blob: 84b878440e97406f475ec80c9cf1042372b46163 [file] [log] [blame]
Klement Sekera31da2e32018-06-24 22:49:55 +02001import unittest
Klement Sekera611864f2018-09-26 11:19:00 +02002import socket
Neale Ranns80f6fd52019-04-16 02:41:34 +00003import struct
Klement Sekera31da2e32018-06-24 22:49:55 +02004
Neale Ranns53f526b2019-02-25 14:32:02 +00005from scapy.layers.inet import IP, ICMP, TCP, UDP
Damjan Mariona829b132019-04-24 23:39:16 +02006from scapy.layers.ipsec import SecurityAssociation, ESP
Klement Sekera31da2e32018-06-24 22:49:55 +02007from scapy.layers.l2 import Ether, Raw
Klement Sekera611864f2018-09-26 11:19:00 +02008from scapy.layers.inet6 import IPv6, ICMPv6EchoRequest
Klement Sekera31da2e32018-06-24 22:49:55 +02009
10from framework import VppTestCase, VppTestRunner
Neale Rannsd7603d92019-03-28 08:56:10 +000011from util import ppp, reassemble4
Neale Ranns17dcec02019-01-09 21:22:20 -080012from vpp_papi import VppEnum
Klement Sekera31da2e32018-06-24 22:49:55 +020013
14
Klement Sekera611864f2018-09-26 11:19:00 +020015class IPsecIPv4Params(object):
Neale Ranns17dcec02019-01-09 21:22:20 -080016
Klement Sekera611864f2018-09-26 11:19:00 +020017 addr_type = socket.AF_INET
18 addr_any = "0.0.0.0"
19 addr_bcast = "255.255.255.255"
20 addr_len = 32
21 is_ipv6 = 0
Klement Sekera611864f2018-09-26 11:19:00 +020022
Neale Ranns17dcec02019-01-09 21:22:20 -080023 def __init__(self):
24 self.remote_tun_if_host = '1.1.1.1'
Neale Ranns987aea82019-03-27 13:40:35 +000025 self.remote_tun_if_host6 = '1111::1'
Klement Sekera611864f2018-09-26 11:19:00 +020026
Neale Ranns17dcec02019-01-09 21:22:20 -080027 self.scapy_tun_sa_id = 10
28 self.scapy_tun_spi = 1001
29 self.vpp_tun_sa_id = 20
30 self.vpp_tun_spi = 1000
Klement Sekera611864f2018-09-26 11:19:00 +020031
Neale Ranns17dcec02019-01-09 21:22:20 -080032 self.scapy_tra_sa_id = 30
33 self.scapy_tra_spi = 2001
34 self.vpp_tra_sa_id = 40
35 self.vpp_tra_spi = 2000
Klement Sekera611864f2018-09-26 11:19:00 +020036
Neale Ranns17dcec02019-01-09 21:22:20 -080037 self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
38 IPSEC_API_INTEG_ALG_SHA1_96)
39 self.auth_algo = 'HMAC-SHA1-96' # scapy name
40 self.auth_key = 'C91KUR9GYMm5GfkEvNjX'
41
42 self.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t.
43 IPSEC_API_CRYPTO_ALG_AES_CBC_128)
44 self.crypt_algo = 'AES-CBC' # scapy name
45 self.crypt_key = 'JPjyOWBeVEQiMe7h'
Neale Ranns80f6fd52019-04-16 02:41:34 +000046 self.salt = 0
Neale Ranns53f526b2019-02-25 14:32:02 +000047 self.flags = 0
48 self.nat_header = None
Klement Sekera611864f2018-09-26 11:19:00 +020049
50
51class IPsecIPv6Params(object):
Neale Ranns17dcec02019-01-09 21:22:20 -080052
Klement Sekera611864f2018-09-26 11:19:00 +020053 addr_type = socket.AF_INET6
54 addr_any = "0::0"
55 addr_bcast = "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"
56 addr_len = 128
57 is_ipv6 = 1
Klement Sekera611864f2018-09-26 11:19:00 +020058
Neale Ranns17dcec02019-01-09 21:22:20 -080059 def __init__(self):
60 self.remote_tun_if_host = '1111:1111:1111:1111:1111:1111:1111:1111'
Neale Ranns987aea82019-03-27 13:40:35 +000061 self.remote_tun_if_host4 = '1.1.1.1'
Klement Sekera611864f2018-09-26 11:19:00 +020062
Neale Ranns17dcec02019-01-09 21:22:20 -080063 self.scapy_tun_sa_id = 50
64 self.scapy_tun_spi = 3001
65 self.vpp_tun_sa_id = 60
66 self.vpp_tun_spi = 3000
Klement Sekera611864f2018-09-26 11:19:00 +020067
Neale Ranns17dcec02019-01-09 21:22:20 -080068 self.scapy_tra_sa_id = 70
69 self.scapy_tra_spi = 4001
70 self.vpp_tra_sa_id = 80
71 self.vpp_tra_spi = 4000
Klement Sekera611864f2018-09-26 11:19:00 +020072
Neale Ranns17dcec02019-01-09 21:22:20 -080073 self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
Neale Ranns1091c4a2019-04-08 14:48:23 +000074 IPSEC_API_INTEG_ALG_SHA1_96)
75 self.auth_algo = 'HMAC-SHA1-96' # scapy name
Neale Ranns17dcec02019-01-09 21:22:20 -080076 self.auth_key = 'C91KUR9GYMm5GfkEvNjX'
77
78 self.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t.
