test/test_ipsec_esp.py

   1 import socket
   2 import unittest
   3 from scapy.layers.ipsec import ESP
   4 from scapy.layers.inet import IP, ICMP, UDP
   5
   6 from parameterized import parameterized
   7 from framework import VppTestRunner
   8 from template_ipsec import IpsecTra46Tests, IpsecTun46Tests, TemplateIpsec, \
   9     IpsecTcpTests, IpsecTun4Tests, IpsecTra4Tests, config_tra_params, \
  10     config_tun_params, IPsecIPv4Params, IPsecIPv6Params, \
  11     IpsecTra4, IpsecTun4, IpsecTra6, IpsecTun6, \
  12     IpsecTun6HandoffTests, IpsecTun4HandoffTests, \
  13     IpsecTra6ExtTests
  14 from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSA,\
  15     VppIpsecSpdItfBinding
  16 from vpp_ip_route import VppIpRoute, VppRoutePath
  17 from vpp_ip import DpoProto
  18 from vpp_papi import VppEnum
  19
  20 NUM_PKTS = 67
  21 engines_supporting_chain_bufs = ["openssl"]
  22
  23
  24 class ConfigIpsecESP(TemplateIpsec):
  25     encryption_type = ESP
  26     tra4_encrypt_node_name = "esp4-encrypt"
  27     tra4_decrypt_node_name = "esp4-decrypt"
  28     tra6_encrypt_node_name = "esp6-encrypt"
  29     tra6_decrypt_node_name = "esp6-decrypt"
  30     tun4_encrypt_node_name = "esp4-encrypt"
  31     tun4_decrypt_node_name = "esp4-decrypt"
  32     tun6_encrypt_node_name = "esp6-encrypt"
  33     tun6_decrypt_node_name = "esp6-decrypt"
  34
  35     @classmethod
  36     def setUpClass(cls):
  37         super(ConfigIpsecESP, cls).setUpClass()
  38
  39     @classmethod
  40     def tearDownClass(cls):
  41         super(ConfigIpsecESP, cls).tearDownClass()
  42
  43     def setUp(self):
  44         super(ConfigIpsecESP, self).setUp()
  45
  46     def tearDown(self):
  47         super(ConfigIpsecESP, self).tearDown()
  48
  49     def config_network(self, params):
  50         self.net_objs = []
  51         self.tun_if = self.pg0
  52         self.tra_if = self.pg2
  53         self.logger.info(self.vapi.ppcli("show int addr"))
  54
  55         self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
  56         self.tra_spd.add_vpp_config()
  57         self.net_objs.append(self.tra_spd)
  58         self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
  59         self.tun_spd.add_vpp_config()
  60         self.net_objs.append(self.tun_spd)
  61
  62         b = VppIpsecSpdItfBinding(self, self.tun_spd,
  63                                   self.tun_if)
  64         b.add_vpp_config()
  65         self.net_objs.append(b)
  66
  67         b = VppIpsecSpdItfBinding(self, self.tra_spd,
  68                                   self.tra_if)
  69         b.add_vpp_config()
  70         self.net_objs.append(b)
  71
  72         for p in params:
  73             self.config_esp_tra(p)
  74             config_tra_params(p, self.encryption_type)
  75         for p in params:
  76             self.config_esp_tun(p)
  77             config_tun_params(p, self.encryption_type, self.tun_if)
  78
  79         for p in params:
  80             d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4
  81             r = VppIpRoute(self,  p.remote_tun_if_host, p.addr_len,
  82                            [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
  83                                          0xffffffff,
  84                                          proto=d)])
  85             r.add_vpp_config()
  86             self.net_objs.append(r)
  87
  88         self.logger.info(self.vapi.ppcli("show ipsec all"))
  89
  90     def unconfig_network(self):
  91         for o in reversed(self.net_objs):
  92             o.remove_vpp_config()
  93         self.net_objs = []
  94
  95     def config_esp_tun(self, params):
  96         addr_type = params.addr_type
  97         scapy_tun_sa_id = params.scapy_tun_sa_id
  98         scapy_tun_spi = params.scapy_tun_spi
  99         vpp_tun_sa_id = params.vpp_tun_sa_id
 100         vpp_tun_spi = params.vpp_tun_spi
 101         auth_algo_vpp_id = params.auth_algo_vpp_id
 102         auth_key = params.auth_key
 103         crypt_algo_vpp_id = params.crypt_algo_vpp_id
 104         crypt_key = params.crypt_key
 105         remote_tun_if_host = params.remote_tun_if_host
 106         addr_any = params.addr_any
 107         addr_bcast = params.addr_bcast
 108         e = VppEnum.vl_api_ipsec_spd_action_t
 109         flags = params.flags
 110         salt = params.salt
 111         objs = []
 112
 113         params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi,
 114                                       auth_algo_vpp_id, auth_key,
 115                                       crypt_algo_vpp_id, crypt_key,
 116                                       self.vpp_esp_protocol,
