blob: e40fa561dbd339dc228fa72d9e5eedb9c4d9622a [file] [log] [blame]
Klement Sekera31da2e32018-06-24 22:49:55 +02001import unittest
Klement Sekera611864f2018-09-26 11:19:00 +02002import socket
Neale Ranns80f6fd52019-04-16 02:41:34 +00003import struct
Klement Sekera31da2e32018-06-24 22:49:55 +02004
Neale Ranns53f526b2019-02-25 14:32:02 +00005from scapy.layers.inet import IP, ICMP, TCP, UDP
Damjan Mariona829b132019-04-24 23:39:16 +02006from scapy.layers.ipsec import SecurityAssociation, ESP
Klement Sekera31da2e32018-06-24 22:49:55 +02007from scapy.layers.l2 import Ether, Raw
Klement Sekera611864f2018-09-26 11:19:00 +02008from scapy.layers.inet6 import IPv6, ICMPv6EchoRequest
Klement Sekera31da2e32018-06-24 22:49:55 +02009
10from framework import VppTestCase, VppTestRunner
Neale Rannsd7603d92019-03-28 08:56:10 +000011from util import ppp, reassemble4
Neale Ranns17dcec02019-01-09 21:22:20 -080012from vpp_papi import VppEnum
Klement Sekera31da2e32018-06-24 22:49:55 +020013
14
Klement Sekera611864f2018-09-26 11:19:00 +020015class IPsecIPv4Params(object):
Neale Ranns17dcec02019-01-09 21:22:20 -080016
Klement Sekera611864f2018-09-26 11:19:00 +020017 addr_type = socket.AF_INET
18 addr_any = "0.0.0.0"
19 addr_bcast = "255.255.255.255"
20 addr_len = 32
21 is_ipv6 = 0
Klement Sekera611864f2018-09-26 11:19:00 +020022
Neale Ranns17dcec02019-01-09 21:22:20 -080023 def __init__(self):
24 self.remote_tun_if_host = '1.1.1.1'
Neale Ranns987aea82019-03-27 13:40:35 +000025 self.remote_tun_if_host6 = '1111::1'
Klement Sekera611864f2018-09-26 11:19:00 +020026
Neale Ranns17dcec02019-01-09 21:22:20 -080027 self.scapy_tun_sa_id = 10
28 self.scapy_tun_spi = 1001
29 self.vpp_tun_sa_id = 20
30 self.vpp_tun_spi = 1000
Klement Sekera611864f2018-09-26 11:19:00 +020031
Neale Ranns17dcec02019-01-09 21:22:20 -080032 self.scapy_tra_sa_id = 30
33 self.scapy_tra_spi = 2001
34 self.vpp_tra_sa_id = 40
35 self.vpp_tra_spi = 2000
Klement Sekera611864f2018-09-26 11:19:00 +020036
Neale Ranns17dcec02019-01-09 21:22:20 -080037 self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
38 IPSEC_API_INTEG_ALG_SHA1_96)
39 self.auth_algo = 'HMAC-SHA1-96' # scapy name
40 self.auth_key = 'C91KUR9GYMm5GfkEvNjX'
41
42 self.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t.
43 IPSEC_API_CRYPTO_ALG_AES_CBC_128)
44 self.crypt_algo = 'AES-CBC' # scapy name
45 self.crypt_key = 'JPjyOWBeVEQiMe7h'
Neale Ranns80f6fd52019-04-16 02:41:34 +000046 self.salt = 0
Neale Ranns53f526b2019-02-25 14:32:02 +000047 self.flags = 0
48 self.nat_header = None
Klement Sekera611864f2018-09-26 11:19:00 +020049
50
51class IPsecIPv6Params(object):
Neale Ranns17dcec02019-01-09 21:22:20 -080052
Klement Sekera611864f2018-09-26 11:19:00 +020053 addr_type = socket.AF_INET6
54 addr_any = "0::0"
55 addr_bcast = "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"
56 addr_len = 128
57 is_ipv6 = 1
Klement Sekera611864f2018-09-26 11:19:00 +020058
Neale Ranns17dcec02019-01-09 21:22:20 -080059 def __init__(self):
60 self.remote_tun_if_host = '1111:1111:1111:1111:1111:1111:1111:1111'
Neale Ranns987aea82019-03-27 13:40:35 +000061 self.remote_tun_if_host4 = '1.1.1.1'
Klement Sekera611864f2018-09-26 11:19:00 +020062
Neale Ranns17dcec02019-01-09 21:22:20 -080063 self.scapy_tun_sa_id = 50
64 self.scapy_tun_spi = 3001
65 self.vpp_tun_sa_id = 60
66 self.vpp_tun_spi = 3000
Klement Sekera611864f2018-09-26 11:19:00 +020067
Neale Ranns17dcec02019-01-09 21:22:20 -080068 self.scapy_tra_sa_id = 70
69 self.scapy_tra_spi = 4001
70 self.vpp_tra_sa_id = 80
71 self.vpp_tra_spi = 4000
Klement Sekera611864f2018-09-26 11:19:00 +020072
Neale Ranns17dcec02019-01-09 21:22:20 -080073 self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
Neale Ranns1091c4a2019-04-08 14:48:23 +000074 IPSEC_API_INTEG_ALG_SHA1_96)
75 self.auth_algo = 'HMAC-SHA1-96' # scapy name
Neale Ranns17dcec02019-01-09 21:22:20 -080076 self.auth_key = 'C91KUR9GYMm5GfkEvNjX'
77
78 self.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t.