Neale Ranns4f33c802019-04-10 12:39:10 +000079 IPSEC_API_CRYPTO_ALG_AES_CBC_128)
Neale Ranns17dcec02019-01-09 21:22:20 -080080 self.crypt_algo = 'AES-CBC' # scapy name
Neale Ranns4f33c802019-04-10 12:39:10 +000081 self.crypt_key = 'JPjyOWBeVEQiMe7h'
Neale Ranns80f6fd52019-04-16 02:41:34 +000082 self.salt = 0
Neale Ranns53f526b2019-02-25 14:32:02 +000083 self.flags = 0
84 self.nat_header = None
Klement Sekera611864f2018-09-26 11:19:00 +020085
86
Neale Ranns2ac885c2019-03-20 18:24:43 +000087def config_tun_params(p, encryption_type, tun_if):
88 ip_class_by_addr_type = {socket.AF_INET: IP, socket.AF_INET6: IPv6}
Neale Ranns3833ffd2019-03-21 14:34:09 +000089 use_esn = bool(p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.
Damjan Marion1e3aa5e2019-03-28 10:58:59 +010090 IPSEC_API_SAD_FLAG_USE_ESN))
Neale Ranns80f6fd52019-04-16 02:41:34 +000091 if p.crypt_algo == "AES-GCM":
92 crypt_key = p.crypt_key + struct.pack("!I", p.salt)
93 else:
94 crypt_key = p.crypt_key
Neale Ranns2ac885c2019-03-20 18:24:43 +000095 p.scapy_tun_sa = SecurityAssociation(
96 encryption_type, spi=p.vpp_tun_spi,
Neale Ranns80f6fd52019-04-16 02:41:34 +000097 crypt_algo=p.crypt_algo,
98 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +000099 auth_algo=p.auth_algo, auth_key=p.auth_key,
100 tunnel_header=ip_class_by_addr_type[p.addr_type](
101 src=tun_if.remote_addr[p.addr_type],
102 dst=tun_if.local_addr[p.addr_type]),
Neale Ranns3833ffd2019-03-21 14:34:09 +0000103 nat_t_header=p.nat_header,
104 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000105 p.vpp_tun_sa = SecurityAssociation(
106 encryption_type, spi=p.scapy_tun_spi,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000107 crypt_algo=p.crypt_algo,
108 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000109 auth_algo=p.auth_algo, auth_key=p.auth_key,
110 tunnel_header=ip_class_by_addr_type[p.addr_type](
111 dst=tun_if.remote_addr[p.addr_type],
112 src=tun_if.local_addr[p.addr_type]),
Neale Ranns3833ffd2019-03-21 14:34:09 +0000113 nat_t_header=p.nat_header,
114 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000115
116
117def config_tra_params(p, encryption_type):
Neale Ranns4f33c802019-04-10 12:39:10 +0000118 use_esn = bool(p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.
119 IPSEC_API_SAD_FLAG_USE_ESN))
Neale Ranns80f6fd52019-04-16 02:41:34 +0000120 if p.crypt_algo == "AES-GCM":
121 crypt_key = p.crypt_key + struct.pack("!I", p.salt)
122 else:
123 crypt_key = p.crypt_key
Neale Ranns2ac885c2019-03-20 18:24:43 +0000124 p.scapy_tra_sa = SecurityAssociation(
125 encryption_type,
126 spi=p.vpp_tra_spi,
127 crypt_algo=p.crypt_algo,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000128 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000129 auth_algo=p.auth_algo,
130 auth_key=p.auth_key,
Neale Ranns3833ffd2019-03-21 14:34:09 +0000131 nat_t_header=p.nat_header,
132 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000133 p.vpp_tra_sa = SecurityAssociation(
134 encryption_type,
135 spi=p.scapy_tra_spi,
136 crypt_algo=p.crypt_algo,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000137 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000138 auth_algo=p.auth_algo,
139 auth_key=p.auth_key,
Neale Ranns3833ffd2019-03-21 14:34:09 +0000140 nat_t_header=p.nat_header,
141 use_esn=use_esn)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000142
143
Klement Sekera31da2e32018-06-24 22:49:55 +0200144class TemplateIpsec(VppTestCase):
145 """
146 TRANSPORT MODE:
147
148 ------ encrypt ---
149 |tra_if| <-------> |VPP|
150 ------ decrypt ---
151
152 TUNNEL MODE:
153
154 ------ encrypt --- plain ---
155 |tun_if| <------- |VPP| <------ |pg1|
156 ------ --- ---
157
158 ------ decrypt --- plain ---
159 |tun_if| -------> |VPP| ------> |pg1|
160 ------ --- ---
161 """
Neale Ranns4f33c802019-04-10 12:39:10 +0000162 tun_spd_id = 1
163 tra_spd_id = 2
Klement Sekera31da2e32018-06-24 22:49:55 +0200164
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800165 def ipsec_select_backend(self):
Klement Sekerab4d30532018-11-08 13:00:02 +0100166 """ empty method to be overloaded when necessary """
167 pass
168
Paul Vinciguerra7f9b7f92019-03-12 19:23:27 -0700169 @classmethod
170 def setUpClass(cls):
171 super(TemplateIpsec, cls).setUpClass()
172
173 @classmethod
174 def tearDownClass(cls):
175 super(TemplateIpsec, cls).tearDownClass()
176
Neale Ranns3833ffd2019-03-21 14:34:09 +0000177 def setup_params(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800178 self.ipv4_params = IPsecIPv4Params()
179 self.ipv6_params = IPsecIPv6Params()
180 self.params = {self.ipv4_params.addr_type: self.ipv4_params,
181 self.ipv6_params.addr_type: self.ipv6_params}
182
Neale Ranns4f33c802019-04-10 12:39:10 +0000183 def config_interfaces(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800184 self.create_pg_interfaces(range(3))
185 self.interfaces = list(self.pg_interfaces)
186 for i in self.interfaces:
Klement Sekera31da2e32018-06-24 22:49:55 +0200187 i.admin_up()
188 i.config_ip4()
189 i.resolve_arp()
Klement Sekera611864f2018-09-26 11:19:00 +0200190 i.config_ip6()
191 i.resolve_ndp()
Neale Ranns4f33c802019-04-10 12:39:10 +0000192
193 def setUp(self):
194 super(TemplateIpsec, self).setUp()
195
196 self.setup_params()
197
198 self.vpp_esp_protocol = (VppEnum.vl_api_ipsec_proto_t.
