test/test_ipsec_esp.py

   1 import socket
   2 import unittest
   3 from scapy.layers.ipsec import ESP
   4
   5 from framework import VppTestRunner
   6 from template_ipsec import IpsecTraTests, IpsecTunTests
   7 from template_ipsec import TemplateIpsec, IpsecTcpTests
   8 from vpp_ipsec import *
   9 from vpp_ip_route import VppIpRoute, VppRoutePath
  10 from vpp_ip import DpoProto
  11
  12
  13 class TemplateIpsecEsp(TemplateIpsec):
  14     """
  15     Basic test for ipsec esp sanity - tunnel and transport modes.
  16
  17     Below 4 cases are covered as part of this test
  18     1) ipsec esp v4 transport basic test  - IPv4 Transport mode
  19         scenario using HMAC-SHA1-96 intergrity algo
  20     2) ipsec esp v4 transport burst test
  21         Above test for 257 pkts
  22     3) ipsec esp 4o4 tunnel basic test    - IPv4 Tunnel mode
  23         scenario using HMAC-SHA1-96 intergrity algo
  24     4) ipsec esp 4o4 tunnel burst test
  25         Above test for 257 pkts
  26
  27     TRANSPORT MODE:
  28
  29      ---   encrypt   ---
  30     |pg2| <-------> |VPP|
  31      ---   decrypt   ---
  32
  33     TUNNEL MODE:
  34
  35      ---   encrypt   ---   plain   ---
  36     |pg0| <-------  |VPP| <------ |pg1|
  37      ---             ---           ---
  38
  39      ---   decrypt   ---   plain   ---
  40     |pg0| ------->  |VPP| ------> |pg1|
  41      ---             ---           ---
  42     """
  43
  44     def setUp(self):
  45         super(TemplateIpsecEsp, self).setUp()
  46         self.encryption_type = ESP
  47         self.tun_if = self.pg0
  48         self.tra_if = self.pg2
  49         self.logger.info(self.vapi.ppcli("show int addr"))
  50
  51         self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
  52         self.tra_spd.add_vpp_config()
  53         VppIpsecSpdItfBinding(self, self.tra_spd,
  54                               self.tra_if).add_vpp_config()
  55
  56         for _, p in self.params.items():
  57             self.config_esp_tra(p)
  58             self.configure_sa_tra(p)
  59         self.logger.info(self.vapi.ppcli("show ipsec"))
  60
  61         self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
  62         self.tun_spd.add_vpp_config()
  63         VppIpsecSpdItfBinding(self, self.tun_spd,
  64                               self.tun_if).add_vpp_config()
  65
  66         for _, p in self.params.items():
  67             self.config_esp_tun(p)
  68         self.logger.info(self.vapi.ppcli("show ipsec"))
  69
  70         for _, p in self.params.items():
  71             d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4
  72             VppIpRoute(self,  p.remote_tun_if_host, p.addr_len,
  73                        [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
  74                                      0xffffffff,
  75                                      proto=d)],
  76                        is_ip6=p.is_ipv6).add_vpp_config()
  77
  78     def tearDown(self):
  79         super(TemplateIpsecEsp, self).tearDown()
  80         if not self.vpp_dead:
  81             self.vapi.cli("show hardware")
  82
  83     def config_esp_tun(self, params):
  84         addr_type = params.addr_type
  85         scapy_tun_sa_id = params.scapy_tun_sa_id
  86         scapy_tun_spi = params.scapy_tun_spi
  87         vpp_tun_sa_id = params.vpp_tun_sa_id
  88         vpp_tun_spi = params.vpp_tun_spi
  89         auth_algo_vpp_id = params.auth_algo_vpp_id
  90         auth_key = params.auth_key
  91         crypt_algo_vpp_id = params.crypt_algo_vpp_id
  92         crypt_key = params.crypt_key
  93         remote_tun_if_host = params.remote_tun_if_host
  94         addr_any = params.addr_any
  95         addr_bcast = params.addr_bcast
  96
  97         VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi,
  98                    auth_algo_vpp_id, auth_key,
  99                    crypt_algo_vpp_id, crypt_key,
 100                    self.vpp_esp_protocol,
 101                    self.tun_if.local_addr[addr_type],
 102                    self.tun_if.remote_addr[addr_type]).add_vpp_config()
 103         VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi,
 104                    auth_algo_vpp_id, auth_key,
 105                    crypt_algo_vpp_id, crypt_key,
 106                    self.vpp_esp_protocol,
 107                    self.tun_if.remote_addr[addr_type],
 108                    self.tun_if.local_addr[addr_type]).add_vpp_config()
 109
 110         VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 111                          addr_any, addr_bcast,
 112                          addr_any, addr_bcast,
 113                          socket.IPPROTO_ESP).add_vpp_config()
 114         VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 115                          addr_any, addr_bcast,
 116                          addr_any, addr_bcast,