 117                                       self.tun_if.local_addr[addr_type],
 118                                       self.tun_if.remote_addr[addr_type],
 119                                       flags=flags,
 120                                       salt=salt)
 121         params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi,
 122                                        auth_algo_vpp_id, auth_key,
 123                                        crypt_algo_vpp_id, crypt_key,
 124                                        self.vpp_esp_protocol,
 125                                        self.tun_if.remote_addr[addr_type],
 126                                        self.tun_if.local_addr[addr_type],
 127                                        flags=flags,
 128                                        salt=salt)
 129         objs.append(params.tun_sa_in)
 130         objs.append(params.tun_sa_out)
 131
 132         params.spd_policy_in_any = VppIpsecSpdEntry(self, self.tun_spd,
 133                                                     scapy_tun_sa_id,
 134                                                     addr_any, addr_bcast,
 135                                                     addr_any, addr_bcast,
 136                                                     socket.IPPROTO_ESP)
 137         params.spd_policy_out_any = VppIpsecSpdEntry(self, self.tun_spd,
 138                                                      scapy_tun_sa_id,
 139                                                      addr_any, addr_bcast,
 140                                                      addr_any, addr_bcast,
 141                                                      socket.IPPROTO_ESP,
 142                                                      is_outbound=0)
 143         objs.append(params.spd_policy_out_any)
 144         objs.append(params.spd_policy_in_any)
 145
 146         objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
 147                                      remote_tun_if_host, remote_tun_if_host,
 148                                      self.pg1.remote_addr[addr_type],
 149                                      self.pg1.remote_addr[addr_type],
 150                                      0,
 151                                      priority=10,
 152                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 153                                      is_outbound=0))
 154         objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 155                                      self.pg1.remote_addr[addr_type],
 156                                      self.pg1.remote_addr[addr_type],
 157                                      remote_tun_if_host, remote_tun_if_host,
 158                                      0,
 159                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 160                                      priority=10))
 161         objs.append(VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id,
 162                                      remote_tun_if_host, remote_tun_if_host,
 163                                      self.pg0.local_addr[addr_type],
 164                                      self.pg0.local_addr[addr_type],
 165                                      0,
 166                                      priority=20,
 167                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 168                                      is_outbound=0))
 169         objs.append(VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id,
 170                                      self.pg0.local_addr[addr_type],
 171                                      self.pg0.local_addr[addr_type],
 172                                      remote_tun_if_host, remote_tun_if_host,
 173                                      0,
 174                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 175                                      priority=20))
 176         for o in objs:
 177             o.add_vpp_config()
 178         self.net_objs = self.net_objs + objs
 179
 180     def config_esp_tra(self, params):
 181         addr_type = params.addr_type
 182         scapy_tra_sa_id = params.scapy_tra_sa_id
 183         scapy_tra_spi = params.scapy_tra_spi
 184         vpp_tra_sa_id = params.vpp_tra_sa_id
 185         vpp_tra_spi = params.vpp_tra_spi
 186         auth_algo_vpp_id = params.auth_algo_vpp_id
 187         auth_key = params.auth_key
 188         crypt_algo_vpp_id = params.crypt_algo_vpp_id
 189         crypt_key = params.crypt_key
 190         addr_any = params.addr_any
 191         addr_bcast = params.addr_bcast
 192         flags = (VppEnum.vl_api_ipsec_sad_flags_t.