199 IPSEC_API_PROTO_ESP)
200 self.vpp_ah_protocol = (VppEnum.vl_api_ipsec_proto_t.
201 IPSEC_API_PROTO_AH)
202
203 self.config_interfaces()
Paul Vinciguerra90cf21b2019-03-13 09:23:05 -0700204
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800205 self.ipsec_select_backend()
Klement Sekera31da2e32018-06-24 22:49:55 +0200206
Neale Ranns4f33c802019-04-10 12:39:10 +0000207 def unconfig_interfaces(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800208 for i in self.interfaces:
209 i.admin_down()
210 i.unconfig_ip4()
211 i.unconfig_ip6()
212
Neale Ranns4f33c802019-04-10 12:39:10 +0000213 def tearDown(self):
214 super(TemplateIpsec, self).tearDown()
215
216 self.unconfig_interfaces()
217
Paul Vinciguerra90cf21b2019-03-13 09:23:05 -0700218 def show_commands_at_teardown(self):
219 self.logger.info(self.vapi.cli("show hardware"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200220
Neale Rannsd7603d92019-03-28 08:56:10 +0000221 def gen_encrypt_pkts(self, sa, sw_intf, src, dst, count=1,
222 payload_size=54):
Klement Sekera31da2e32018-06-24 22:49:55 +0200223 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000224 sa.encrypt(IP(src=src, dst=dst) /
225 ICMP() / Raw('X' * payload_size))
Klement Sekera31da2e32018-06-24 22:49:55 +0200226 for i in range(count)]
227
Neale Rannsd7603d92019-03-28 08:56:10 +0000228 def gen_encrypt_pkts6(self, sa, sw_intf, src, dst, count=1,
229 payload_size=54):
Klement Sekera611864f2018-09-26 11:19:00 +0200230 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
231 sa.encrypt(IPv6(src=src, dst=dst) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000232 ICMPv6EchoRequest(id=0, seq=1,
233 data='X' * payload_size))
Klement Sekera611864f2018-09-26 11:19:00 +0200234 for i in range(count)]
235
Neale Rannsd7603d92019-03-28 08:56:10 +0000236 def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
Klement Sekera31da2e32018-06-24 22:49:55 +0200237 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000238 IP(src=src, dst=dst) / ICMP() / Raw('X' * payload_size)
Klement Sekera31da2e32018-06-24 22:49:55 +0200239 for i in range(count)]
240
Neale Rannsd7603d92019-03-28 08:56:10 +0000241 def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54):
Klement Sekera611864f2018-09-26 11:19:00 +0200242 return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
243 IPv6(src=src, dst=dst) /
Neale Rannsd7603d92019-03-28 08:56:10 +0000244 ICMPv6EchoRequest(id=0, seq=1, data='X' * payload_size)
Klement Sekera611864f2018-09-26 11:19:00 +0200245 for i in range(count)]
246
Klement Sekera31da2e32018-06-24 22:49:55 +0200247
Neale Ranns4f33c802019-04-10 12:39:10 +0000248class IpsecTcp(object):
249 def verify_tcp_checksum(self):
Klement Sekera31da2e32018-06-24 22:49:55 +0200250 self.vapi.cli("test http server")
Klement Sekera611864f2018-09-26 11:19:00 +0200251 p = self.params[socket.AF_INET]
Neale Ranns2ac885c2019-03-20 18:24:43 +0000252 config_tun_params(p, self.encryption_type, self.tun_if)
Klement Sekera31da2e32018-06-24 22:49:55 +0200253 send = (Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac) /
Neale Ranns2ac885c2019-03-20 18:24:43 +0000254 p.scapy_tun_sa.encrypt(IP(src=p.remote_tun_if_host,
255 dst=self.tun_if.local_ip4) /
256 TCP(flags='S', dport=80)))
Klement Sekera31da2e32018-06-24 22:49:55 +0200257 self.logger.debug(ppp("Sending packet:", send))
Klement Sekera611864f2018-09-26 11:19:00 +0200258 recv = self.send_and_expect(self.tun_if, [send], self.tun_if)
Klement Sekera31da2e32018-06-24 22:49:55 +0200259 recv = recv[0]
Neale Ranns2ac885c2019-03-20 18:24:43 +0000260 decrypted = p.vpp_tun_sa.decrypt(recv[IP])
Klement Sekera31da2e32018-06-24 22:49:55 +0200261 self.assert_packet_checksums_valid(decrypted)
262
263
Neale Ranns4f33c802019-04-10 12:39:10 +0000264class IpsecTcpTests(IpsecTcp):
265 def test_tcp_checksum(self):
266 """ verify checksum correctness for vpp generated packets """
267 self.verify_tcp_checksum()
268
269
270class IpsecTra4(object):
271 """ verify methods for Transport v4 """
272 def verify_tra_anti_replay(self, count=1):
Neale Rannsde847272018-11-28 01:38:34 -0800273 p = self.params[socket.AF_INET]
Neale Ranns3833ffd2019-03-21 14:34:09 +0000274 use_esn = p.vpp_tra_sa.use_esn
Neale Rannsde847272018-11-28 01:38:34 -0800275
276 # fire in a packet with seq number 1
277 pkt = (Ether(src=self.tra_if.remote_mac,
278 dst=self.tra_if.local_mac) /
279 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
280 dst=self.tra_if.local_ip4) /
281 ICMP(),
282 seq_num=1))
283 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
284
285 # now move the window over to 235
286 pkt = (Ether(src=self.tra_if.remote_mac,