Neale Ranns4f33c802019-04-10 12:39:10 +000079 IPSEC_API_CRYPTO_ALG_AES_CBC_128)
Neale Ranns17dcec02019-01-09 21:22:20 -080080 self.crypt_algo = 'AES-CBC' # scapy name
Neale Ranns4f33c802019-04-10 12:39:10 +000081 self.crypt_key = 'JPjyOWBeVEQiMe7h'
Neale Ranns80f6fd52019-04-16 02:41:34 +000082 self.salt = 0
Neale Ranns53f526b2019-02-25 14:32:02 +000083 self.flags = 0
84 self.nat_header = None
Klement Sekera611864f2018-09-26 11:19:00 +020085
86
Neale Ranns2ac885c2019-03-20 18:24:43 +000087def config_tun_params(p, encryption_type, tun_if):
88 ip_class_by_addr_type = {socket.AF_INET: IP, socket.AF_INET6: IPv6}
Neale Ranns3833ffd2019-03-21 14:34:09 +000089 use_esn = bool(p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.
Damjan Marion1e3aa5e2019-03-28 10:58:59 +010090 IPSEC_API_SAD_FLAG_USE_ESN))
Neale Ranns80f6fd52019-04-16 02:41:34 +000091 if p.crypt_algo == "AES-GCM":
92 crypt_key = p.crypt_key + struct.pack("!I", p.salt)
93 else:
94 crypt_key = p.crypt_key
Neale Ranns2ac885c2019-03-20 18:24:43 +000095 p.scapy_tun_sa = SecurityAssociation(
96 encryption_type, spi=p.vpp_tun_spi,
Neale Ranns80f6fd52019-04-16 02:41:34 +000097 crypt_algo=p.crypt_algo,
98 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +000099 auth_algo=p.auth_algo, auth_key=p.auth_key,
100 tunnel_header=ip_class_by_addr_type[p.addr_type](
101 src=tun_if.remote_addr[p.addr_type],
102 dst=tun_if.local_addr[p.addr_type]),
Neale Ranns3833ffd2019-03-21 14:34:09 +0000103 nat_t_header=p.nat_header,
104 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000105 p.vpp_tun_sa = SecurityAssociation(
106 encryption_type, spi=p.scapy_tun_spi,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000107 crypt_algo=p.crypt_algo,
108 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000109 auth_algo=p.auth_algo, auth_key=p.auth_key,
110 tunnel_header=ip_class_by_addr_type[p.addr_type](
111 dst=tun_if.remote_addr[p.addr_type],
112 src=tun_if.local_addr[p.addr_type]),
Neale Ranns3833ffd2019-03-21 14:34:09 +0000113 nat_t_header=p.nat_header,
114 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000115
116
117def config_tra_params(p, encryption_type):
Neale Ranns4f33c802019-04-10 12:39:10 +0000118 use_esn = bool(p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.
119 IPSEC_API_SAD_FLAG_USE_ESN))
Neale Ranns80f6fd52019-04-16 02:41:34 +0000120 if p.crypt_algo == "AES-GCM":
121 crypt_key = p.crypt_key + struct.pack("!I", p.salt)
122 else:
123 crypt_key = p.crypt_key
Neale Ranns2ac885c2019-03-20 18:24:43 +0000124 p.scapy_tra_sa = SecurityAssociation(
125 encryption_type,
126 spi=p.vpp_tra_spi,
127 crypt_algo=p.crypt_algo,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000128 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000129 auth_algo=p.auth_algo,
130 auth_key=p.auth_key,
Neale Ranns3833ffd2019-03-21 14:34:09 +0000131 nat_t_header=p.nat_header,
132 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000133 p.vpp_tra_sa = SecurityAssociation(
134 encryption_type,
135 spi=p.scapy_tra_spi,
136 crypt_algo=p.crypt_algo,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000137 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000138 auth_algo=p.auth_algo,
139 auth_key=p.auth_key,
Neale Ranns3833ffd2019-03-21 14:34:09 +0000140 nat_t_header=p.nat_header,
141 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000142
143
Klement Sekera31da2e32018-06-24 22:49:55 +0200144class TemplateIpsec(VppTestCase):
145 """
146 TRANSPORT MODE:
147
148 ------ encrypt ---
149 |tra_if| <-------> |VPP|
150 ------ decrypt ---
151
152 TUNNEL MODE:
153
154 ------ encrypt --- plain ---
155 |tun_if| <------- |VPP| <------ |pg1|
156 ------ --- ---
157
158 ------ decrypt --- plain ---
159 |tun_if| -------> |VPP| ------> |pg1|
160 ------ --- ---
161 """
Neale Ranns4f33c802019-04-10 12:39:10 +0000162 tun_spd_id = 1
163 tra_spd_id = 2
Klement Sekera31da2e32018-06-24 22:49:55 +0200164
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800165 def ipsec_select_backend(self):
Klement Sekerab4d30532018-11-08 13:00:02 +0100166 """ empty method to be overloaded when necessary """
167 pass
168
Paul Vinciguerra7f9b7f92019-03-12 19:23:27 -0700169 @classmethod
170 def setUpClass(cls):
171 super(TemplateIpsec, cls).setUpClass()
172
173 @classmethod
174 def tearDownClass(cls):
175 super(TemplateIpsec, cls).tearDownClass()
176
Neale Ranns3833ffd2019-03-21 14:34:09 +0000177 def setup_params(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800178 self.ipv4_params = IPsecIPv4Params()
179 self.ipv6_params = IPsecIPv6Params()
180 self.params = {self.ipv4_params.addr_type: self.ipv4_params,
181 self.ipv6_params.addr_type: self.ipv6_params}
182
Neale Ranns4f33c802019-04-10 12:39:10 +0000183 def config_interfaces(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800184 self.create_pg_interfaces(range(3))
185 self.interfaces = list(self.pg_interfaces)
186 for i in self.interfaces:
Klement Sekera31da2e32018-06-24 22:49:55 +0200187 i.admin_up()
188 i.config_ip4()
189 i.resolve_arp()
Klement Sekera611864f2018-09-26 11:19:00 +0200190 i.config_ip6()
191 i.resolve_ndp()
Neale Ranns4f33c802019-04-10 12:39:10 +0000192
193 def setUp(self):
194 super(TemplateIpsec, self).setUp()
195
196 self.setup_params()
197
198 self.vpp_esp_protocol = (VppEnum.vl_api_ipsec_proto_t.
