blob: 013e3d7310b2b84f26260aad93ab82f315ea6024 [file] [log] [blame]
Paul Vinciguerraa279d9c2019-02-28 09:00:09 -08001from vpp_object import VppObject
Neale Ranns311124e2019-01-24 04:52:25 -08002from ipaddress import ip_address
Neale Ranns17dcec02019-01-09 21:22:20 -08003from vpp_papi import VppEnum
Neale Rannsdd4ccf22020-06-30 07:47:14 +00004from vpp_interface import VppInterface
Neale Ranns311124e2019-01-24 04:52:25 -08005
6try:
7 text_type = unicode
8except NameError:
9 text_type = str
10
11
Neale Ranns4a56f4e2019-12-23 04:10:25 +000012def mk_counter():
13 return {'packets': 0, 'bytes': 0}
14
15
Neale Ranns311124e2019-01-24 04:52:25 -080016class VppIpsecSpd(VppObject):
17 """
18 VPP SPD DB
19 """
20
21 def __init__(self, test, id):
22 self.test = test
23 self.id = id
24
25 def add_vpp_config(self):
26 self.test.vapi.ipsec_spd_add_del(self.id)
27 self.test.registry.register(self, self.test.logger)
28
29 def remove_vpp_config(self):
30 self.test.vapi.ipsec_spd_add_del(self.id, is_add=0)
31
Neale Ranns311124e2019-01-24 04:52:25 -080032 def object_id(self):
33 return "ipsec-spd-%d" % self.id
34
35 def query_vpp_config(self):
36 spds = self.test.vapi.ipsec_spds_dump()
37 for spd in spds:
38 if spd.spd_id == self.id:
39 return True
40 return False
41
42
43class VppIpsecSpdItfBinding(VppObject):
44 """
45 VPP SPD DB to interface binding
Paul Vinciguerra8feeaff2019-03-27 11:25:48 -070046 (i.e. this SPD is used on this interface)
Neale Ranns311124e2019-01-24 04:52:25 -080047 """
48
49 def __init__(self, test, spd, itf):
50 self.test = test
51 self.spd = spd
52 self.itf = itf
53
54 def add_vpp_config(self):
55 self.test.vapi.ipsec_interface_add_del_spd(self.spd.id,
56 self.itf.sw_if_index)
57 self.test.registry.register(self, self.test.logger)
58
59 def remove_vpp_config(self):
60 self.test.vapi.ipsec_interface_add_del_spd(self.spd.id,
61 self.itf.sw_if_index,
62 is_add=0)
63
Neale Ranns311124e2019-01-24 04:52:25 -080064 def object_id(self):
65 return "bind-%s-to-%s" % (self.spd.id, self.itf)
66
67 def query_vpp_config(self):
68 bs = self.test.vapi.ipsec_spd_interface_dump()
69 for b in bs:
70 if b.sw_if_index == self.itf.sw_if_index:
71 return True
72 return False
73
74
75class VppIpsecSpdEntry(VppObject):
76 """
77 VPP SPD DB Entry
78 """
79
80 def __init__(self, test, spd, sa_id,
81 local_start, local_stop,
82 remote_start, remote_stop,
83 proto,
84 priority=100,
Neale Ranns17dcec02019-01-09 21:22:20 -080085 policy=None,
Neale Ranns311124e2019-01-24 04:52:25 -080086 is_outbound=1,
87 remote_port_start=0,
88 remote_port_stop=65535,
89 local_port_start=0,
90 local_port_stop=65535):
91 self.test = test
92 self.spd = spd
93 self.sa_id = sa_id
94 self.local_start = ip_address(text_type(local_start))
95 self.local_stop = ip_address(text_type(local_stop))
96 self.remote_start = ip_address(text_type(remote_start))
97 self.remote_stop = ip_address(text_type(remote_stop))
98 self.proto = proto
99 self.is_outbound = is_outbound
100 self.priority = priority
Neale Ranns17dcec02019-01-09 21:22:20 -0800101 if not policy:
102 self.policy = (VppEnum.vl_api_ipsec_spd_action_t.
