1110     def test_ipsec(self):
1111         self.run_test()
1112
1113
1114 class Test_ipsecmb_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
1115     """ipsecmb noESN AES-GCM-128/NONE IPSec test"""
1116     def test_ipsec(self):
1117         self.run_test()
1118
1119
1120 class Test_ipsecmb_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
1121     """ipsecmb noESN AES-GCM-192/NONE IPSec test"""
1122     def test_ipsec(self):
1123         self.run_test()
1124
1125
1126 class Test_ipsecmb_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
1127     """ipsecmb noESN AES-GCM-256/NONE IPSec test"""
1128     def test_ipsec(self):
1129         self.run_test()
1130
1131
1132 class Test_ipsecmb_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
1133     """ipsecmb noESN AES-CBC-128/MD5-96 IPSec test"""
1134     def test_ipsec(self):
1135         self.run_test()
1136
1137
1138 class Test_ipsecmb_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1139     """ipsecmb noESN AES-CBC-192/SHA1-96 IPSec test"""
1140     def test_ipsec(self):
1141         self.run_test()
1142
1143
1144 class Test_ipsecmb_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1145     """ipsecmb noESN AES-CBC-256/SHA1-96 IPSec test"""
1146     def test_ipsec(self):
1147         self.run_test()
1148
1149
1150 class Test_ipsecmb_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
1151     """ipsecmb noESN 3DES-CBC/SHA1-96 IPSec test"""
1152     def test_ipsec(self):
1153         self.run_test()
1154
1155
1156 class Test_ipsecmb_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
1157     """ipsecmb noESN NONE/SHA1-96 IPSec test"""
1158     def test_ipsec(self):
1159         self.run_test()
1160
1161
1162 class Test_ipsecmb_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
1163     """ipsecmb noESN AES-CTR-128/SHA1-96 IPSec test"""
1164     def test_ipsec(self):
1165         self.run_test()
1166
1167
1168 class Test_ipsecmb_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
1169     """ipsecmb noESN AES-CTR-192/SHA1-96 IPSec test"""
1170     def test_ipsec(self):
1171         self.run_test()
1172
1173
1174 class Test_ipsecmb_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
1175     """ipsecmb noESN AES-CTR-256/SHA1-96 IPSec test"""
1176     def test_ipsec(self):
1177         self.run_test()
1178
1179
1180 class Test_ipsecmb_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
1181     """ipsecmb ESN AES-CBC-128/MD5-96 IPSec test"""
1182     def test_ipsec(self):
1183         self.run_test()
1184
1185
1186 class Test_ipsecmb_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1187     """ipsecmb ESN AES-CBC-192/SHA1-96 IPSec test"""
1188     def test_ipsec(self):
1189         self.run_test()
1190
1191
1192 class Test_ipsecmb_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1193     """ipsecmb ESN AES-CBC-256/SHA1-96 IPSec test"""
1194     def test_ipsec(self):
1195         self.run_test()
1196
1197
1198 class Test_ipsecmb_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
1199     """ipsecmb ESN 3DES-CBC/SHA1-96 IPSec test"""
1200     def test_ipsec(self):
1201         self.run_test()
1202
1203
1204 class Test_ipsecmb_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
1205     """ipsecmb ESN NONE/SHA1-96 IPSec test"""
1206     def test_ipsec(self):
1207         self.run_test()
1208
1209
1210 class Test_ipsecmb_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
1211     """ipsecmb ESN AES-CTR-128/SHA1-96 IPSec test"""
1212     def test_ipsec(self):
1213         self.run_test()
1214
1215
1216 class Test_ipsecmb_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
1217     """ipsecmb ESN AES-CTR-192/SHA1-96 IPSec test"""
1218     def test_ipsec(self):
1219         self.run_test()
1220
1221
1222 class Test_ipsecmb_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
1223     """ipsecmb ESN AES-CTR-256/SHA1-96 IPSec test"""
1224     def test_ipsec(self):
1225         self.run_test()
1226
1227
1228 class Test_openssl_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
1229     """openssl noESN AES-GCM-128/NONE IPSec test"""
1230     def test_ipsec(self):
1231         self.run_test()
1232
1233
1234 class Test_openssl_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
1235     """openssl noESN AES-GCM-192/NONE IPSec test"""
1236     def test_ipsec(self):
1237         self.run_test()
1238
1239
1240 class Test_openssl_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
1241     """openssl noESN AES-GCM-256/NONE IPSec test"""
1242     def test_ipsec(self):
1243         self.run_test()
1244
1245
1246 class Test_openssl_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