199 IPSEC_API_PROTO_ESP)
200 self.vpp_ah_protocol = (VppEnum.vl_api_ipsec_proto_t.
201 IPSEC_API_PROTO_AH)
202
203 self.config_interfaces()
Paul Vinciguerra90cf21b2019-03-13 09:23:05 -0700204
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800205 self.ipsec_select_backend()
Klement Sekera31da2e32018-06-24 22:49:55 +0200206
Neale Ranns4f33c802019-04-10 12:39:10 +0000207 def unconfig_interfaces(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800208 for i in self.interfaces:
209 i.admin_down()
210 i.unconfig_ip4()
211 i.unconfig_ip6()
212
Neale Ranns4f33c802019-04-10 12:39:10 +0000213 def tearDown(self):
214 super(TemplateIpsec, self).tearDown()
215
216 self.unconfig_interfaces()
217
Paul Vinciguerra90cf21b2019-03-13 09:23:05 -0700218 def show_commands_at_teardown(self):
219 self.logger.info(self.vapi.cli("show hardware"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200220
Neale Rannsd7603d92019-03-28 08:56:10 +0000221 def gen_encrypt_pkts(self, sa, sw_intf, src, dst, count=1,
222 payload_size=54):
Klement Sekera31da2e32018-06-24 22:49:55 +0200223 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000224 sa.encrypt(IP(src=src, dst=dst) /
225 ICMP() / Raw('X' * payload_size))
Klement Sekera31da2e32018-06-24 22:49:55 +0200226 for i in range(count)]
227
Neale Rannsd7603d92019-03-28 08:56:10 +0000228 def gen_encrypt_pkts6(self, sa, sw_intf, src, dst, count=1,
229 payload_size=54):
Klement Sekera611864f2018-09-26 11:19:00 +0200230 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
231 sa.encrypt(IPv6(src=src, dst=dst) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000232 ICMPv6EchoRequest(id=0, seq=1,
233 data='X' * payload_size))
Klement Sekera611864f2018-09-26 11:19:00 +0200234 for i in range(count)]
235
Neale Rannsd7603d92019-03-28 08:56:10 +0000236 def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
Klement Sekera31da2e32018-06-24 22:49:55 +0200237 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000238 IP(src=src, dst=dst) / ICMP() / Raw('X' * payload_size)
Klement Sekera31da2e32018-06-24 22:49:55 +0200239 for i in range(count)]
240
Neale Rannsd7603d92019-03-28 08:56:10 +0000241 def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54):
Klement Sekera611864f2018-09-26 11:19:00 +0200242 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
243 IPv6(src=src, dst=dst) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000244 ICMPv6EchoRequest(id=0, seq=1, data='X' * payload_size)
Klement Sekera611864f2018-09-26 11:19:00 +0200245 for i in range(count)]
246
Klement Sekera31da2e32018-06-24 22:49:55 +0200247
Neale Ranns4f33c802019-04-10 12:39:10 +0000248class IpsecTcp(object):
249 def verify_tcp_checksum(self):
Klement Sekera31da2e32018-06-24 22:49:55 +0200250 self.vapi.cli("test http server")
Klement Sekera611864f2018-09-26 11:19:00 +0200251 p = self.params[socket.AF_INET]
Neale Ranns2ac885c2019-03-20 18:24:43 +0000252 config_tun_params(p, self.encryption_type, self.tun_if)
Klement Sekera31da2e32018-06-24 22:49:55 +0200253 send = (Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac) /
Neale Ranns2ac885c2019-03-20 18:24:43 +0000254 p.scapy_tun_sa.encrypt(IP(src=p.remote_tun_if_host,
255 dst=self.tun_if.local_ip4) /
256 TCP(flags='S', dport=80)))
Klement Sekera31da2e32018-06-24 22:49:55 +0200257 self.logger.debug(ppp("Sending packet:", send))
Klement Sekera611864f2018-09-26 11:19:00 +0200258 recv = self.send_and_expect(self.tun_if, [send], self.tun_if)
Klement Sekera31da2e32018-06-24 22:49:55 +0200259 recv = recv[0]
Neale Ranns2ac885c2019-03-20 18:24:43 +0000260 decrypted = p.vpp_tun_sa.decrypt(recv[IP])
Klement Sekera31da2e32018-06-24 22:49:55 +0200261 self.assert_packet_checksums_valid(decrypted)
262
263
Neale Ranns4f33c802019-04-10 12:39:10 +0000264class IpsecTcpTests(IpsecTcp):
265 def test_tcp_checksum(self):
266 """ verify checksum correctness for vpp generated packets """
267 self.verify_tcp_checksum()
268
269
270class IpsecTra4(object):
271 """ verify methods for Transport v4 """
272 def verify_tra_anti_replay(self, count=1):
Neale Rannsde847272018-11-28 01:38:34 -0800273 p = self.params[socket.AF_INET]
Neale Ranns3833ffd2019-03-21 14:34:09 +0000274 use_esn = p.vpp_tra_sa.use_esn
Neale Rannsde847272018-11-28 01:38:34 -0800275
276 # fire in a packet with seq number 1
277 pkt = (Ether(src=self.tra_if.remote_mac,
278 dst=self.tra_if.local_mac) /
279 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
280 dst=self.tra_if.local_ip4) /
281 ICMP(),
282 seq_num=1))
283 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
284
285 # now move the window over to 235
286 pkt = (Ether(src=self.tra_if.remote_mac,