103 IPSEC_API_SPD_ACTION_BYPASS)
104 else:
105 self.policy = policy
Neale Ranns311124e2019-01-24 04:52:25 -0800106 self.is_ipv6 = (0 if self.local_start.version == 4 else 1)
107 self.local_port_start = local_port_start
108 self.local_port_stop = local_port_stop
109 self.remote_port_start = remote_port_start
110 self.remote_port_stop = remote_port_stop
111
112 def add_vpp_config(self):
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800113 rv = self.test.vapi.ipsec_spd_entry_add_del(
Neale Ranns311124e2019-01-24 04:52:25 -0800114 self.spd.id,
115 self.sa_id,
Neale Ranns17dcec02019-01-09 21:22:20 -0800116 self.local_start,
117 self.local_stop,
118 self.remote_start,
119 self.remote_stop,
Neale Ranns311124e2019-01-24 04:52:25 -0800120 protocol=self.proto,
121 is_ipv6=self.is_ipv6,
122 is_outbound=self.is_outbound,
123 priority=self.priority,
124 policy=self.policy,
125 local_port_start=self.local_port_start,
126 local_port_stop=self.local_port_stop,
127 remote_port_start=self.remote_port_start,
128 remote_port_stop=self.remote_port_stop)
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800129 self.stat_index = rv.stat_index
Neale Ranns311124e2019-01-24 04:52:25 -0800130 self.test.registry.register(self, self.test.logger)
131
132 def remove_vpp_config(self):
Neale Ranns17dcec02019-01-09 21:22:20 -0800133 self.test.vapi.ipsec_spd_entry_add_del(
Neale Ranns311124e2019-01-24 04:52:25 -0800134 self.spd.id,
135 self.sa_id,
Neale Ranns17dcec02019-01-09 21:22:20 -0800136 self.local_start,
137 self.local_stop,
138 self.remote_start,
139 self.remote_stop,
Neale Ranns311124e2019-01-24 04:52:25 -0800140 protocol=self.proto,
141 is_ipv6=self.is_ipv6,
142 is_outbound=self.is_outbound,
143 priority=self.priority,
144 policy=self.policy,
145 local_port_start=self.local_port_start,
146 local_port_stop=self.local_port_stop,
147 remote_port_start=self.remote_port_start,
148 remote_port_stop=self.remote_port_stop,
149 is_add=0)
150
Neale Ranns311124e2019-01-24 04:52:25 -0800151 def object_id(self):
152 return "spd-entry-%d-%d-%d-%d-%d-%d" % (self.spd.id,
153 self.priority,
154 self.policy,
155 self.is_outbound,
156 self.is_ipv6,
157 self.remote_port_start)
158
159 def query_vpp_config(self):
160 ss = self.test.vapi.ipsec_spd_dump(self.spd.id)
161 for s in ss:
Neale Ranns17dcec02019-01-09 21:22:20 -0800162 if s.entry.sa_id == self.sa_id and \
163 s.entry.is_outbound == self.is_outbound and \
164 s.entry.priority == self.priority and \
165 s.entry.policy == self.policy and \
166 s.entry.remote_address_start == self.remote_start and \
167 s.entry.remote_port_start == self.remote_port_start:
Neale Ranns311124e2019-01-24 04:52:25 -0800168 return True
169 return False
170
Neale Ranns4a56f4e2019-12-23 04:10:25 +0000171 def get_stats(self, worker=None):
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800172 c = self.test.statistics.get_counter("/net/ipsec/policy")
Neale Ranns4a56f4e2019-12-23 04:10:25 +0000173 if worker is None:
174 total = mk_counter()
175 for t in c:
176 total['packets'] += t[self.stat_index]['packets']
177 return total
178 else:
179 # +1 to skip main thread
180 return c[worker+1][self.stat_index]