287 dst=self.tra_if.local_mac) /
288 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
289 dst=self.tra_if.local_ip4) /
290 ICMP(),
291 seq_num=235))
292 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
293
Neale Ranns3833ffd2019-03-21 14:34:09 +0000294 # replayed packets are dropped
295 self.send_and_assert_no_replies(self.tra_if, pkt * 3)
Ole Troan233e4682019-05-16 15:01:34 +0200296 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000297 '/err/%s/SA replayed packet' % self.tra4_decrypt_node_name, 3)
298
Neale Rannsde847272018-11-28 01:38:34 -0800299 # the window size is 64 packets
300 # in window are still accepted
301 pkt = (Ether(src=self.tra_if.remote_mac,
302 dst=self.tra_if.local_mac) /
303 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
304 dst=self.tra_if.local_ip4) /
305 ICMP(),
306 seq_num=172))
307 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
308
Neale Rannsde847272018-11-28 01:38:34 -0800309 # a packet that does not decrypt does not move the window forward
310 bogus_sa = SecurityAssociation(self.encryption_type,
Damjan Mariona829b132019-04-24 23:39:16 +0200311 p.vpp_tra_spi,
312 crypt_algo=p.crypt_algo,
313 crypt_key=p.crypt_key[::-1],
314 auth_algo=p.auth_algo,
315 auth_key=p.auth_key[::-1])
Neale Rannsde847272018-11-28 01:38:34 -0800316 pkt = (Ether(src=self.tra_if.remote_mac,
317 dst=self.tra_if.local_mac) /
318 bogus_sa.encrypt(IP(src=self.tra_if.remote_ip4,
319 dst=self.tra_if.local_ip4) /
320 ICMP(),
321 seq_num=350))
322 self.send_and_assert_no_replies(self.tra_if, pkt * 17)
323
Ole Troan233e4682019-05-16 15:01:34 +0200324 self.assert_error_counter_equal(
Klement Sekera14d7e902018-12-10 13:46:09 +0100325 '/err/%s/Integrity check failed' % self.tra4_decrypt_node_name, 17)
Neale Rannsde847272018-11-28 01:38:34 -0800326
Damjan Mariona829b132019-04-24 23:39:16 +0200327 # a malformed 'runt' packet
328 # created by a mis-constructed SA
329 if (ESP == self.encryption_type):
330 bogus_sa = SecurityAssociation(self.encryption_type,
331 p.vpp_tra_spi)
332 pkt = (Ether(src=self.tra_if.remote_mac,
333 dst=self.tra_if.local_mac) /
334 bogus_sa.encrypt(IP(src=self.tra_if.remote_ip4,
335 dst=self.tra_if.local_ip4) /
336 ICMP(),
337 seq_num=350))
338 self.send_and_assert_no_replies(self.tra_if, pkt * 17)
339
Ole Troan233e4682019-05-16 15:01:34 +0200340 self.assert_error_counter_equal(
Damjan Mariona829b132019-04-24 23:39:16 +0200341 '/err/%s/undersized packet' % self.tra4_decrypt_node_name, 17)
342
Neale Rannsde847272018-11-28 01:38:34 -0800343 # which we can determine since this packet is still in the window
344 pkt = (Ether(src=self.tra_if.remote_mac,
345 dst=self.tra_if.local_mac) /
346 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
347 dst=self.tra_if.local_ip4) /
348 ICMP(),
349 seq_num=234))
Klement Sekera14d7e902018-12-10 13:46:09 +0100350 self.send_and_expect(self.tra_if, [pkt], self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -0800351
Neale Ranns3833ffd2019-03-21 14:34:09 +0000352 # out of window are dropped
353 pkt = (Ether(src=self.tra_if.remote_mac,
354 dst=self.tra_if.local_mac) /
355 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
356 dst=self.tra_if.local_ip4) /
357 ICMP(),
358 seq_num=17))
359 self.send_and_assert_no_replies(self.tra_if, pkt * 17)
Neale Ranns00a44202019-03-21 16:36:28 +0000360
Neale Ranns3833ffd2019-03-21 14:34:09 +0000361 if use_esn:
362 # an out of window error with ESN looks like a high sequence
363 # wrap. but since it isn't then the verify will fail.
Ole Troan233e4682019-05-16 15:01:34 +0200364 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000365 '/err/%s/Integrity check failed' %
366 self.tra4_decrypt_node_name, 34)
367
368 else:
Ole Troan233e4682019-05-16 15:01:34 +0200369 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000370 '/err/%s/SA replayed packet' %
371 self.tra4_decrypt_node_name, 20)
372
373 # valid packet moves the window over to 236
Neale Ranns00a44202019-03-21 16:36:28 +0000374 pkt = (Ether(src=self.tra_if.remote_mac,
375 dst=self.tra_if.local_mac) /
376 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
377 dst=self.tra_if.local_ip4) /
378 ICMP(),
379 seq_num=236))
Neale Ranns3833ffd2019-03-21 14:34:09 +0000380 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
381 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
382
383 # move VPP's SA to just before the seq-number wrap
384 self.vapi.cli("test ipsec sa %d seq 0xffffffff" % p.scapy_tra_sa_id)
385
Paul Vinciguerra8feeaff2019-03-27 11:25:48 -0700386 # then fire in a packet that VPP should drop because it causes the
387 # seq number to wrap unless we're using extended.
