test/vpp_ipsec.py

   1 from vpp_object import VppObject
   2 from ipaddress import ip_address
   3 from vpp_papi import VppEnum
   4
   5 try:
   6     text_type = unicode
   7 except NameError:
   8     text_type = str
   9
  10
  11 class VppIpsecSpd(VppObject):
  12     """
  13     VPP SPD DB
  14     """
  15
  16     def __init__(self, test, id):
  17         self.test = test
  18         self.id = id
  19
  20     def add_vpp_config(self):
  21         self.test.vapi.ipsec_spd_add_del(self.id)
  22         self.test.registry.register(self, self.test.logger)
  23
  24     def remove_vpp_config(self):
  25         self.test.vapi.ipsec_spd_add_del(self.id, is_add=0)
  26
  27     def object_id(self):
  28         return "ipsec-spd-%d" % self.id
  29
  30     def query_vpp_config(self):
  31         spds = self.test.vapi.ipsec_spds_dump()
  32         for spd in spds:
  33             if spd.spd_id == self.id:
  34                 return True
  35         return False
  36
  37
  38 class VppIpsecSpdItfBinding(VppObject):
  39     """
  40     VPP SPD DB to interface binding
  41     (i.e. this SPD is used on this interface)
  42     """
  43
  44     def __init__(self, test, spd, itf):
  45         self.test = test
  46         self.spd = spd
  47         self.itf = itf
  48
  49     def add_vpp_config(self):
  50         self.test.vapi.ipsec_interface_add_del_spd(self.spd.id,
  51                                                    self.itf.sw_if_index)
  52         self.test.registry.register(self, self.test.logger)
  53
  54     def remove_vpp_config(self):
  55         self.test.vapi.ipsec_interface_add_del_spd(self.spd.id,
  56                                                    self.itf.sw_if_index,
  57                                                    is_add=0)
  58
  59     def object_id(self):
  60         return "bind-%s-to-%s" % (self.spd.id, self.itf)
  61
  62     def query_vpp_config(self):
  63         bs = self.test.vapi.ipsec_spd_interface_dump()
  64         for b in bs:
  65             if b.sw_if_index == self.itf.sw_if_index:
  66                 return True
  67         return False
  68
  69
  70 class VppIpsecSpdEntry(VppObject):
  71     """
  72     VPP SPD DB Entry
  73     """
  74
  75     def __init__(self, test, spd, sa_id,
  76                  local_start, local_stop,
  77                  remote_start, remote_stop,
  78                  proto,
  79                  priority=100,
  80                  policy=None,
  81                  is_outbound=1,
  82                  remote_port_start=0,
  83                  remote_port_stop=65535,
  84                  local_port_start=0,
  85                  local_port_stop=65535):
  86         self.test = test
  87         self.spd = spd
  88         self.sa_id = sa_id
  89         self.local_start = ip_address(text_type(local_start))
  90         self.local_stop = ip_address(text_type(local_stop))
  91         self.remote_start = ip_address(text_type(remote_start))
  92         self.remote_stop = ip_address(text_type(remote_stop))
  93         self.proto = proto
  94         self.is_outbound = is_outbound
  95         self.priority = priority
  96         if not policy:
  97             self.policy = (VppEnum.vl_api_ipsec_spd_action_t.