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800181
Neale Ranns311124e2019-01-24 04:52:25 -0800182
183class VppIpsecSA(VppObject):
184 """
185 VPP SAD Entry
186 """
187
Neale Rannsabc56602020-04-01 09:45:23 +0000188 DEFAULT_UDP_PORT = 4500
189
Neale Ranns311124e2019-01-24 04:52:25 -0800190 def __init__(self, test, id, spi,
191 integ_alg, integ_key,
192 crypto_alg, crypto_key,
193 proto,
194 tun_src=None, tun_dst=None,
Neale Ranns041add72020-01-02 04:06:10 +0000195 flags=None, salt=0, tun_flags=None,
196 dscp=None,
Matthew Smith751bb132021-02-08 22:13:59 +0000197 udp_src=None, udp_dst=None):
Neale Ranns17dcec02019-01-09 21:22:20 -0800198 e = VppEnum.vl_api_ipsec_sad_flags_t
Neale Ranns311124e2019-01-24 04:52:25 -0800199 self.test = test
200 self.id = id
201 self.spi = spi
202 self.integ_alg = integ_alg
203 self.integ_key = integ_key
204 self.crypto_alg = crypto_alg
205 self.crypto_key = crypto_key
206 self.proto = proto
Neale Ranns80f6fd52019-04-16 02:41:34 +0000207 self.salt = salt
Neale Ranns17dcec02019-01-09 21:22:20 -0800208
Neale Ranns311124e2019-01-24 04:52:25 -0800209 self.tun_src = tun_src
210 self.tun_dst = tun_dst
Neale Ranns17dcec02019-01-09 21:22:20 -0800211 if not flags:
212 self.flags = e.IPSEC_API_SAD_FLAG_NONE
213 else:
214 self.flags = flags
Neale Ranns311124e2019-01-24 04:52:25 -0800215 if (tun_src):
216 self.tun_src = ip_address(text_type(tun_src))
Neale Ranns17dcec02019-01-09 21:22:20 -0800217 self.flags = self.flags | e.IPSEC_API_SAD_FLAG_IS_TUNNEL
Neale Ranns311124e2019-01-24 04:52:25 -0800218 if (self.tun_src.version == 6):
Neale Ranns17dcec02019-01-09 21:22:20 -0800219 self.flags = self.flags | e.IPSEC_API_SAD_FLAG_IS_TUNNEL_V6
Neale Ranns311124e2019-01-24 04:52:25 -0800220 if (tun_dst):
221 self.tun_dst = ip_address(text_type(tun_dst))
Neale Rannsabc56602020-04-01 09:45:23 +0000222 self.udp_src = udp_src
223 self.udp_dst = udp_dst
Neale Ranns041add72020-01-02 04:06:10 +0000224 self.tun_flags = (VppEnum.vl_api_tunnel_encap_decap_flags_t.
225 TUNNEL_API_ENCAP_DECAP_FLAG_NONE)
226 if tun_flags:
227 self.tun_flags = tun_flags
228 self.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_CS0
229 if dscp:
230 self.dscp = dscp
Neale Ranns311124e2019-01-24 04:52:25 -0800231
232 def add_vpp_config(self):
Neale Rannsabc56602020-04-01 09:45:23 +0000233 entry = {
234 'sad_id': self.id,
235 'spi': self.spi,
236 'integrity_algorithm': self.integ_alg,
237 'integrity_key': {
238 'length': len(self.integ_key),
239 'data': self.integ_key,
240 },
241 'crypto_algorithm': self.crypto_alg,
242 'crypto_key': {
243 'data': self.crypto_key,
244 'length': len(self.crypto_key),
245 },
246 'protocol': self.proto,
Matthew Smith751bb132021-02-08 22:13:59 +0000247 'tunnel_src': (self.tun_src if self.tun_src else []),
248 'tunnel_dst': (self.tun_dst if self.tun_dst else []),
249 'tunnel_flags': self.tun_flags,
250 'dscp': self.dscp,
Neale Rannsabc56602020-04-01 09:45:23 +0000251 'flags': self.flags,
252 'salt': self.salt
253 }
254 # don't explicitly send the defaults, let papi fill them in
255 if self.udp_src:
256 entry['udp_src_port'] = self.udp_src
257 if self.udp_dst:
258 entry['udp_dst_port'] = self.udp_dst
