blob: 1b1c9aaa25d1c9da1ed3b48f1cc02c43e81012fd [file] [log] [blame]
Klement Sekera31da2e32018-06-24 22:49:55 +02001import unittest
Klement Sekera611864f2018-09-26 11:19:00 +02002import socket
Neale Ranns80f6fd52019-04-16 02:41:34 +00003import struct
Klement Sekera31da2e32018-06-24 22:49:55 +02004
Neale Ranns53f526b2019-02-25 14:32:02 +00005from scapy.layers.inet import IP, ICMP, TCP, UDP
Damjan Mariona829b132019-04-24 23:39:16 +02006from scapy.layers.ipsec import SecurityAssociation, ESP
snaramre5d4b8912019-12-13 23:39:35 +00007from scapy.layers.l2 import Ether
Paul Vinciguerra582eac52020-04-03 12:18:40 -04008from scapy.packet import raw, Raw
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02009from scapy.layers.inet6 import (
10 IPv6,
11 ICMPv6EchoRequest,
12 IPv6ExtHdrHopByHop,
13 IPv6ExtHdrFragment,
14 IPv6ExtHdrDestOpt,
15)
Neale Ranns02950402019-12-20 00:54:57 +000016
Klement Sekera31da2e32018-06-24 22:49:55 +020017
18from framework import VppTestCase, VppTestRunner
Neale Ranns14046982019-07-29 14:49:52 +000019from util import ppp, reassemble4, fragment_rfc791, fragment_rfc8200
Neale Ranns17dcec02019-01-09 21:22:20 -080020from vpp_papi import VppEnum
Klement Sekera31da2e32018-06-24 22:49:55 +020021
Klement Sekerad9b0c6f2022-04-26 19:02:15 +020022from vpp_ipsec import VppIpsecSpd, VppIpsecSpdEntry, VppIpsecSpdItfBinding
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +000023from ipaddress import ip_address
24from re import search
25from os import popen
26
Klement Sekera31da2e32018-06-24 22:49:55 +020027
Paul Vinciguerrae061dad2020-12-04 14:57:51 -050028class IPsecIPv4Params:
Neale Ranns17dcec02019-01-09 21:22:20 -080029
Klement Sekera611864f2018-09-26 11:19:00 +020030 addr_type = socket.AF_INET
31 addr_any = "0.0.0.0"
32 addr_bcast = "255.255.255.255"
33 addr_len = 32
34 is_ipv6 = 0
Klement Sekera611864f2018-09-26 11:19:00 +020035
Neale Ranns17dcec02019-01-09 21:22:20 -080036 def __init__(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +020037 self.remote_tun_if_host = "1.1.1.1"
38 self.remote_tun_if_host6 = "1111::1"
Klement Sekera611864f2018-09-26 11:19:00 +020039
Neale Ranns28287212019-12-16 00:53:11 +000040 self.scapy_tun_sa_id = 100
Neale Rannsa9e27742020-12-23 16:22:28 +000041 self.scapy_tun_spi = 1000
Neale Ranns28287212019-12-16 00:53:11 +000042 self.vpp_tun_sa_id = 200
Neale Rannsa9e27742020-12-23 16:22:28 +000043 self.vpp_tun_spi = 2000
Klement Sekera611864f2018-09-26 11:19:00 +020044
Neale Ranns28287212019-12-16 00:53:11 +000045 self.scapy_tra_sa_id = 300
Neale Rannsa9e27742020-12-23 16:22:28 +000046 self.scapy_tra_spi = 3000
Neale Ranns28287212019-12-16 00:53:11 +000047 self.vpp_tra_sa_id = 400
Neale Rannsa9e27742020-12-23 16:22:28 +000048 self.vpp_tra_spi = 4000
Klement Sekera611864f2018-09-26 11:19:00 +020049
Neale Ranns9ec846c2021-02-09 14:04:02 +000050 self.outer_hop_limit = 64
51 self.inner_hop_limit = 255
52 self.outer_flow_label = 0
53 self.inner_flow_label = 0x12345
54
Klement Sekerad9b0c6f2022-04-26 19:02:15 +020055 self.auth_algo_vpp_id = (
56 VppEnum.vl_api_ipsec_integ_alg_t.IPSEC_API_INTEG_ALG_SHA1_96
57 )
58 self.auth_algo = "HMAC-SHA1-96" # scapy name
59 self.auth_key = b"C91KUR9GYMm5GfkEvNjX"
Neale Ranns17dcec02019-01-09 21:22:20 -080060
Klement Sekerad9b0c6f2022-04-26 19:02:15 +020061 self.crypt_algo_vpp_id = (
62 VppEnum.vl_api_ipsec_crypto_alg_t.IPSEC_API_CRYPTO_ALG_AES_CBC_128
63 )
64 self.crypt_algo = "AES-CBC" # scapy name
65 self.crypt_key = b"JPjyOWBeVEQiMe7h"
Neale Ranns80f6fd52019-04-16 02:41:34 +000066 self.salt = 0
Neale Ranns53f526b2019-02-25 14:32:02 +000067 self.flags = 0
68 self.nat_header = None
Klement Sekerad9b0c6f2022-04-26 19:02:15 +020069 self.tun_flags = (
70 VppEnum.vl_api_tunnel_encap_decap_flags_t.TUNNEL_API_ENCAP_DECAP_FLAG_NONE
71 )