Neale Ranns3833ffd2019-03-21 14:34:09 +0000388 pkt = (Ether(src=self.tra_if.remote_mac,
389 dst=self.tra_if.local_mac) /
390 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
391 dst=self.tra_if.local_ip4) /
392 ICMP(),
393 seq_num=237))
394
395 if use_esn:
396 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
397 # in order to decrpyt the high order number needs to wrap
398 p.vpp_tra_sa.seq_num = 0x100000000
399 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
400
401 # send packets with high bits set
402 p.scapy_tra_sa.seq_num = 0x100000005
403 pkt = (Ether(src=self.tra_if.remote_mac,
404 dst=self.tra_if.local_mac) /
405 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
406 dst=self.tra_if.local_ip4) /
407 ICMP(),
408 seq_num=0x100000005))
409 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
410 # in order to decrpyt the high order number needs to wrap
411 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
412 else:
413 self.send_and_assert_no_replies(self.tra_if, [pkt])
Ole Troan233e4682019-05-16 15:01:34 +0200414 self.assert_error_counter_equal(
Neale Ranns3833ffd2019-03-21 14:34:09 +0000415 '/err/%s/sequence number cycled' %
416 self.tra4_encrypt_node_name, 1)
Neale Ranns00a44202019-03-21 16:36:28 +0000417
Neale Rannsde847272018-11-28 01:38:34 -0800418 # move the security-associations seq number on to the last we used
Neale Ranns00a44202019-03-21 16:36:28 +0000419 self.vapi.cli("test ipsec sa %d seq 0x15f" % p.scapy_tra_sa_id)
Neale Rannsde847272018-11-28 01:38:34 -0800420 p.scapy_tra_sa.seq_num = 351
421 p.vpp_tra_sa.seq_num = 351
422
Neale Ranns4f33c802019-04-10 12:39:10 +0000423 def verify_tra_basic4(self, count=1):
Klement Sekera31da2e32018-06-24 22:49:55 +0200424 """ ipsec v4 transport basic test """
Klement Sekera10d066e2018-11-13 11:12:57 +0100425 self.vapi.cli("clear errors")
Klement Sekera31da2e32018-06-24 22:49:55 +0200426 try:
Klement Sekera611864f2018-09-26 11:19:00 +0200427 p = self.params[socket.AF_INET]
Neale Rannsde847272018-11-28 01:38:34 -0800428 send_pkts = self.gen_encrypt_pkts(p.scapy_tra_sa, self.tra_if,
Klement Sekera31da2e32018-06-24 22:49:55 +0200429 src=self.tra_if.remote_ip4,
430 dst=self.tra_if.local_ip4,
431 count=count)
432 recv_pkts = self.send_and_expect(self.tra_if, send_pkts,
Klement Sekera611864f2018-09-26 11:19:00 +0200433 self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -0800434 for rx in recv_pkts:
Neale Ranns1b582b82019-04-18 19:49:13 -0700435 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
436 self.assert_packet_checksums_valid(rx)
Klement Sekera611864f2018-09-26 11:19:00 +0200437 try:
Neale Rannsde847272018-11-28 01:38:34 -0800438 decrypted = p.vpp_tra_sa.decrypt(rx[IP])
Klement Sekera611864f2018-09-26 11:19:00 +0200439 self.assert_packet_checksums_valid(decrypted)
440 except:
Neale Rannsde847272018-11-28 01:38:34 -0800441 self.logger.debug(ppp("Unexpected packet:", rx))
Klement Sekera611864f2018-09-26 11:19:00 +0200442 raise
Klement Sekera31da2e32018-06-24 22:49:55 +0200443 finally:
444 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400445 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200446
Neale Rannseba31ec2019-02-17 18:04:27 +0000447 pkts = p.tra_sa_in.get_stats()['packets']
448 self.assertEqual(pkts, count,
449 "incorrect SA in counts: expected %d != %d" %
450 (count, pkts))
451 pkts = p.tra_sa_out.get_stats()['packets']
452 self.assertEqual(pkts, count,
453 "incorrect SA out counts: expected %d != %d" %
454 (count, pkts))
455
Klement Sekera10d066e2018-11-13 11:12:57 +0100456 self.assert_packet_counter_equal(self.tra4_encrypt_node_name, count)
457 self.assert_packet_counter_equal(self.tra4_decrypt_node_name, count)
458
Neale Ranns4f33c802019-04-10 12:39:10 +0000459
460class IpsecTra4Tests(IpsecTra4):
461 """ UT test methods for Transport v4 """
462 def test_tra_anti_replay(self):
463 """ ipsec v4 transport anti-reply test """
464 self.verify_tra_anti_replay(count=1)
465
466 def test_tra_basic(self, count=1):
467 """ ipsec v4 transport basic test """
468 self.verify_tra_basic4(count=1)
469
Klement Sekera31da2e32018-06-24 22:49:55 +0200470 def test_tra_burst(self):
471 """ ipsec v4 transport burst test """
Neale Ranns4f33c802019-04-10 12:39:10 +0000472 self.verify_tra_basic4(count=257)
Klement Sekera611864f2018-09-26 11:19:00 +0200473
Neale Ranns53f526b2019-02-25 14:32:02 +0000474
Neale Ranns4f33c802019-04-10 12:39:10 +0000475class IpsecTra6(object):
476 """ verify methods for Transport v6 """
477 def verify_tra_basic6(self, count=1):
Klement Sekera10d066e2018-11-13 11:12:57 +0100478 self.vapi.cli("clear errors")
Klement Sekera31da2e32018-06-24 22:49:55 +0200479 try:
Klement Sekera611864f2018-09-26 11:19:00 +0200480 p = self.params[socket.AF_INET6]
Neale Rannsde847272018-11-28 01:38:34 -0800481 send_pkts = self.gen_encrypt_pkts6(p.scapy_tra_sa, self.tra_if,
Klement Sekera611864f2018-09-26 11:19:00 +0200482 src=self.tra_if.remote_ip6,
483 dst=self.tra_if.local_ip6,
484 count=count)
485 recv_pkts = self.send_and_expect(self.tra_if, send_pkts,
486 self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -0800487 for rx in recv_pkts:
Neale Rannsd207fd72019-04-18 17:18:12 -0700488 self.assertEqual(len(rx) - len(Ether()) - len(IPv6()),
489 rx[IPv6].plen)
Klement Sekera611864f2018-09-26 11:19:00 +0200490 try:
Neale Rannsde847272018-11-28 01:38:34 -0800491 decrypted = p.vpp_tra_sa.decrypt(rx[IPv6])
Klement Sekera611864f2018-09-26 11:19:00 +0200492 self.assert_packet_checksums_valid(decrypted)
493 except:
Neale Rannsde847272018-11-28 01:38:34 -0800494 self.logger.debug(ppp("Unexpected packet:", rx))
Klement Sekera611864f2018-09-26 11:19:00 +0200495 raise
Klement Sekera31da2e32018-06-24 22:49:55 +0200496 finally:
497 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400498 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200499
Neale Rannseba31ec2019-02-17 18:04:27 +0000500 pkts = p.tra_sa_in.get_stats()['packets']
501 self.assertEqual(pkts, count,
502 "incorrect SA in counts: expected %d != %d" %
503 (count, pkts))
504 pkts = p.tra_sa_out.get_stats()['packets']
505 self.assertEqual(pkts, count,
506 "incorrect SA out counts: expected %d != %d" %
507 (count, pkts))
Klement Sekera10d066e2018-11-13 11:12:57 +0100508 self.assert_packet_counter_equal(self.tra6_encrypt_node_name, count)
509 self.assert_packet_counter_equal(self.tra6_decrypt_node_name, count)
510
Neale Ranns4f33c802019-04-10 12:39:10 +0000511
512class IpsecTra6Tests(IpsecTra6):
513 """ UT test methods for Transport v6 """
514 def test_tra_basic6(self):
515 """ ipsec v6 transport basic test """
516 self.verify_tra_basic6(count=1)
517
Klement Sekera611864f2018-09-26 11:19:00 +0200518 def test_tra_burst6(self):
519 """ ipsec v6 transport burst test """
Neale Ranns4f33c802019-04-10 12:39:10 +0000520 self.verify_tra_basic6(count=257)
Klement Sekera31da2e32018-06-24 22:49:55 +0200521
Klement Sekera611864f2018-09-26 11:19:00 +0200522
Neale Ranns53f526b2019-02-25 14:32:02 +0000523class IpsecTra46Tests(IpsecTra4Tests, IpsecTra6Tests):
Neale Ranns4f33c802019-04-10 12:39:10 +0000524 """ UT test methods for Transport v6 and v4"""
Neale Ranns53f526b2019-02-25 14:32:02 +0000525 pass
526
527
Neale Ranns2ac885c2019-03-20 18:24:43 +0000528class IpsecTun4(object):
Neale Ranns4f33c802019-04-10 12:39:10 +0000529 """ verify methods for Tunnel v4 """
Neale Ranns987aea82019-03-27 13:40:35 +0000530 def verify_counters(self, p, count):
531 if (hasattr(p, "spd_policy_in_any")):
532 pkts = p.spd_policy_in_any.get_stats()['packets']
533 self.assertEqual(pkts, count,
534 "incorrect SPD any policy: expected %d != %d" %
535 (count, pkts))
536
537 if (hasattr(p, "tun_sa_in")):
538 pkts = p.tun_sa_in.get_stats()['packets']
539 self.assertEqual(pkts, count,
540 "incorrect SA in counts: expected %d != %d" %
541 (count, pkts))
542 pkts = p.tun_sa_out.get_stats()['packets']
543 self.assertEqual(pkts, count,
544 "incorrect SA out counts: expected %d != %d" %
545 (count, pkts))
546
547 self.assert_packet_counter_equal(self.tun4_encrypt_node_name, count)
548 self.assert_packet_counter_equal(self.tun4_decrypt_node_name, count)
549
Neale Rannsf05e7322019-03-29 20:23:58 +0000550 def verify_decrypted(self, p, rxs):
551 for rx in rxs:
552 self.assert_equal(rx[IP].src, p.remote_tun_if_host)
553 self.assert_equal(rx[IP].dst, self.pg1.remote_ip4)
554 self.assert_packet_checksums_valid(rx)
555
556 def verify_encrypted(self, p, sa, rxs):
557 decrypt_pkts = []
558 for rx in rxs:
Neale Ranns1b582b82019-04-18 19:49:13 -0700559 self.assert_packet_checksums_valid(rx)
560 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
Neale Rannsf05e7322019-03-29 20:23:58 +0000561 try:
562 decrypt_pkt = p.vpp_tun_sa.decrypt(rx[IP])
563 if not decrypt_pkt.haslayer(IP):
564 decrypt_pkt = IP(decrypt_pkt[Raw].load)
565 decrypt_pkts.append(decrypt_pkt)
566 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
567 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
568 except:
569 self.logger.debug(ppp("Unexpected packet:", rx))
570 try:
571 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
572 except:
573 pass
574 raise
575 pkts = reassemble4(decrypt_pkts)
576 for pkt in pkts:
577 self.assert_packet_checksums_valid(pkt)
578
Neale Rannsd7603d92019-03-28 08:56:10 +0000579 def verify_tun_44(self, p, count=1, payload_size=64, n_rx=None):