 193                  IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
 194         e = VppEnum.vl_api_ipsec_spd_action_t
 195         flags = params.flags | flags
 196         salt = params.salt
 197         objs = []
 198
 199         params.tra_sa_in = VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi,
 200                                       auth_algo_vpp_id, auth_key,
 201                                       crypt_algo_vpp_id, crypt_key,
 202                                       self.vpp_esp_protocol,
 203                                       flags=flags,
 204                                       salt=salt)
 205         params.tra_sa_out = VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi,
 206                                        auth_algo_vpp_id, auth_key,
 207                                        crypt_algo_vpp_id, crypt_key,
 208                                        self.vpp_esp_protocol,
 209                                        flags=flags,
 210                                        salt=salt)
 211         objs.append(params.tra_sa_in)
 212         objs.append(params.tra_sa_out)
 213
 214         objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 215                                      addr_any, addr_bcast,
 216                                      addr_any, addr_bcast,
 217                                      socket.IPPROTO_ESP))
 218         objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 219                                      addr_any, addr_bcast,
 220                                      addr_any, addr_bcast,
 221                                      socket.IPPROTO_ESP,
 222                                      is_outbound=0))
 223         objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id,
 224                                      self.tra_if.local_addr[addr_type],
 225                                      self.tra_if.local_addr[addr_type],
 226                                      self.tra_if.remote_addr[addr_type],
 227                                      self.tra_if.remote_addr[addr_type],
 228                                      0, priority=10,
 229                                      policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 230                                      is_outbound=0))
 231         objs.append(VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id,
 232                                      self.tra_if.local_addr[addr_type],
 233                                      self.tra_if.local_addr[addr_type],
 234                                      self.tra_if.remote_addr[addr_type],
 235                                      self.tra_if.remote_addr[addr_type],
 236                                      0, policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 237                                      priority=10))
 238         for o in objs:
 239             o.add_vpp_config()
 240         self.net_objs = self.net_objs + objs
 241
 242
 243 class TemplateIpsecEsp(ConfigIpsecESP):
 244     """
 245     Basic test for ipsec esp sanity - tunnel and transport modes.
 246
 247     Below 4 cases are covered as part of this test
 248     1) ipsec esp v4 transport basic test  - IPv4 Transport mode
 249         scenario using HMAC-SHA1-96 integrity algo
 250     2) ipsec esp v4 transport burst test
 251         Above test for 257 pkts
 252     3) ipsec esp 4o4 tunnel basic test    - IPv4 Tunnel mode
 253         scenario using HMAC-SHA1-96 integrity algo
 254     4) ipsec esp 4o4 tunnel burst test
 255         Above test for 257 pkts
 256
 257     TRANSPORT MODE:
 258
 259      ---   encrypt   ---
 260     |pg2| <-------> |VPP|
 261      ---   decrypt   ---
 262
 263     TUNNEL MODE:
 264
 265      ---   encrypt   ---   plain   ---
 266     |pg0| <-------  |VPP| <------ |pg1|
 267      ---             ---           ---
 268
 269      ---   decrypt   ---   plain   ---
 270     |pg0| ------->  |VPP| ------> |pg1|
 271      ---             ---           ---
 272     """
 273
 274     @classmethod
 275     def setUpClass(cls):
 276         super(TemplateIpsecEsp, cls).setUpClass()
 277
 278     @classmethod
 279     def tearDownClass(cls):
 280         super(TemplateIpsecEsp, cls).tearDownClass()
 281
 282     def setUp(self):
 283         super(TemplateIpsecEsp, self).setUp()
 284         self.config_network(self.params.values())
 285
 286     def tearDown(self):
 287         self.unconfig_network()