287 dst=self.tra_if.local_mac) /
288 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
289 dst=self.tra_if.local_ip4) /
290 ICMP(),
291 seq_num=235))
292 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
293
Neale Ranns3833ffd2019-03-21 14:34:09 +0000294 # replayed packets are dropped
295 self.send_and_assert_no_replies(self.tra_if, pkt * 3)
Ole Troan233e4682019-05-16 15:01:34 +0200296 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000297 '/err/%s/SA replayed packet' % self.tra4_decrypt_node_name, 3)
298
Neale Rannsde847272018-11-28 01:38:34 -0800299 # the window size is 64 packets
300 # in window are still accepted
301 pkt = (Ether(src=self.tra_if.remote_mac,
302 dst=self.tra_if.local_mac) /
303 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
304 dst=self.tra_if.local_ip4) /
305 ICMP(),
306 seq_num=172))
307 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
308
Neale Rannsde847272018-11-28 01:38:34 -0800309 # a packet that does not decrypt does not move the window forward
310 bogus_sa = SecurityAssociation(self.encryption_type,
Damjan Mariona829b132019-04-24 23:39:16 +0200311 p.vpp_tra_spi,
312 crypt_algo=p.crypt_algo,
313 crypt_key=p.crypt_key[::-1],
314 auth_algo=p.auth_algo,
315 auth_key=p.auth_key[::-1])
Neale Rannsde847272018-11-28 01:38:34 -0800316 pkt = (Ether(src=self.tra_if.remote_mac,
317 dst=self.tra_if.local_mac) /
318 bogus_sa.encrypt(IP(src=self.tra_if.remote_ip4,
319 dst=self.tra_if.local_ip4) /
320 ICMP(),
321 seq_num=350))
322 self.send_and_assert_no_replies(self.tra_if, pkt * 17)
323
Ole Troan233e4682019-05-16 15:01:34 +0200324 self.assert_error_counter_equal(
Klement Sekera14d7e902018-12-10 13:46:09 +0100325 '/err/%s/Integrity check failed' % self.tra4_decrypt_node_name, 17)
Neale Rannsde847272018-11-28 01:38:34 -0800326
Damjan Mariona829b132019-04-24 23:39:16 +0200327 # a malformed 'runt' packet
328 # created by a mis-constructed SA
329 if (ESP == self.encryption_type):
330 bogus_sa = SecurityAssociation(self.encryption_type,
331 p.vpp_tra_spi)
332 pkt = (Ether(src=self.tra_if.remote_mac,
333 dst=self.tra_if.local_mac) /
334 bogus_sa.encrypt(IP(src=self.tra_if.remote_ip4,
335 dst=self.tra_if.local_ip4) /
336 ICMP(),
337 seq_num=350))
338 self.send_and_assert_no_replies(self.tra_if, pkt * 17)
339
Ole Troan233e4682019-05-16 15:01:34 +0200340 self.assert_error_counter_equal(
Damjan Mariona829b132019-04-24 23:39:16 +0200341 '/err/%s/undersized packet' % self.tra4_decrypt_node_name, 17)
342
Neale Rannsde847272018-11-28 01:38:34 -0800343 # which we can determine since this packet is still in the window
344 pkt = (Ether(src=self.tra_if.remote_mac,
345 dst=self.tra_if.local_mac) /
346 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
347 dst=self.tra_if.local_ip4) /
348 ICMP(),
349 seq_num=234))
Klement Sekera14d7e902018-12-10 13:46:09 +0100350 self.send_and_expect(self.tra_if, [pkt], self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -0800351
Neale Ranns3833ffd2019-03-21 14:34:09 +0000352 # out of window are dropped
353 pkt = (Ether(src=self.tra_if.remote_mac,
354 dst=self.tra_if.local_mac) /
355 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
356 dst=self.tra_if.local_ip4) /
357 ICMP(),
358 seq_num=17))
359 self.send_and_assert_no_replies(self.tra_if, pkt * 17)
Neale Ranns00a44202019-03-21 16:36:28 +0000360
Neale Ranns3833ffd2019-03-21 14:34:09 +0000361 if use_esn:
362 # an out of window error with ESN looks like a high sequence
363 # wrap. but since it isn't then the verify will fail.
Ole Troan233e4682019-05-16 15:01:34 +0200364 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000365 '/err/%s/Integrity check failed' %
366 self.tra4_decrypt_node_name, 34)
367
368 else:
Ole Troan233e4682019-05-16 15:01:34 +0200369 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000370 '/err/%s/SA replayed packet' %
371 self.tra4_decrypt_node_name, 20)
372
373 # valid packet moves the window over to 236
Neale Ranns00a44202019-03-21 16:36:28 +0000374 pkt = (Ether(src=self.tra_if.remote_mac,
375 dst=self.tra_if.local_mac) /
376 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
377 dst=self.tra_if.local_ip4) /
378 ICMP(),
379 seq_num=236))
Neale Ranns3833ffd2019-03-21 14:34:09 +0000380 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
381 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
382
383 # move VPP's SA to just before the seq-number wrap
384 self.vapi.cli("test ipsec sa %d seq 0xffffffff" % p.scapy_tra_sa_id)
385
Paul Vinciguerra8feeaff2019-03-27 11:25:48 -0700386 # then fire in a packet that VPP should drop because it causes the
387 # seq number to wrap unless we're using extended.