Matthew Smith751bb132021-02-08 22:13:59 +0000259 r = self.test.vapi.ipsec_sad_entry_add_del_v2(is_add=1, entry=entry)
Neale Rannseba31ec2019-02-17 18:04:27 +0000260 self.stat_index = r.stat_index
Neale Ranns311124e2019-01-24 04:52:25 -0800261 self.test.registry.register(self, self.test.logger)
Neale Rannsa9e27742020-12-23 16:22:28 +0000262 return self
Neale Ranns311124e2019-01-24 04:52:25 -0800263
264 def remove_vpp_config(self):
Matthew Smith751bb132021-02-08 22:13:59 +0000265 r = self.test.vapi.ipsec_sad_entry_add_del_v2(
Neale Rannsabc56602020-04-01 09:45:23 +0000266 is_add=0,
267 entry={
268 'sad_id': self.id,
269 'spi': self.spi,
270 'integrity_algorithm': self.integ_alg,
271 'integrity_key': {
272 'length': len(self.integ_key),
273 'data': self.integ_key,
274 },
275 'crypto_algorithm': self.crypto_alg,
276 'crypto_key': {
277 'data': self.crypto_key,
278 'length': len(self.crypto_key),
279 },
280 'protocol': self.proto,
Matthew Smith751bb132021-02-08 22:13:59 +0000281 'tunnel_src': (self.tun_src if self.tun_src else []),
282 'tunnel_dst': (self.tun_dst if self.tun_dst else []),
283 'flags': self.flags,
Neale Rannsabc56602020-04-01 09:45:23 +0000284 'salt': self.salt
285 })
Neale Ranns311124e2019-01-24 04:52:25 -0800286
Neale Ranns311124e2019-01-24 04:52:25 -0800287 def object_id(self):
288 return "ipsec-sa-%d" % self.id
289
290 def query_vpp_config(self):
Neale Rannsabc56602020-04-01 09:45:23 +0000291 e = VppEnum.vl_api_ipsec_sad_flags_t
292
Matthew Smith751bb132021-02-08 22:13:59 +0000293 bs = self.test.vapi.ipsec_sa_v2_dump()
Neale Ranns311124e2019-01-24 04:52:25 -0800294 for b in bs:
Neale Ranns8d7c5022019-02-06 01:41:05 -0800295 if b.entry.sad_id == self.id:
Neale Rannsabc56602020-04-01 09:45:23 +0000296 # if udp encap is configured then the ports should match
297 # those configured or the default
298 if (self.flags & e.IPSEC_API_SAD_FLAG_UDP_ENCAP):
299 if not b.entry.flags & e.IPSEC_API_SAD_FLAG_UDP_ENCAP:
300 return False
301 if self.udp_src:
302 if self.udp_src != b.entry.udp_src_port:
303 return False
304 else:
305 if self.DEFAULT_UDP_PORT != b.entry.udp_src_port:
306 return False
307 if self.udp_dst:
308 if self.udp_dst != b.entry.udp_dst_port:
309 return False
310 else:
311 if self.DEFAULT_UDP_PORT != b.entry.udp_dst_port:
312 return False
Neale Ranns311124e2019-01-24 04:52:25 -0800313 return True
314 return False
Neale Rannseba31ec2019-02-17 18:04:27 +0000315
Neale Ranns4a56f4e2019-12-23 04:10:25 +0000316 def get_stats(self, worker=None):
Neale Rannseba31ec2019-02-17 18:04:27 +0000317 c = self.test.statistics.get_counter("/net/ipsec/sa")
Neale Ranns4a56f4e2019-12-23 04:10:25 +0000318 if worker is None:
319 total = mk_counter()
320 for t in c:
321 total['packets'] += t[self.stat_index]['packets']
322 return total
323 else:
324 # +1 to skip main thread
325 return c[worker+1][self.stat_index]
Neale Rannsc87b66c2019-02-07 07:26:12 -0800326
327
328class VppIpsecTunProtect(VppObject):
329 """
330 VPP IPSEC tunnel protection
331 """
332
Neale Ranns28287212019-12-16 00:53:11 +0000333 def __init__(self, test, itf, sa_out, sas_in, nh=None):
Neale Rannsc87b66c2019-02-07 07:26:12 -0800334 self.test = test
335 self.itf = itf
336 self.sas_in = []