 288         super(TemplateIpsecEsp, self).tearDown()
 289
 290
 291 class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests,
 292                     IpsecTun46Tests, IpsecTra6ExtTests):
 293     """ Ipsec ESP - TUN & TRA tests """
 294
 295     @classmethod
 296     def setUpClass(cls):
 297         super(TestIpsecEsp1, cls).setUpClass()
 298
 299     @classmethod
 300     def tearDownClass(cls):
 301         super(TestIpsecEsp1, cls).tearDownClass()
 302
 303     def setUp(self):
 304         super(TestIpsecEsp1, self).setUp()
 305
 306     def tearDown(self):
 307         super(TestIpsecEsp1, self).tearDown()
 308
 309     def test_tun_46(self):
 310         """ ipsec 4o6 tunnel """
 311         # add an SPD entry to direct 2.2.2.2 to the v6 tunnel SA
 312         p6 = self.ipv6_params
 313         p4 = self.ipv4_params
 314
 315         p6.remote_tun_if_host4 = "2.2.2.2"
 316         e = VppEnum.vl_api_ipsec_spd_action_t
 317
 318         VppIpsecSpdEntry(self,
 319                          self.tun_spd,
 320                          p6.scapy_tun_sa_id,
 321                          self.pg1.remote_addr[p4.addr_type],
 322                          self.pg1.remote_addr[p4.addr_type],
 323                          p6.remote_tun_if_host4,
 324                          p6.remote_tun_if_host4,
 325                          0,
 326                          priority=10,
 327                          policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 328                          is_outbound=1).add_vpp_config()
 329         VppIpRoute(self,  p6.remote_tun_if_host4, p4.addr_len,
 330                    [VppRoutePath(self.tun_if.remote_addr[p4.addr_type],
 331                                  0xffffffff)]).add_vpp_config()
 332
 333         old_name = self.tun6_encrypt_node_name
 334         self.tun6_encrypt_node_name = "esp4-encrypt"
 335
 336         self.verify_tun_46(p6, count=63)
 337         self.tun6_encrypt_node_name = old_name
 338
 339     def test_tun_64(self):
 340         """ ipsec 6o4 tunnel """
 341         # add an SPD entry to direct 4444::4 to the v4 tunnel SA
 342         p6 = self.ipv6_params
 343         p4 = self.ipv4_params
 344
 345         p4.remote_tun_if_host6 = "4444::4"
 346         e = VppEnum.vl_api_ipsec_spd_action_t
 347
 348         VppIpsecSpdEntry(self,
 349                          self.tun_spd,
 350                          p4.scapy_tun_sa_id,
 351                          self.pg1.remote_addr[p6.addr_type],
 352                          self.pg1.remote_addr[p6.addr_type],
 353                          p4.remote_tun_if_host6,
 354                          p4.remote_tun_if_host6,
 355                          0,
 356                          priority=10,
 357                          policy=e.IPSEC_API_SPD_ACTION_PROTECT,
 358                          is_outbound=1).add_vpp_config()
 359         d = DpoProto.DPO_PROTO_IP6
 360         VppIpRoute(self,  p4.remote_tun_if_host6, p6.addr_len,
 361                    [VppRoutePath(self.tun_if.remote_addr[p6.addr_type],
 362                                  0xffffffff,
 363                                  proto=d)]).add_vpp_config()
 364
 365         old_name = self.tun4_encrypt_node_name
 366         self.tun4_encrypt_node_name = "esp6-encrypt"
 367         self.verify_tun_64(p4, count=63)
 368         self.tun4_encrypt_node_name = old_name
 369
 370
 371 class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests):
 372     """ Ipsec ESP - TCP tests """
 373     pass
 374
 375
 376 class TestIpsecEspHandoff(TemplateIpsecEsp,
 377                           IpsecTun6HandoffTests,
 378                           IpsecTun4HandoffTests):
 379     """ Ipsec ESP - handoff tests """
 380     pass
 381
 382
 383 class TemplateIpsecEspUdp(ConfigIpsecESP):
 384     """
 385     UDP encapped ESP
 386     """
 387
 388     @classmethod
 389     def setUpClass(cls):
 390         super(TemplateIpsecEspUdp, cls).setUpClass()
 391
 392     @classmethod
 393     def tearDownClass(cls):
 394         super(TemplateIpsecEspUdp, cls).tearDownClass()
 395
 396     def setUp(self):
 397         super(TemplateIpsecEspUdp, self).setUp()
 398         self.net_objs = []
 399         self.tun_if = self.pg0
 400         self.tra_if = self.pg2
 401         self.logger.info(self.vapi.ppcli("show int addr"))
 402
 403         p = self.ipv4_params
 404         p.flags = (VppEnum.vl_api_ipsec_sad_flags_t.