Klement Sekera10d066e2018-11-13 11:12:57 +0100580 self.vapi.cli("clear errors")
Neale Rannsd7603d92019-03-28 08:56:10 +0000581 if not n_rx:
582 n_rx = count
Klement Sekera31da2e32018-06-24 22:49:55 +0200583 try:
Neale Ranns2ac885c2019-03-20 18:24:43 +0000584 config_tun_params(p, self.encryption_type, self.tun_if)
585 send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
Klement Sekera611864f2018-09-26 11:19:00 +0200586 src=p.remote_tun_if_host,
Klement Sekera31da2e32018-06-24 22:49:55 +0200587 dst=self.pg1.remote_ip4,
588 count=count)
Klement Sekera611864f2018-09-26 11:19:00 +0200589 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
Neale Rannsf05e7322019-03-29 20:23:58 +0000590 self.verify_decrypted(p, recv_pkts)
591
Klement Sekera31da2e32018-06-24 22:49:55 +0200592 send_pkts = self.gen_pkts(self.pg1, src=self.pg1.remote_ip4,
Neale Rannsd7603d92019-03-28 08:56:10 +0000593 dst=p.remote_tun_if_host, count=count,
594 payload_size=payload_size)
595 recv_pkts = self.send_and_expect(self.pg1, send_pkts,
596 self.tun_if, n_rx)
Neale Rannsf05e7322019-03-29 20:23:58 +0000597 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
598
Klement Sekera31da2e32018-06-24 22:49:55 +0200599 finally:
600 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400601 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200602
Neale Ranns987aea82019-03-27 13:40:35 +0000603 self.verify_counters(p, count)
Neale Rannseba31ec2019-02-17 18:04:27 +0000604
Neale Ranns987aea82019-03-27 13:40:35 +0000605 def verify_tun_64(self, p, count=1):
606 self.vapi.cli("clear errors")
607 try:
608 config_tun_params(p, self.encryption_type, self.tun_if)
609 send_pkts = self.gen_encrypt_pkts6(p.scapy_tun_sa, self.tun_if,
610 src=p.remote_tun_if_host6,
611 dst=self.pg1.remote_ip6,
612 count=count)
613 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
614 for recv_pkt in recv_pkts:
615 self.assert_equal(recv_pkt[IPv6].src, p.remote_tun_if_host6)
616 self.assert_equal(recv_pkt[IPv6].dst, self.pg1.remote_ip6)
617 self.assert_packet_checksums_valid(recv_pkt)
618 send_pkts = self.gen_pkts6(self.pg1, src=self.pg1.remote_ip6,
619 dst=p.remote_tun_if_host6, count=count)
620 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
621 for recv_pkt in recv_pkts:
622 try:
623 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IP])
624 if not decrypt_pkt.haslayer(IPv6):
625 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
626 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
627 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host6)
628 self.assert_packet_checksums_valid(decrypt_pkt)
629 except:
630 self.logger.error(ppp("Unexpected packet:", recv_pkt))
631 try:
632 self.logger.debug(
633 ppp("Decrypted packet:", decrypt_pkt))
634 except:
635 pass
636 raise
637 finally:
638 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400639 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Rannseba31ec2019-02-17 18:04:27 +0000640
Neale Ranns987aea82019-03-27 13:40:35 +0000641 self.verify_counters(p, count)
Klement Sekera10d066e2018-11-13 11:12:57 +0100642
Neale Ranns2ac885c2019-03-20 18:24:43 +0000643
644class IpsecTun4Tests(IpsecTun4):
Neale Ranns4f33c802019-04-10 12:39:10 +0000645 """ UT test methods for Tunnel v4 """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000646 def test_tun_basic44(self):
647 """ ipsec 4o4 tunnel basic test """
648 self.verify_tun_44(self.params[socket.AF_INET], count=1)
649
Klement Sekera611864f2018-09-26 11:19:00 +0200650 def test_tun_burst44(self):
Klement Sekera31da2e32018-06-24 22:49:55 +0200651 """ ipsec 4o4 tunnel burst test """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000652 self.verify_tun_44(self.params[socket.AF_INET], count=257)
Klement Sekera611864f2018-09-26 11:19:00 +0200653
654
Neale Ranns2ac885c2019-03-20 18:24:43 +0000655class IpsecTun6(object):
Neale Ranns4f33c802019-04-10 12:39:10 +0000656 """ verify methods for Tunnel v6 """
Neale Ranns987aea82019-03-27 13:40:35 +0000657 def verify_counters(self, p, count):
658 if (hasattr(p, "tun_sa_in")):
659 pkts = p.tun_sa_in.get_stats()['packets']
660 self.assertEqual(pkts, count,
661 "incorrect SA in counts: expected %d != %d" %
662 (count, pkts))
663 pkts = p.tun_sa_out.get_stats()['packets']
664 self.assertEqual(pkts, count,
665 "incorrect SA out counts: expected %d != %d" %
666 (count, pkts))
667 self.assert_packet_counter_equal(self.tun6_encrypt_node_name, count)
668 self.assert_packet_counter_equal(self.tun6_decrypt_node_name, count)
669
Neale Ranns2ac885c2019-03-20 18:24:43 +0000670 def verify_tun_66(self, p, count=1):