  98                            IPSEC_API_SPD_ACTION_BYPASS)
  99         else:
 100             self.policy = policy
 101         self.is_ipv6 = (0 if self.local_start.version == 4 else 1)
 102         self.local_port_start = local_port_start
 103         self.local_port_stop = local_port_stop
 104         self.remote_port_start = remote_port_start
 105         self.remote_port_stop = remote_port_stop
 106
 107     def add_vpp_config(self):
 108         rv = self.test.vapi.ipsec_spd_entry_add_del(
 109             self.spd.id,
 110             self.sa_id,
 111             self.local_start,
 112             self.local_stop,
 113             self.remote_start,
 114             self.remote_stop,
 115             protocol=self.proto,
 116             is_ipv6=self.is_ipv6,
 117             is_outbound=self.is_outbound,
 118             priority=self.priority,
 119             policy=self.policy,
 120             local_port_start=self.local_port_start,
 121             local_port_stop=self.local_port_stop,
 122             remote_port_start=self.remote_port_start,
 123             remote_port_stop=self.remote_port_stop)
 124         self.stat_index = rv.stat_index
 125         self.test.registry.register(self, self.test.logger)
 126
 127     def remove_vpp_config(self):
 128         self.test.vapi.ipsec_spd_entry_add_del(
 129             self.spd.id,
 130             self.sa_id,
 131             self.local_start,
 132             self.local_stop,
 133             self.remote_start,
 134             self.remote_stop,
 135             protocol=self.proto,
 136             is_ipv6=self.is_ipv6,
 137             is_outbound=self.is_outbound,
 138             priority=self.priority,
 139             policy=self.policy,
 140             local_port_start=self.local_port_start,
 141             local_port_stop=self.local_port_stop,
 142             remote_port_start=self.remote_port_start,
 143             remote_port_stop=self.remote_port_stop,
 144             is_add=0)
 145
 146     def object_id(self):
 147         return "spd-entry-%d-%d-%d-%d-%d-%d" % (self.spd.id,
 148                                                 self.priority,
 149                                                 self.policy,
 150                                                 self.is_outbound,
 151                                                 self.is_ipv6,
 152                                                 self.remote_port_start)
 153
 154     def query_vpp_config(self):
 155         ss = self.test.vapi.ipsec_spd_dump(self.spd.id)
 156         for s in ss:
 157             if s.entry.sa_id == self.sa_id and \
 158                s.entry.is_outbound == self.is_outbound and \
 159                s.entry.priority == self.priority and \
 160                s.entry.policy == self.policy and \
 161                s.entry.remote_address_start == self.remote_start and \
 162                s.entry.remote_port_start == self.remote_port_start:
 163                 return True
 164         return False
 165
 166     def get_stats(self):
 167         c = self.test.statistics.get_counter("/net/ipsec/policy")
 168         return c[0][self.stat_index]
 169
 170
 171 class VppIpsecSA(VppObject):
 172     """
 173     VPP SAD Entry
 174     """
 175
 176     def __init__(self, test, id, spi,
 177                  integ_alg, integ_key,
 178                  crypto_alg, crypto_key,
 179                  proto,
 180                  tun_src=None, tun_dst=None,
 181                  flags=None, salt=0):
 182         e = VppEnum.vl_api_ipsec_sad_flags_t
 183         self.test = test
 184         self.id = id
 185         self.spi = spi
 186         self.integ_alg = integ_alg
 187         self.integ_key = integ_key
 188         self.crypto_alg = crypto_alg
 189         self.crypto_key = crypto_key
 190         self.proto = proto
 191         self.salt = salt
 192
 193         self.tun_src = tun_src
 194         self.tun_dst = tun_dst
 195         if not flags:
 196             self.flags = e.IPSEC_API_SAD_FLAG_NONE
 197         else:
 198             self.flags = flags
 199         if (tun_src):
 200             self.tun_src = ip_address(text_type(tun_src))
 201             self.flags = self.flags | e.IPSEC_API_SAD_FLAG_IS_TUNNEL
 202             if (self.tun_src.version == 6):
 203                 self.flags = self.flags | e.IPSEC_API_SAD_FLAG_IS_TUNNEL_V6
 204         if (tun_dst):
 205             self.tun_dst = ip_address(text_type(tun_dst))
 206
 207     def add_vpp_config(self):
 208         r = self.test.vapi.ipsec_sad_entry_add_del(
 209             self.id,
 210             self.spi,
 211             self.integ_alg,
 212             self.integ_key,
 213             self.crypto_alg,
 214             self.crypto_key,
 215             self.proto,
 216             (self.tun_src if self.tun_src else []),
 217             (self.tun_dst if self.tun_dst else []),
 218             flags=self.flags,
 219             salt=self.salt)
 220         self.stat_index = r.stat_index
 221         self.test.registry.register(self, self.test.logger)
 222
 223     def remove_vpp_config(self):
 224         self.test.vapi.ipsec_sad_entry_add_del(
 225             self.id,
 226             self.spi,
 227             self.integ_alg,
 228             self.integ_key,
 229             self.crypto_alg,
 230             self.crypto_key,
 231             self.proto,
 232             (self.tun_src if self.tun_src else []),
 233             (self.tun_dst if self.tun_dst else []),
 234             flags=self.flags,
 235             is_add=0)
 236
 237     def object_id(self):
 238         return "ipsec-sa-%d" % self.id
 239
 240     def query_vpp_config(self):
 241         bs = self.test.vapi.ipsec_sa_dump()
 242         for b in bs:
 243             if b.entry.sad_id == self.id:
 244                 return True
 245         return False
 246
 247     def get_stats(self):
 248         c = self.test.statistics.get_counter("/net/ipsec/sa")
 249         return c[0][self.stat_index]