 405                    IPSEC_API_SAD_FLAG_UDP_ENCAP)
 406         p.nat_header = UDP(sport=5454, dport=4500)
 407
 408         self.tra_spd = VppIpsecSpd(self, self.tra_spd_id)
 409         self.tra_spd.add_vpp_config()
 410         VppIpsecSpdItfBinding(self, self.tra_spd,
 411                               self.tra_if).add_vpp_config()
 412
 413         self.config_esp_tra(p)
 414         config_tra_params(p, self.encryption_type)
 415
 416         self.tun_spd = VppIpsecSpd(self, self.tun_spd_id)
 417         self.tun_spd.add_vpp_config()
 418         VppIpsecSpdItfBinding(self, self.tun_spd,
 419                               self.tun_if).add_vpp_config()
 420
 421         self.config_esp_tun(p)
 422         self.logger.info(self.vapi.ppcli("show ipsec all"))
 423
 424         d = DpoProto.DPO_PROTO_IP4
 425         VppIpRoute(self,  p.remote_tun_if_host, p.addr_len,
 426                    [VppRoutePath(self.tun_if.remote_addr[p.addr_type],
 427                                  0xffffffff,
 428                                  proto=d)]).add_vpp_config()
 429
 430     def tearDown(self):
 431         super(TemplateIpsecEspUdp, self).tearDown()
 432
 433     def show_commands_at_teardown(self):
 434         self.logger.info(self.vapi.cli("show hardware"))
 435
 436
 437 class TestIpsecEspUdp(TemplateIpsecEspUdp, IpsecTra4Tests):
 438     """ Ipsec NAT-T ESP UDP tests """
 439     pass
 440
 441
 442 class MyParameters():
 443     def __init__(self):
 444         self.engines = ["ia32", "ipsecmb", "openssl"]
 445         flag_esn = VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN
 446         self.flags = [0, flag_esn]
 447         # foreach crypto algorithm
 448         self.algos = {
 449             'AES-GCM-128/NONE': {
 450                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 451                                  IPSEC_API_CRYPTO_ALG_AES_GCM_128),
 452                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 453                                 IPSEC_API_INTEG_ALG_NONE),
 454                   'scapy-crypto': "AES-GCM",
 455                   'scapy-integ': "NULL",
 456                   'key': b"JPjyOWBeVEQiMe7h",
 457                   'salt': 0},
 458             'AES-GCM-192/NONE': {
 459                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 460                                  IPSEC_API_CRYPTO_ALG_AES_GCM_192),
 461                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 462                                 IPSEC_API_INTEG_ALG_NONE),
 463                   'scapy-crypto': "AES-GCM",
 464                   'scapy-integ': "NULL",
 465                   'key': b"JPjyOWBeVEQiMe7h01234567",
 466                   'salt': 1010},
 467             'AES-GCM-256/NONE': {
 468                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 469                                  IPSEC_API_CRYPTO_ALG_AES_GCM_256),
 470                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 471                                 IPSEC_API_INTEG_ALG_NONE),
 472                   'scapy-crypto': "AES-GCM",
 473                   'scapy-integ': "NULL",
 474                   'key': b"JPjyOWBeVEQiMe7h0123456787654321",
 475                   'salt': 2020},
 476             'AES-CBC-128/MD5-96': {
 477                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 478                                  IPSEC_API_CRYPTO_ALG_AES_CBC_128),
 479                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 480                                 IPSEC_API_INTEG_ALG_MD5_96),
 481                   'scapy-crypto': "AES-CBC",
 482                   'scapy-integ': "HMAC-MD5-96",
 483                   'salt': 0,
 484                   'key': b"JPjyOWBeVEQiMe7h"},
 485             'AES-CBC-192/SHA1-96': {
 486                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 487                                  IPSEC_API_CRYPTO_ALG_AES_CBC_192),
 488                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 489                                 IPSEC_API_INTEG_ALG_SHA1_96),
 490                   'scapy-crypto': "AES-CBC",
 491                   'scapy-integ': "HMAC-SHA1-96",
 492                   'salt': 0,
 493                   'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"},
 494             'AES-CBC-256/SHA1-96': {
 495                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 496                                  IPSEC_API_CRYPTO_ALG_AES_CBC_256),
 497                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 498                                 IPSEC_API_INTEG_ALG_SHA1_96),
 499                   'scapy-crypto': "AES-CBC",
 500                   'scapy-integ': "HMAC-SHA1-96",
 501                   'salt': 0,
 502                   'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"},
 503             '3DES-CBC/SHA1-96': {
 504                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 505                                  IPSEC_API_CRYPTO_ALG_3DES_CBC),
 506                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 507                                 IPSEC_API_INTEG_ALG_SHA1_96),
 508                   'scapy-crypto': "3DES",
 509                   'scapy-integ': "HMAC-SHA1-96",
 510                   'salt': 0,
 511                   'key': b"JPjyOWBeVEQiMe7h00112233"},
 512             'NONE/SHA1-96': {
 513                   'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t.
 514                                  IPSEC_API_CRYPTO_ALG_NONE),
 515                   'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t.