1247     """openssl noESN AES-CBC-128/MD5-96 IPSec test"""
1248     def test_ipsec(self):
1249         self.run_test()
1250
1251
1252 class Test_openssl_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1253     """openssl noESN AES-CBC-192/SHA1-96 IPSec test"""
1254     def test_ipsec(self):
1255         self.run_test()
1256
1257
1258 class Test_openssl_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1259     """openssl noESN AES-CBC-256/SHA1-96 IPSec test"""
1260     def test_ipsec(self):
1261         self.run_test()
1262
1263
1264 class Test_openssl_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
1265     """openssl noESN 3DES-CBC/SHA1-96 IPSec test"""
1266     def test_ipsec(self):
1267         self.run_test()
1268
1269
1270 class Test_openssl_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
1271     """openssl noESN NONE/SHA1-96 IPSec test"""
1272     def test_ipsec(self):
1273         self.run_test()
1274
1275
1276 class Test_openssl_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
1277     """openssl noESN AES-CTR-128/SHA1-96 IPSec test"""
1278     def test_ipsec(self):
1279         self.run_test()
1280
1281
1282 class Test_openssl_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
1283     """openssl noESN AES-CTR-192/SHA1-96 IPSec test"""
1284     def test_ipsec(self):
1285         self.run_test()
1286
1287
1288 class Test_openssl_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
1289     """openssl noESN AES-CTR-256/SHA1-96 IPSec test"""
1290     def test_ipsec(self):
1291         self.run_test()
1292
1293
1294 class Test_openssl_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
1295     """openssl ESN AES-CBC-128/MD5-96 IPSec test"""
1296     def test_ipsec(self):
1297         self.run_test()
1298
1299
1300 class Test_openssl_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1301     """openssl ESN AES-CBC-192/SHA1-96 IPSec test"""
1302     def test_ipsec(self):
1303         self.run_test()
1304
1305
1306 class Test_openssl_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1307     """openssl ESN AES-CBC-256/SHA1-96 IPSec test"""
1308     def test_ipsec(self):
1309         self.run_test()
1310
1311
1312 class Test_openssl_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
1313     """openssl ESN 3DES-CBC/SHA1-96 IPSec test"""
1314     def test_ipsec(self):
1315         self.run_test()
1316
1317
1318 class Test_openssl_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
1319     """openssl ESN NONE/SHA1-96 IPSec test"""
1320     def test_ipsec(self):
1321         self.run_test()
1322
1323
1324 class Test_openssl_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
1325     """openssl ESN AES-CTR-128/SHA1-96 IPSec test"""
1326     def test_ipsec(self):
1327         self.run_test()
1328
1329
1330 class Test_openssl_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
1331     """openssl ESN AES-CTR-192/SHA1-96 IPSec test"""
1332     def test_ipsec(self):
1333         self.run_test()
1334
1335
1336 class Test_openssl_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
1337     """openssl ESN AES-CTR-256/SHA1-96 IPSec test"""
1338     def test_ipsec(self):
1339         self.run_test()
1340
1341
1342 class Test_async_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
1343     """async noESN AES-GCM-128/NONE IPSec test"""
1344     def test_ipsec(self):
1345         self.run_test()
1346
1347
1348 class Test_async_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
1349     """async noESN AES-GCM-192/NONE IPSec test"""
1350     def test_ipsec(self):
1351         self.run_test()
1352
1353
1354 class Test_async_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
1355     """async noESN AES-GCM-256/NONE IPSec test"""
1356     def test_ipsec(self):
1357         self.run_test()
1358
1359
1360 class Test_async_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1361     """async noESN AES-CBC-192/SHA1-96 IPSec test"""
1362     def test_ipsec(self):
1363         self.run_test()
1364
1365
1366 class Test_async_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1367     """async noESN AES-CBC-256/SHA1-96 IPSec test"""
1368     def test_ipsec(self):
1369         self.run_test()
1370
1371
1372 class Test_async_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
1373     """async ESN AES-CBC-192/SHA1-96 IPSec test"""
1374     def test_ipsec(self):
1375         self.run_test()
1376
1377
1378 class Test_async_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
1379     """async ESN AES-CBC-256/SHA1-96 IPSec test"""
1380     def test_ipsec(self):
1381         self.run_test()