Neale Ranns3833ffd2019-03-21 14:34:09 +0000388 pkt = (Ether(src=self.tra_if.remote_mac,
389 dst=self.tra_if.local_mac) /
390 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
391 dst=self.tra_if.local_ip4) /
392 ICMP(),
393 seq_num=237))
394
395 if use_esn:
396 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
397 # in order to decrpyt the high order number needs to wrap
398 p.vpp_tra_sa.seq_num = 0x100000000
399 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
400
401 # send packets with high bits set
402 p.scapy_tra_sa.seq_num = 0x100000005
403 pkt = (Ether(src=self.tra_if.remote_mac,
404 dst=self.tra_if.local_mac) /
405 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
406 dst=self.tra_if.local_ip4) /
407 ICMP(),
408 seq_num=0x100000005))
409 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
410 # in order to decrpyt the high order number needs to wrap
411 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
412 else:
413 self.send_and_assert_no_replies(self.tra_if, [pkt])
Ole Troan233e4682019-05-16 15:01:34 +0200414 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000415 '/err/%s/sequence number cycled' %
416 self.tra4_encrypt_node_name, 1)
Neale Ranns00a44202019-03-21 16:36:28 +0000417
Neale Rannsde847272018-11-28 01:38:34 -0800418 # move the security-associations seq number on to the last we used
Neale Ranns00a44202019-03-21 16:36:28 +0000419 self.vapi.cli("test ipsec sa %d seq 0x15f" % p.scapy_tra_sa_id)
Neale Rannsde847272018-11-28 01:38:34 -0800420 p.scapy_tra_sa.seq_num = 351
421 p.vpp_tra_sa.seq_num = 351
422
Neale Ranns4f33c802019-04-10 12:39:10 +0000423 def verify_tra_basic4(self, count=1):
Klement Sekera31da2e32018-06-24 22:49:55 +0200424 """ ipsec v4 transport basic test """
Klement Sekera10d066e2018-11-13 11:12:57 +0100425 self.vapi.cli("clear errors")
Klement Sekera31da2e32018-06-24 22:49:55 +0200426 try:
Klement Sekera611864f2018-09-26 11:19:00 +0200427 p = self.params[socket.AF_INET]
Neale Rannsde847272018-11-28 01:38:34 -0800428 send_pkts = self.gen_encrypt_pkts(p.scapy_tra_sa, self.tra_if,
Klement Sekera31da2e32018-06-24 22:49:55 +0200429 src=self.tra_if.remote_ip4,
430 dst=self.tra_if.local_ip4,
431 count=count)
432 recv_pkts = self.send_and_expect(self.tra_if, send_pkts,
Klement Sekera611864f2018-09-26 11:19:00 +0200433 self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -0800434 for rx in recv_pkts:
Neale Ranns1b582b82019-04-18 19:49:13 -0700435 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
436 self.assert_packet_checksums_valid(rx)
Klement Sekera611864f2018-09-26 11:19:00 +0200437 try:
Neale Rannsde847272018-11-28 01:38:34 -0800438 decrypted = p.vpp_tra_sa.decrypt(rx[IP])
Klement Sekera611864f2018-09-26 11:19:00 +0200439 self.assert_packet_checksums_valid(decrypted)
440 except:
Neale Rannsde847272018-11-28 01:38:34 -0800441 self.logger.debug(ppp("Unexpected packet:", rx))
Klement Sekera611864f2018-09-26 11:19:00 +0200442 raise
Klement Sekera31da2e32018-06-24 22:49:55 +0200443 finally:
444 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400445 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200446
Neale Rannseba31ec2019-02-17 18:04:27 +0000447 pkts = p.tra_sa_in.get_stats()['packets']
448 self.assertEqual(pkts, count,
449 "incorrect SA in counts: expected %d != %d" %
450 (count, pkts))
451 pkts = p.tra_sa_out.get_stats()['packets']
452 self.assertEqual(pkts, count,
453 "incorrect SA out counts: expected %d != %d" %
454 (count, pkts))
455
Klement Sekera10d066e2018-11-13 11:12:57 +0100456 self.assert_packet_counter_equal(self.tra4_encrypt_node_name, count)
457 self.assert_packet_counter_equal(self.tra4_decrypt_node_name, count)
458
Neale Ranns4f33c802019-04-10 12:39:10 +0000459
460class IpsecTra4Tests(IpsecTra4):
461 """ UT test methods for Transport v4 """
462 def test_tra_anti_replay(self):
463 """ ipsec v4 transport anti-reply test """
464 self.verify_tra_anti_replay(count=1)
465
466 def test_tra_basic(self, count=1):
467 """ ipsec v4 transport basic test """
468 self.verify_tra_basic4(count=1)
469
Klement Sekera31da2e32018-06-24 22:49:55 +0200470 def test_tra_burst(self):
471 """ ipsec v4 transport burst test """
Neale Ranns4f33c802019-04-10 12:39:10 +0000472 self.verify_tra_basic4(count=257)
Klement Sekera611864f2018-09-26 11:19:00 +0200473
Neale Ranns53f526b2019-02-25 14:32:02 +0000474
Neale Ranns4f33c802019-04-10 12:39:10 +0000475class IpsecTra6(object):
476 """ verify methods for Transport v6 """
477 def verify_tra_basic6(self, count=1):
Klement Sekera10d066e2018-11-13 11:12:57 +0100478 self.vapi.cli("clear errors")
Klement Sekera31da2e32018-06-24 22:49:55 +0200479 try:
Klement Sekera611864f2018-09-26 11:19:00 +0200480 p = self.params[socket.AF_INET6]
Neale Rannsde847272018-11-28 01:38:34 -0800481 send_pkts = self.gen_encrypt_pkts6(p.scapy_tra_sa, self.tra_if,
Klement Sekera611864f2018-09-26 11:19:00 +0200482 src=self.tra_if.remote_ip6,
483 dst=self.tra_if.local_ip6,
484 count=count)
485 recv_pkts = self.send_and_expect(self.tra_if, send_pkts,
486 self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -0800487 for rx in recv_pkts:
Neale Rannsd207fd72019-04-18 17:18:12 -0700488 self.assertEqual(len(rx) - len(Ether()) - len(IPv6()),
489 rx[IPv6].plen)
Klement Sekera611864f2018-09-26 11:19:00 +0200490 try:
Neale Rannsde847272018-11-28 01:38:34 -0800491 decrypted = p.vpp_tra_sa.decrypt(rx[IPv6])
Klement Sekera611864f2018-09-26 11:19:00 +0200492 self.assert_packet_checksums_valid(decrypted)
493 except:
Neale Rannsde847272018-11-28 01:38:34 -0800494 self.logger.debug(ppp("Unexpected packet:", rx))
Klement Sekera611864f2018-09-26 11:19:00 +0200495 raise
Klement Sekera31da2e32018-06-24 22:49:55 +0200496 finally:
497 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400498 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200499
Neale Rannseba31ec2019-02-17 18:04:27 +0000500 pkts = p.tra_sa_in.get_stats()['packets']
501 self.assertEqual(pkts, count,
502 "incorrect SA in counts: expected %d != %d" %
503 (count, pkts))
504 pkts = p.tra_sa_out.get_stats()['packets']
505 self.assertEqual(pkts, count,
506 "incorrect SA out counts: expected %d != %d" %
507 (count, pkts))
Klement Sekera10d066e2018-11-13 11:12:57 +0100508 self.assert_packet_counter_equal(self.tra6_encrypt_node_name, count)
509 self.assert_packet_counter_equal(self.tra6_decrypt_node_name, count)
510
Neale Ranns4f33c802019-04-10 12:39:10 +0000511
512class IpsecTra6Tests(IpsecTra6):
513 """ UT test methods for Transport v6 """
514 def test_tra_basic6(self):
515 """ ipsec v6 transport basic test """
516 self.verify_tra_basic6(count=1)
517
Klement Sekera611864f2018-09-26 11:19:00 +0200518 def test_tra_burst6(self):
519 """ ipsec v6 transport burst test """
Neale Ranns4f33c802019-04-10 12:39:10 +0000520 self.verify_tra_basic6(count=257)
Klement Sekera31da2e32018-06-24 22:49:55 +0200521
Klement Sekera611864f2018-09-26 11:19:00 +0200522
Neale Ranns53f526b2019-02-25 14:32:02 +0000523class IpsecTra46Tests(IpsecTra4Tests, IpsecTra6Tests):
Neale Ranns4f33c802019-04-10 12:39:10 +0000524 """ UT test methods for Transport v6 and v4"""
Neale Ranns53f526b2019-02-25 14:32:02 +0000525 pass
526
527
Neale Ranns2ac885c2019-03-20 18:24:43 +0000528class IpsecTun4(object):
Neale Ranns4f33c802019-04-10 12:39:10 +0000529 """ verify methods for Tunnel v4 """
Klement Sekera6aa58b72019-05-16 14:34:55 +0200530 def verify_counters4(self, p, count, n_frags=None):
531 if not n_frags:
532 n_frags = count
Neale Ranns987aea82019-03-27 13:40:35 +0000533 if (hasattr(p, "spd_policy_in_any")):
534 pkts = p.spd_policy_in_any.get_stats()['packets']
535 self.assertEqual(pkts, count,
536 "incorrect SPD any policy: expected %d != %d" %
537 (count, pkts))
538
539 if (hasattr(p, "tun_sa_in")):
540 pkts = p.tun_sa_in.get_stats()['packets']
541 self.assertEqual(pkts, count,
542 "incorrect SA in counts: expected %d != %d" %
543 (count, pkts))
544 pkts = p.tun_sa_out.get_stats()['packets']
545 self.assertEqual(pkts, count,
546 "incorrect SA out counts: expected %d != %d" %
547 (count, pkts))
548
Klement Sekera6aa58b72019-05-16 14:34:55 +0200549 self.assert_packet_counter_equal(self.tun4_encrypt_node_name, n_frags)
Neale Ranns987aea82019-03-27 13:40:35 +0000550 self.assert_packet_counter_equal(self.tun4_decrypt_node_name, count)
551
Neale Rannsf05e7322019-03-29 20:23:58 +0000552 def verify_decrypted(self, p, rxs):
553 for rx in rxs:
554 self.assert_equal(rx[IP].src, p.remote_tun_if_host)
555 self.assert_equal(rx[IP].dst, self.pg1.remote_ip4)
556 self.assert_packet_checksums_valid(rx)
557
558 def verify_encrypted(self, p, sa, rxs):
559 decrypt_pkts = []
560 for rx in rxs:
Neale Ranns41afb332019-07-16 06:19:35 -0700561 if p.nat_header:
562 self.assertEqual(rx[UDP].dport, 4500)
Neale Ranns1b582b82019-04-18 19:49:13 -0700563 self.assert_packet_checksums_valid(rx)
564 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
Neale Rannsf05e7322019-03-29 20:23:58 +0000565 try:
566 decrypt_pkt = p.vpp_tun_sa.decrypt(rx[IP])
567 if not decrypt_pkt.haslayer(IP):
568 decrypt_pkt = IP(decrypt_pkt[Raw].load)
569 decrypt_pkts.append(decrypt_pkt)
570 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
571 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
572 except:
573 self.logger.debug(ppp("Unexpected packet:", rx))
574 try:
575 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
576 except:
577 pass
578 raise
579 pkts = reassemble4(decrypt_pkts)
580 for pkt in pkts:
581 self.assert_packet_checksums_valid(pkt)
582
Neale Rannsd7603d92019-03-28 08:56:10 +0000583 def verify_tun_44(self, p, count=1, payload_size=64, n_rx=None):
Klement Sekera10d066e2018-11-13 11:12:57 +0100584 self.vapi.cli("clear errors")
Neale Rannsd7603d92019-03-28 08:56:10 +0000585 if not n_rx:
586 n_rx = count
Klement Sekera31da2e32018-06-24 22:49:55 +0200587 try:
Neale Ranns2ac885c2019-03-20 18:24:43 +0000588 config_tun_params(p, self.encryption_type, self.tun_if)
589 send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
Klement Sekera611864f2018-09-26 11:19:00 +0200590 src=p.remote_tun_if_host,
Klement Sekera31da2e32018-06-24 22:49:55 +0200591 dst=self.pg1.remote_ip4,
592 count=count)
Klement Sekera611864f2018-09-26 11:19:00 +0200593 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
Neale Rannsf05e7322019-03-29 20:23:58 +0000594 self.verify_decrypted(p, recv_pkts)