 516                                 IPSEC_API_INTEG_ALG_SHA1_96),
 517                   'scapy-crypto': "NULL",
 518                   'scapy-integ': "HMAC-SHA1-96",
 519                   'salt': 0,
 520                   'key': b"JPjyOWBeVEQiMe7h00112233"}}
 521
 522
 523 class RunTestIpsecEspAll(ConfigIpsecESP,
 524                          IpsecTra4, IpsecTra6,
 525                          IpsecTun4, IpsecTun6):
 526     """ Ipsec ESP all Algos """
 527
 528     def setUp(self):
 529         super(RunTestIpsecEspAll, self).setUp()
 530         test_args = str.split(self.__doc__, " ")
 531
 532         params = MyParameters()
 533         self.engine = test_args[0]
 534         self.flag = params.flags[0]
 535         if test_args[1] == 'ESN':
 536             self.flag = params.flags[1]
 537
 538         self.algo = params.algos[test_args[2]]
 539
 540     def tearDown(self):
 541         super(RunTestIpsecEspAll, self).tearDown()
 542
 543     def run_test(self):
 544         self.run_a_test(self.engine, self.flag, self.algo)
 545
 546     def run_a_test(self, engine, flag, algo, payload_size=None):
 547         if engine == "ia32":
 548             engine = "native"
 549         self.vapi.cli("set crypto handler all %s" % engine)
 550
 551         self.ipv4_params = IPsecIPv4Params()
 552         self.ipv6_params = IPsecIPv6Params()
 553
 554         self.params = {self.ipv4_params.addr_type:
 555                        self.ipv4_params,
 556                        self.ipv6_params.addr_type:
 557                        self.ipv6_params}
 558
 559         for _, p in self.params.items():
 560             p.auth_algo_vpp_id = algo['vpp-integ']
 561             p.crypt_algo_vpp_id = algo['vpp-crypto']
 562             p.crypt_algo = algo['scapy-crypto']
 563             p.auth_algo = algo['scapy-integ']
 564             p.crypt_key = algo['key']
 565             p.salt = algo['salt']
 566             p.flags = p.flags | flag
 567
 568         self.reporter.send_keep_alive(self)
 569
 570         #
 571         # configure the SPDs. SAs, etc
 572         #
 573         self.config_network(self.params.values())
 574
 575         #
 576         # run some traffic.
 577         #  An exhautsive 4o6, 6o4 is not necessary
 578         #  for each algo
 579         #
 580         self.verify_tra_basic6(count=NUM_PKTS)
 581         self.verify_tra_basic4(count=NUM_PKTS)
 582         self.verify_tun_66(self.params[socket.AF_INET6],
 583                            count=NUM_PKTS)
 584         #
 585         # Use an odd-byte payload size to check for correct padding.
 586         #
 587         # 49 + 2 == 51 which should pad +1 to 52 for 4 byte alignment, +5
 588         # to 56 for 8 byte alignment, and +13 to 64 for 64 byte alignment.
 589         # This should catch bugs where the code is incorrectly over-padding
 590         # for algorithms that don't require it
 591         psz = 49 - len(IP()/ICMP()) if payload_size is None else payload_size
 592         self.verify_tun_44(self.params[socket.AF_INET],
 593                            count=NUM_PKTS, payload_size=psz)
 594
 595         LARGE_PKT_SZ = [
 596             1970,  # results in 2 chained buffers entering decrypt node
 597                    # but leaving as simple buffer due to ICV removal (tra4)
 598             2004,  # footer+ICV will be added to 2nd buffer (tun4)
 599             4010,  # ICV ends up splitted accross 2 buffers in esp_decrypt
 600                    # for transport4; transport6 takes normal path
 601             4020,  # same as above but tra4 and tra6 are switched
 602         ]
 603         if self.engine in engines_supporting_chain_bufs:
 604             for sz in LARGE_PKT_SZ:
 605                 self.verify_tra_basic4(count=NUM_PKTS, payload_size=sz)
 606                 self.verify_tra_basic6(count=NUM_PKTS, payload_size=sz)
 607                 self.verify_tun_66(self.params[socket.AF_INET6],
 608                                    count=NUM_PKTS, payload_size=sz)
 609                 self.verify_tun_44(self.params[socket.AF_INET],
 610                                    count=NUM_PKTS, payload_size=sz)
 611
 612         #
 613         # remove the SPDs, SAs, etc
 614         #
 615         self.unconfig_network()
 616
 617         #
 618         # reconfigure the network and SA to run the
 619         # anti replay tests
 620         #
 621         self.config_network(self.params.values())