 117                          socket.IPPROTO_ESP,
 118                          is_outbound=0).add_vpp_config()
 119
 120         VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
 121                          remote_tun_if_host, remote_tun_if_host,
 122                          self.pg1.remote_addr[addr_type],
 123                          self.pg1.remote_addr[addr_type],
 124                          0,
 125                          priority=10, policy=3,
 126                          is_outbound=0).add_vpp_config()
 127         VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 128                          self.pg1.remote_addr[addr_type],
 129                          self.pg1.remote_addr[addr_type],
 130                          remote_tun_if_host, remote_tun_if_host,
 131                          0,
 132                          priority=10, policy=3).add_vpp_config()
 133
 134         VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
 135                          remote_tun_if_host, remote_tun_if_host,
 136                          self.pg0.local_addr[addr_type],
 137                          self.pg0.local_addr[addr_type],
 138                          0,
 139                          priority=20, policy=3,
 140                          is_outbound=0).add_vpp_config()
 141         VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 142                          self.pg0.local_addr[addr_type],
 143                          self.pg0.local_addr[addr_type],
 144                          remote_tun_if_host, remote_tun_if_host,
 145                          0,
 146                          priority=20, policy=3).add_vpp_config()
 147
 148     def config_esp_tra(self, params):
 149         addr_type = params.addr_type
 150         scapy_tra_sa_id = params.scapy_tra_sa_id
 151         scapy_tra_spi = params.scapy_tra_spi
 152         vpp_tra_sa_id = params.vpp_tra_sa_id
 153         vpp_tra_spi = params.vpp_tra_spi
 154         auth_algo_vpp_id = params.auth_algo_vpp_id
 155         auth_key = params.auth_key
 156         crypt_algo_vpp_id = params.crypt_algo_vpp_id
 157         crypt_key = params.crypt_key
 158         addr_any = params.addr_any
 159         addr_bcast = params.addr_bcast
 160
 161         VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi,
 162                    auth_algo_vpp_id, auth_key,
 163                    crypt_algo_vpp_id, crypt_key,
 164                    self.vpp_esp_protocol,
 165                    use_anti_replay=1).add_vpp_config()
 166         VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi,
 167                    auth_algo_vpp_id, auth_key,
 168                    crypt_algo_vpp_id, crypt_key,
 169                    self.vpp_esp_protocol,
 170                    use_anti_replay=1).add_vpp_config()
 171
 172         VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 173                          addr_any, addr_bcast,
 174                          addr_any, addr_bcast,
 175                          socket.IPPROTO_ESP).add_vpp_config()
 176         VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 177                          addr_any, addr_bcast,
 178                          addr_any, addr_bcast,
 179                          socket.IPPROTO_ESP,
 180                          is_outbound=0).add_vpp_config()
 181
 182         VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 183                          self.tra_if.local_addr[addr_type],
 184                          self.tra_if.local_addr[addr_type],
 185                          self.tra_if.remote_addr[addr_type],
 186                          self.tra_if.remote_addr[addr_type],
 187                          0, priority=10, policy=3,
 188                          is_outbound=0).add_vpp_config()
 189         VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
 190                          self.tra_if.local_addr[addr_type],
 191                          self.tra_if.local_addr[addr_type],
 192                          self.tra_if.remote_addr[addr_type],
 193                          self.tra_if.remote_addr[addr_type],
 194                          0, priority=10, policy=3).add_vpp_config()
 195
 196
 197 class TestIpsecEsp1(TemplateIpsecEsp, IpsecTraTests, IpsecTunTests):
 198     """ Ipsec ESP - TUN & TRA tests """
 199     tra4_encrypt_node_name = "esp4-encrypt"
 200     tra4_decrypt_node_name = "esp4-decrypt"
 201     tra6_encrypt_node_name = "esp6-encrypt"
 202     tra6_decrypt_node_name = "esp6-decrypt"
 203     tun4_encrypt_node_name = "esp4-encrypt"
 204     tun4_decrypt_node_name = "esp4-decrypt"
 205     tun6_encrypt_node_name = "esp6-encrypt"
 206     tun6_decrypt_node_name = "esp6-decrypt"
 207
 208
 209 class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
 210     """ Ipsec ESP - TCP tests """
 211     pass
 212
 213
 214 if __name__ == '__main__':
 215     unittest.main(testRunner=VppTestRunner)