595
Klement Sekera31da2e32018-06-24 22:49:55 +0200596 send_pkts = self.gen_pkts(self.pg1, src=self.pg1.remote_ip4,
Neale Rannsd7603d92019-03-28 08:56:10 +0000597 dst=p.remote_tun_if_host, count=count,
598 payload_size=payload_size)
599 recv_pkts = self.send_and_expect(self.pg1, send_pkts,
600 self.tun_if, n_rx)
Neale Rannsf05e7322019-03-29 20:23:58 +0000601 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
602
Klement Sekera31da2e32018-06-24 22:49:55 +0200603 finally:
604 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400605 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200606
Klement Sekera6aa58b72019-05-16 14:34:55 +0200607 self.verify_counters4(p, count, n_rx)
Neale Rannseba31ec2019-02-17 18:04:27 +0000608
Neale Ranns987aea82019-03-27 13:40:35 +0000609 def verify_tun_64(self, p, count=1):
610 self.vapi.cli("clear errors")
611 try:
612 config_tun_params(p, self.encryption_type, self.tun_if)
613 send_pkts = self.gen_encrypt_pkts6(p.scapy_tun_sa, self.tun_if,
614 src=p.remote_tun_if_host6,
615 dst=self.pg1.remote_ip6,
616 count=count)
617 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
618 for recv_pkt in recv_pkts:
619 self.assert_equal(recv_pkt[IPv6].src, p.remote_tun_if_host6)
620 self.assert_equal(recv_pkt[IPv6].dst, self.pg1.remote_ip6)
621 self.assert_packet_checksums_valid(recv_pkt)
622 send_pkts = self.gen_pkts6(self.pg1, src=self.pg1.remote_ip6,
623 dst=p.remote_tun_if_host6, count=count)
624 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
625 for recv_pkt in recv_pkts:
626 try:
627 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IP])
628 if not decrypt_pkt.haslayer(IPv6):
629 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
630 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
631 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host6)
632 self.assert_packet_checksums_valid(decrypt_pkt)
633 except:
634 self.logger.error(ppp("Unexpected packet:", recv_pkt))
635 try:
636 self.logger.debug(
637 ppp("Decrypted packet:", decrypt_pkt))
638 except:
639 pass
640 raise
641 finally:
642 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400643 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Rannseba31ec2019-02-17 18:04:27 +0000644
Klement Sekera6aa58b72019-05-16 14:34:55 +0200645 self.verify_counters4(p, count)
Klement Sekera10d066e2018-11-13 11:12:57 +0100646
Neale Ranns41afb332019-07-16 06:19:35 -0700647 def verify_keepalive(self, p):
648 pkt = (Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac) /
649 IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4) /
650 UDP(sport=333, dport=4500) /
651 Raw(0xff))
652 self.send_and_assert_no_replies(self.tun_if, pkt*31)
653 self.assert_error_counter_equal(
654 '/err/%s/NAT Keepalive' % self.tun4_input_node, 31)
655
656 pkt = (Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac) /
657 IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4) /
658 UDP(sport=333, dport=4500) /
659 Raw(0xfe))
660 self.send_and_assert_no_replies(self.tun_if, pkt*31)
661 self.assert_error_counter_equal(
662 '/err/%s/Too Short' % self.tun4_input_node, 31)
663
Neale Ranns2ac885c2019-03-20 18:24:43 +0000664
665class IpsecTun4Tests(IpsecTun4):
Neale Ranns4f33c802019-04-10 12:39:10 +0000666 """ UT test methods for Tunnel v4 """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000667 def test_tun_basic44(self):
668 """ ipsec 4o4 tunnel basic test """
669 self.verify_tun_44(self.params[socket.AF_INET], count=1)
670
Klement Sekera611864f2018-09-26 11:19:00 +0200671 def test_tun_burst44(self):
Klement Sekera31da2e32018-06-24 22:49:55 +0200672 """ ipsec 4o4 tunnel burst test """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000673 self.verify_tun_44(self.params[socket.AF_INET], count=257)
Klement Sekera611864f2018-09-26 11:19:00 +0200674
675
Neale Ranns2ac885c2019-03-20 18:24:43 +0000676class IpsecTun6(object):
Neale Ranns4f33c802019-04-10 12:39:10 +0000677 """ verify methods for Tunnel v6 """
Neale Rannsc87b66c2019-02-07 07:26:12 -0800678 def verify_counters6(self, p_in, p_out, count):
679 if (hasattr(p_in, "tun_sa_in")):
680 pkts = p_in.tun_sa_in.get_stats()['packets']
Neale Ranns987aea82019-03-27 13:40:35 +0000681 self.assertEqual(pkts, count,
682 "incorrect SA in counts: expected %d != %d" %
683 (count, pkts))
Neale Rannsc87b66c2019-02-07 07:26:12 -0800684 if (hasattr(p_out, "tun_sa_out")):
685 pkts = p_out.tun_sa_out.get_stats()['packets']
Neale Ranns987aea82019-03-27 13:40:35 +0000686 self.assertEqual(pkts, count,
687 "incorrect SA out counts: expected %d != %d" %
688 (count, pkts))
689 self.assert_packet_counter_equal(self.tun6_encrypt_node_name, count)
690 self.assert_packet_counter_equal(self.tun6_decrypt_node_name, count)
691
Neale Rannsc87b66c2019-02-07 07:26:12 -0800692 def verify_decrypted6(self, p, rxs):
693 for rx in rxs:
694 self.assert_equal(rx[IPv6].src, p.remote_tun_if_host)
695 self.assert_equal(rx[IPv6].dst, self.pg1.remote_ip6)
696 self.assert_packet_checksums_valid(rx)
697
698 def verify_encrypted6(self, p, sa, rxs):
699 for rx in rxs:
700 self.assert_packet_checksums_valid(rx)
701 self.assertEqual(len(rx) - len(Ether()) - len(IPv6()),