 622         self.verify_tra_anti_replay()
 623         self.unconfig_network()
 624
 625 #
 626 # To generate test classes, do:
 627 #   grep '# GEN' test_ipsec_esp.py | sed -e 's/# GEN //g' | bash
 628 #
 629 # GEN for ENG in ia32 ipsecmb openssl; do \
 630 # GEN   for FLG in noESN ESN; do for ALG in AES-GCM-128/NONE \
 631 # GEN     AES-GCM-192/NONE AES-GCM-256/NONE AES-CBC-128/MD5-96 \
 632 # GEN     AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96 \
 633 # GEN     3DES-CBC/SHA1-96 NONE/SHA1-96; do \
 634 # GEN      [[ ${FLG} == "ESN" &&  ${ALG} == *"NONE" ]] && continue
 635 # GEN      echo -e "\n\nclass Test_${ENG}_${FLG}_${ALG}(RunTestIpsecEspAll):" |
 636 # GEN             sed -e 's/-/_/g' -e 's#/#_#g' ; \
 637 # GEN      echo '    """'$ENG $FLG $ALG IPSec test'"""' ;
 638 # GEN      echo "    def test_ipsec(self):";
 639 # GEN      echo "        self.run_test()";
 640 # GEN done; done; done
 641
 642
 643 class Test_ia32_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
 644     """ia32 noESN AES-GCM-128/NONE IPSec test"""
 645     def test_ipsec(self):
 646         self.run_test()
 647
 648
 649 class Test_ia32_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
 650     """ia32 noESN AES-GCM-192/NONE IPSec test"""
 651     def test_ipsec(self):
 652         self.run_test()
 653
 654
 655 class Test_ia32_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
 656     """ia32 noESN AES-GCM-256/NONE IPSec test"""
 657     def test_ipsec(self):
 658         self.run_test()
 659
 660
 661 class Test_ia32_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
 662     """ia32 noESN AES-CBC-128/MD5-96 IPSec test"""
 663     def test_ipsec(self):
 664         self.run_test()
 665
 666
 667 class Test_ia32_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
 668     """ia32 noESN AES-CBC-192/SHA1-96 IPSec test"""
 669     def test_ipsec(self):
 670         self.run_test()
 671
 672
 673 class Test_ia32_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
 674     """ia32 noESN AES-CBC-256/SHA1-96 IPSec test"""
 675     def test_ipsec(self):
 676         self.run_test()
 677
 678
 679 class Test_ia32_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
 680     """ia32 noESN 3DES-CBC/SHA1-96 IPSec test"""
 681     def test_ipsec(self):
 682         self.run_test()
 683
 684
 685 class Test_ia32_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
 686     """ia32 noESN NONE/SHA1-96 IPSec test"""
 687     def test_ipsec(self):
 688         self.run_test()
 689
 690
 691 class Test_ia32_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
 692     """ia32 ESN AES-CBC-128/MD5-96 IPSec test"""
 693     def test_ipsec(self):
 694         self.run_test()
 695
 696
 697 class Test_ia32_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
 698     """ia32 ESN AES-CBC-192/SHA1-96 IPSec test"""
 699     def test_ipsec(self):
 700         self.run_test()
 701
 702
 703 class Test_ia32_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
 704     """ia32 ESN AES-CBC-256/SHA1-96 IPSec test"""
 705     def test_ipsec(self):
 706         self.run_test()
 707
 708
 709 class Test_ia32_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
 710     """ia32 ESN 3DES-CBC/SHA1-96 IPSec test"""
 711     def test_ipsec(self):
 712         self.run_test()
 713
 714
 715 class Test_ia32_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
 716     """ia32 ESN NONE/SHA1-96 IPSec test"""
 717     def test_ipsec(self):
 718         self.run_test()
 719
 720
 721 class Test_ipsecmb_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
 722     """ipsecmb noESN AES-GCM-128/NONE IPSec test"""
 723     def test_ipsec(self):
 724         self.run_test()
 725
 726
 727 class Test_ipsecmb_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
 728     """ipsecmb noESN AES-GCM-192/NONE IPSec test"""
 729     def test_ipsec(self):
 730         self.run_test()
 731
 732
 733 class Test_ipsecmb_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
 734     """ipsecmb noESN AES-GCM-256/NONE IPSec test"""
 735     def test_ipsec(self):
 736         self.run_test()
 737
 738
 739 class Test_ipsecmb_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
 740     """ipsecmb noESN AES-CBC-128/MD5-96 IPSec test"""
 741     def test_ipsec(self):
 742         self.run_test()
 743
 744
 745 class Test_ipsecmb_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
 746     """ipsecmb noESN AES-CBC-192/SHA1-96 IPSec test"""