Klement Sekera611864f2018-09-26 11:19:00 +0200671 """ ipsec 6o6 tunnel basic test """
Klement Sekera10d066e2018-11-13 11:12:57 +0100672 self.vapi.cli("clear errors")
Klement Sekera31da2e32018-06-24 22:49:55 +0200673 try:
Neale Ranns2ac885c2019-03-20 18:24:43 +0000674 config_tun_params(p, self.encryption_type, self.tun_if)
675 send_pkts = self.gen_encrypt_pkts6(p.scapy_tun_sa, self.tun_if,
Klement Sekera611864f2018-09-26 11:19:00 +0200676 src=p.remote_tun_if_host,
677 dst=self.pg1.remote_ip6,
678 count=count)
679 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
680 for recv_pkt in recv_pkts:
681 self.assert_equal(recv_pkt[IPv6].src, p.remote_tun_if_host)
682 self.assert_equal(recv_pkt[IPv6].dst, self.pg1.remote_ip6)
683 self.assert_packet_checksums_valid(recv_pkt)
684 send_pkts = self.gen_pkts6(self.pg1, src=self.pg1.remote_ip6,
685 dst=p.remote_tun_if_host,
686 count=count)
687 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
688 for recv_pkt in recv_pkts:
Neale Rannsd207fd72019-04-18 17:18:12 -0700689 self.assertEqual(len(recv_pkt) - len(Ether()) - len(IPv6()),
690 recv_pkt[IPv6].plen)
Klement Sekera611864f2018-09-26 11:19:00 +0200691 try:
Neale Ranns2ac885c2019-03-20 18:24:43 +0000692 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IPv6])
Klement Sekera611864f2018-09-26 11:19:00 +0200693 if not decrypt_pkt.haslayer(IPv6):
694 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
695 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
696 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
697 self.assert_packet_checksums_valid(decrypt_pkt)
698 except:
699 self.logger.debug(ppp("Unexpected packet:", recv_pkt))
700 try:
701 self.logger.debug(
702 ppp("Decrypted packet:", decrypt_pkt))
703 except:
704 pass
705 raise
Klement Sekera31da2e32018-06-24 22:49:55 +0200706 finally:
707 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400708 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Ranns987aea82019-03-27 13:40:35 +0000709 self.verify_counters(p, count)
Klement Sekera31da2e32018-06-24 22:49:55 +0200710
Neale Ranns987aea82019-03-27 13:40:35 +0000711 def verify_tun_46(self, p, count=1):
712 """ ipsec 4o6 tunnel basic test """
713 self.vapi.cli("clear errors")
714 try:
715 config_tun_params(p, self.encryption_type, self.tun_if)
716 send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
717 src=p.remote_tun_if_host4,
718 dst=self.pg1.remote_ip4,
719 count=count)
720 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
721 for recv_pkt in recv_pkts:
722 self.assert_equal(recv_pkt[IP].src, p.remote_tun_if_host4)
723 self.assert_equal(recv_pkt[IP].dst, self.pg1.remote_ip4)
724 self.assert_packet_checksums_valid(recv_pkt)
725 send_pkts = self.gen_pkts(self.pg1, src=self.pg1.remote_ip4,
726 dst=p.remote_tun_if_host4,
727 count=count)
728 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
729 for recv_pkt in recv_pkts:
730 try:
731 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IPv6])
732 if not decrypt_pkt.haslayer(IP):
733 decrypt_pkt = IP(decrypt_pkt[Raw].load)
734 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
735 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host4)
736 self.assert_packet_checksums_valid(decrypt_pkt)
737 except:
738 self.logger.debug(ppp("Unexpected packet:", recv_pkt))
739 try:
740 self.logger.debug(ppp("Decrypted packet:",
741 decrypt_pkt))
742 except:
743 pass
744 raise
745 finally:
746 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -0400747 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Ranns987aea82019-03-27 13:40:35 +0000748 self.verify_counters(p, count)
Klement Sekera10d066e2018-11-13 11:12:57 +0100749
Neale Ranns2ac885c2019-03-20 18:24:43 +0000750
751class IpsecTun6Tests(IpsecTun6):
Neale Ranns4f33c802019-04-10 12:39:10 +0000752 """ UT test methods for Tunnel v6 """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000753
754 def test_tun_basic66(self):
755 """ ipsec 6o6 tunnel basic test """
756 self.verify_tun_66(self.params[socket.AF_INET6], count=1)
757
Klement Sekera611864f2018-09-26 11:19:00 +0200758 def test_tun_burst66(self):
759 """ ipsec 6o6 tunnel burst test """
Neale Ranns2ac885c2019-03-20 18:24:43 +0000760 self.verify_tun_66(self.params[socket.AF_INET6], count=257)
Klement Sekera611864f2018-09-26 11:19:00 +0200761
762
Neale Ranns53f526b2019-02-25 14:32:02 +0000763class IpsecTun46Tests(IpsecTun4Tests, IpsecTun6Tests):
Neale Ranns4f33c802019-04-10 12:39:10 +0000764 """ UT test methods for Tunnel v6 & v4 """
Klement Sekera611864f2018-09-26 11:19:00 +0200765 pass
766
Klement Sekera31da2e32018-06-24 22:49:55 +0200767
768if __name__ == '__main__':
769 unittest.main(testRunner=VppTestRunner)