702 rx[IPv6].plen)
703 try:
704 decrypt_pkt = p.vpp_tun_sa.decrypt(rx[IPv6])
705 if not decrypt_pkt.haslayer(IPv6):
706 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
707 self.assert_packet_checksums_valid(decrypt_pkt)
708 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
709 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
710 except:
711 self.logger.debug(ppp("Unexpected packet:", rx))
712 try:
713 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
714 except:
715 pass
716 raise
717
718 def verify_drop_tun_66(self, p_in, count=1, payload_size=64):
Klement Sekera10d066e2018-11-13 11:12:57 +0100719 self.vapi.cli("clear errors")
Neale Rannsc87b66c2019-02-07 07:26:12 -0800720 self.vapi.cli("clear ipsec sa")
721
722 config_tun_params(p_in, self.encryption_type, self.tun_if)
723 send_pkts = self.gen_encrypt_pkts6(p_in.scapy_tun_sa, self.tun_if,
724 src=p_in.remote_tun_if_host,
725 dst=self.pg1.remote_ip6,
726 count=count)
727 self.send_and_assert_no_replies(self.tun_if, send_pkts)
728 self.logger.info(self.vapi.cli("sh punt stats"))
729
730 def verify_tun_66(self, p_in, p_out=None, count=1, payload_size=64):
731 self.vapi.cli("clear errors")
732 self.vapi.cli("clear ipsec sa")
733 if not p_out:
734 p_out = p_in
Klement Sekera31da2e32018-06-24 22:49:55 +0200735 try:
Neale Rannsc87b66c2019-02-07 07:26:12 -0800736 config_tun_params(p_in, self.encryption_type, self.tun_if)
737 config_tun_params(p_out, self.encryption_type, self.tun_if)
738 send_pkts = self.gen_encrypt_pkts6(p_in.scapy_tun_sa, self.tun_if,
739 src=p_in.remote_tun_if_host,
Klement Sekera611864f2018-09-26 11:19:00 +0200740 dst=self.pg1.remote_ip6,
741 count=count)
742 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
Neale Rannsc87b66c2019-02-07 07:26:12 -0800743 self.verify_decrypted6(p_in, recv_pkts)
744
Klement Sekera611864f2018-09-26 11:19:00 +0200745 send_pkts = self.gen_pkts6(self.pg1, src=self.pg1.remote_ip6,
Neale Rannsc87b66c2019-02-07 07:26:12 -0800746 dst=p_out.remote_tun_if_host,
747 count=count,
748 payload_size=payload_size)
749 recv_pkts = self.send_and_expect(self.pg1, send_pkts,
750 self.tun_if)
751 self.verify_encrypted6(p_out, p_out.vpp_tun_sa, recv_pkts)
752
Klement Sekera31da2e32018-06-24 22:49:55 +0200753 finally:
754 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400755 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Rannsc87b66c2019-02-07 07:26:12 -0800756 self.verify_counters6(p_in, p_out, count)
Klement Sekera31da2e32018-06-24 22:49:55 +0200757
Neale Ranns987aea82019-03-27 13:40:35 +0000758 def verify_tun_46(self, p, count=1):
759 """ ipsec 4o6 tunnel basic test """
760 self.vapi.cli("clear errors")
761 try:
762 config_tun_params(p, self.encryption_type, self.tun_if)
763 send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
764 src=p.remote_tun_if_host4,
765 dst=self.pg1.remote_ip4,
766 count=count)
767 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
768 for recv_pkt in recv_pkts:
769 self.assert_equal(recv_pkt[IP].src, p.remote_tun_if_host4)
770 self.assert_equal(recv_pkt[IP].dst, self.pg1.remote_ip4)
771 self.assert_packet_checksums_valid(recv_pkt)
772 send_pkts = self.gen_pkts(self.pg1, src=self.pg1.remote_ip4,
773 dst=p.remote_tun_if_host4,
774 count=count)
775 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
776 for recv_pkt in recv_pkts:
777 try:
778 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IPv6])
779 if not decrypt_pkt.haslayer(IP):
780 decrypt_pkt = IP(decrypt_pkt[Raw].load)
781 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
782 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host4)
783 self.assert_packet_checksums_valid(decrypt_pkt)
784 except:
785 self.logger.debug(ppp("Unexpected packet:", recv_pkt))
786 try:
787 self.logger.debug(ppp("Decrypted packet:",
788 decrypt_pkt))
789 except:
790 pass
791 raise
792 finally:
793 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400794 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Rannsc87b66c2019-02-07 07:26:12 -0800795 self.verify_counters6(p, p, count)
Klement Sekera10d066e2018-11-13 11:12:57 +0100796
Neale Ranns2ac885c2019-03-20 18:24:43 +0000797
798class IpsecTun6Tests(IpsecTun6):
Neale Ranns4f33c802019-04-10 12:39:10 +0000799 """ UT test methods for Tunnel v6 """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000800
801 def test_tun_basic66(self):
802 """ ipsec 6o6 tunnel basic test """
803 self.verify_tun_66(self.params[socket.AF_INET6], count=1)
804
Klement Sekera611864f2018-09-26 11:19:00 +0200805 def test_tun_burst66(self):
806 """ ipsec 6o6 tunnel burst test """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000807 self.verify_tun_66(self.params[socket.AF_INET6], count=257)
Klement Sekera611864f2018-09-26 11:19:00 +0200808
809
Neale Ranns53f526b2019-02-25 14:32:02 +0000810class IpsecTun46Tests(IpsecTun4Tests, IpsecTun6Tests):
Neale Ranns4f33c802019-04-10 12:39:10 +0000811 """ UT test methods for Tunnel v6 & v4 """
Klement Sekera611864f2018-09-26 11:19:00 +0200812 pass
813
Klement Sekera31da2e32018-06-24 22:49:55 +0200814
815if __name__ == '__main__':
816 unittest.main(testRunner=VppTestRunner)