337 for sa in sas_in:
338 self.sas_in.append(sa.id)
339 self.sa_out = sa_out.id
Neale Ranns28287212019-12-16 00:53:11 +0000340 self.nh = nh
341 if not self.nh:
342 self.nh = "0.0.0.0"
Neale Rannsc87b66c2019-02-07 07:26:12 -0800343
344 def update_vpp_config(self, sa_out, sas_in):
345 self.sas_in = []
346 for sa in sas_in:
347 self.sas_in.append(sa.id)
348 self.sa_out = sa_out.id
349 self.test.vapi.ipsec_tunnel_protect_update(
350 tunnel={
351 'sw_if_index': self.itf._sw_if_index,
352 'n_sa_in': len(self.sas_in),
353 'sa_out': self.sa_out,
Neale Ranns28287212019-12-16 00:53:11 +0000354 'sa_in': self.sas_in,
355 'nh': self.nh})
Neale Rannsc87b66c2019-02-07 07:26:12 -0800356
357 def object_id(self):
Neale Ranns28287212019-12-16 00:53:11 +0000358 return "ipsec-tun-protect-%s-%s" % (self.itf, self.nh)
Neale Rannsc87b66c2019-02-07 07:26:12 -0800359
360 def add_vpp_config(self):
361 self.test.vapi.ipsec_tunnel_protect_update(
362 tunnel={
363 'sw_if_index': self.itf._sw_if_index,
364 'n_sa_in': len(self.sas_in),
365 'sa_out': self.sa_out,
Neale Ranns28287212019-12-16 00:53:11 +0000366 'sa_in': self.sas_in,
367 'nh': self.nh})
Neale Rannsc87b66c2019-02-07 07:26:12 -0800368 self.test.registry.register(self, self.test.logger)
369
370 def remove_vpp_config(self):
371 self.test.vapi.ipsec_tunnel_protect_del(
Neale Ranns28287212019-12-16 00:53:11 +0000372 sw_if_index=self.itf.sw_if_index,
373 nh=self.nh)
Neale Rannsc87b66c2019-02-07 07:26:12 -0800374
375 def query_vpp_config(self):
376 bs = self.test.vapi.ipsec_tunnel_protect_dump(
377 sw_if_index=self.itf.sw_if_index)
378 for b in bs:
Neale Ranns28287212019-12-16 00:53:11 +0000379 if b.tun.sw_if_index == self.itf.sw_if_index and \
380 self.nh == str(b.tun.nh):
Neale Rannsc87b66c2019-02-07 07:26:12 -0800381 return True
382 return False
Neale Rannsdd4ccf22020-06-30 07:47:14 +0000383
384
385class VppIpsecInterface(VppInterface):
386 """
387 VPP IPSec interface
388 """
389
Eric Kinzie609d5792020-10-13 20:02:11 -0400390 def __init__(self, test, mode=None, instance=0xffffffff):
Neale Rannsdd4ccf22020-06-30 07:47:14 +0000391 super(VppIpsecInterface, self).__init__(test)
392
Neale Ranns6ba4e412020-10-19 09:59:41 +0000393 self.mode = mode
394 if not self.mode:
395 self.mode = (VppEnum.vl_api_tunnel_mode_t.
396 TUNNEL_API_MODE_P2P)
Eric Kinzie609d5792020-10-13 20:02:11 -0400397 self.instance = instance
Neale Rannsdd4ccf22020-06-30 07:47:14 +0000398
399 def add_vpp_config(self):
400 r = self.test.vapi.ipsec_itf_create(itf={
Eric Kinzie609d5792020-10-13 20:02:11 -0400401 'user_instance': self.instance,
Neale Rannsdd4ccf22020-06-30 07:47:14 +0000402 'mode': self.mode,
403 })
404 self.set_sw_if_index(r.sw_if_index)
405 self.test.registry.register(self, self.test.logger)
406 return self
407
408 def remove_vpp_config(self):
409 self.test.vapi.ipsec_itf_delete(sw_if_index=self._sw_if_index)
410
411 def query_vpp_config(self):
412 ts = self.test.vapi.ipsec_itf_dump(sw_if_index=0xffffffff)
413 for t in ts:
414 if t.tunnel.sw_if_index == self._sw_if_index:
415 return True
416 return False
417
418 def __str__(self):
419 return self.object_id()
420
421 def object_id(self):
422 return "ipsec-%d" % self._sw_if_index