 747     def test_ipsec(self):
 748         self.run_test()
 749
 750
 751 class Test_ipsecmb_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
 752     """ipsecmb noESN AES-CBC-256/SHA1-96 IPSec test"""
 753     def test_ipsec(self):
 754         self.run_test()
 755
 756
 757 class Test_ipsecmb_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
 758     """ipsecmb noESN 3DES-CBC/SHA1-96 IPSec test"""
 759     def test_ipsec(self):
 760         self.run_test()
 761
 762
 763 class Test_ipsecmb_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
 764     """ipsecmb noESN NONE/SHA1-96 IPSec test"""
 765     def test_ipsec(self):
 766         self.run_test()
 767
 768
 769 class Test_ipsecmb_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
 770     """ipsecmb ESN AES-CBC-128/MD5-96 IPSec test"""
 771     def test_ipsec(self):
 772         self.run_test()
 773
 774
 775 class Test_ipsecmb_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
 776     """ipsecmb ESN AES-CBC-192/SHA1-96 IPSec test"""
 777     def test_ipsec(self):
 778         self.run_test()
 779
 780
 781 class Test_ipsecmb_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
 782     """ipsecmb ESN AES-CBC-256/SHA1-96 IPSec test"""
 783     def test_ipsec(self):
 784         self.run_test()
 785
 786
 787 class Test_ipsecmb_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
 788     """ipsecmb ESN 3DES-CBC/SHA1-96 IPSec test"""
 789     def test_ipsec(self):
 790         self.run_test()
 791
 792
 793 class Test_ipsecmb_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
 794     """ipsecmb ESN NONE/SHA1-96 IPSec test"""
 795     def test_ipsec(self):
 796         self.run_test()
 797
 798
 799 class Test_openssl_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
 800     """openssl noESN AES-GCM-128/NONE IPSec test"""
 801     def test_ipsec(self):
 802         self.run_test()
 803
 804
 805 class Test_openssl_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
 806     """openssl noESN AES-GCM-192/NONE IPSec test"""
 807     def test_ipsec(self):
 808         self.run_test()
 809
 810
 811 class Test_openssl_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
 812     """openssl noESN AES-GCM-256/NONE IPSec test"""
 813     def test_ipsec(self):
 814         self.run_test()
 815
 816
 817 class Test_openssl_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
 818     """openssl noESN AES-CBC-128/MD5-96 IPSec test"""
 819     def test_ipsec(self):
 820         self.run_test()
 821
 822
 823 class Test_openssl_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
 824     """openssl noESN AES-CBC-192/SHA1-96 IPSec test"""
 825     def test_ipsec(self):
 826         self.run_test()
 827
 828
 829 class Test_openssl_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
 830     """openssl noESN AES-CBC-256/SHA1-96 IPSec test"""
 831     def test_ipsec(self):
 832         self.run_test()
 833
 834
 835 class Test_openssl_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
 836     """openssl noESN 3DES-CBC/SHA1-96 IPSec test"""
 837     def test_ipsec(self):
 838         self.run_test()
 839
 840
 841 class Test_openssl_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
 842     """openssl noESN NONE/SHA1-96 IPSec test"""
 843     def test_ipsec(self):
 844         self.run_test()
 845
 846
 847 class Test_openssl_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
 848     """openssl ESN AES-CBC-128/MD5-96 IPSec test"""
 849     def test_ipsec(self):
 850         self.run_test()
 851
 852
 853 class Test_openssl_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
 854     """openssl ESN AES-CBC-192/SHA1-96 IPSec test"""
 855     def test_ipsec(self):
 856         self.run_test()
 857
 858
 859 class Test_openssl_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
 860     """openssl ESN AES-CBC-256/SHA1-96 IPSec test"""
 861     def test_ipsec(self):
 862         self.run_test()
 863
 864
 865 class Test_openssl_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
 866     """openssl ESN 3DES-CBC/SHA1-96 IPSec test"""
 867     def test_ipsec(self):
 868         self.run_test()
 869
 870
 871 class Test_openssl_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
 872     """openssl ESN NONE/SHA1-96 IPSec test"""
 873     def test_ipsec(self):
 874         self.run_test()
 875
 876
 877 if __name__ == '__main__':
 878     unittest.main(testRunner=VppTestRunner)