Neale Ranns041add72020-01-02 04:06:10 +000072 self.dscp = 0
Neale Ranns8c609af2021-02-25 10:05:32 +000073 self.async_mode = False
Klement Sekera611864f2018-09-26 11:19:00 +020074
75
Paul Vinciguerrae061dad2020-12-04 14:57:51 -050076class IPsecIPv6Params:
Neale Ranns17dcec02019-01-09 21:22:20 -080077
Klement Sekera611864f2018-09-26 11:19:00 +020078 addr_type = socket.AF_INET6
79 addr_any = "0::0"
80 addr_bcast = "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"
81 addr_len = 128
82 is_ipv6 = 1
Klement Sekera611864f2018-09-26 11:19:00 +020083
Neale Ranns17dcec02019-01-09 21:22:20 -080084 def __init__(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +020085 self.remote_tun_if_host = "1111:1111:1111:1111:1111:1111:1111:1111"
86 self.remote_tun_if_host4 = "1.1.1.1"
Klement Sekera611864f2018-09-26 11:19:00 +020087
Neale Ranns28287212019-12-16 00:53:11 +000088 self.scapy_tun_sa_id = 500
Neale Ranns17dcec02019-01-09 21:22:20 -080089 self.scapy_tun_spi = 3001
Neale Ranns28287212019-12-16 00:53:11 +000090 self.vpp_tun_sa_id = 600
Neale Ranns17dcec02019-01-09 21:22:20 -080091 self.vpp_tun_spi = 3000
Klement Sekera611864f2018-09-26 11:19:00 +020092
Neale Ranns28287212019-12-16 00:53:11 +000093 self.scapy_tra_sa_id = 700
Neale Ranns17dcec02019-01-09 21:22:20 -080094 self.scapy_tra_spi = 4001
Neale Ranns28287212019-12-16 00:53:11 +000095 self.vpp_tra_sa_id = 800
Neale Ranns17dcec02019-01-09 21:22:20 -080096 self.vpp_tra_spi = 4000
Klement Sekera611864f2018-09-26 11:19:00 +020097
Neale Ranns9ec846c2021-02-09 14:04:02 +000098 self.outer_hop_limit = 64
99 self.inner_hop_limit = 255
100 self.outer_flow_label = 0
101 self.inner_flow_label = 0x12345
102
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200103 self.auth_algo_vpp_id = (
104 VppEnum.vl_api_ipsec_integ_alg_t.IPSEC_API_INTEG_ALG_SHA1_96
105 )
106 self.auth_algo = "HMAC-SHA1-96" # scapy name
107 self.auth_key = b"C91KUR9GYMm5GfkEvNjX"
Neale Ranns17dcec02019-01-09 21:22:20 -0800108
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200109 self.crypt_algo_vpp_id = (
110 VppEnum.vl_api_ipsec_crypto_alg_t.IPSEC_API_CRYPTO_ALG_AES_CBC_128
111 )
112 self.crypt_algo = "AES-CBC" # scapy name
113 self.crypt_key = b"JPjyOWBeVEQiMe7h"
Neale Ranns80f6fd52019-04-16 02:41:34 +0000114 self.salt = 0
Neale Ranns53f526b2019-02-25 14:32:02 +0000115 self.flags = 0
116 self.nat_header = None
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200117 self.tun_flags = (
118 VppEnum.vl_api_tunnel_encap_decap_flags_t.TUNNEL_API_ENCAP_DECAP_FLAG_NONE
119 )
Neale Ranns041add72020-01-02 04:06:10 +0000120 self.dscp = 0
Neale Ranns8c609af2021-02-25 10:05:32 +0000121 self.async_mode = False
Klement Sekera611864f2018-09-26 11:19:00 +0200122
123
Neale Ranns12989b52019-09-26 16:20:19 +0000124def mk_scapy_crypt_key(p):
Benoît Ganne490b9272021-01-22 18:03:09 +0100125 if p.crypt_algo in ("AES-GCM", "AES-CTR"):
Neale Ranns6afaae12019-07-17 15:07:14 +0000126 return p.crypt_key + struct.pack("!I", p.salt)
127 else:
128 return p.crypt_key
129
130
Neale Ranns2ac885c2019-03-20 18:24:43 +0000131def config_tun_params(p, encryption_type, tun_if):
132 ip_class_by_addr_type = {socket.AF_INET: IP, socket.AF_INET6: IPv6}
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200133 esn_en = bool(
134 p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN)
135 )
Neale Rannsf3a66222020-01-02 05:04:00 +0000136 p.tun_dst = tun_if.remote_addr[p.addr_type]
137 p.tun_src = tun_if.local_addr[p.addr_type]
Neale Ranns12989b52019-09-26 16:20:19 +0000138 crypt_key = mk_scapy_crypt_key(p)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000139 p.scapy_tun_sa = SecurityAssociation(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200140 encryption_type,
141 spi=p.vpp_tun_spi,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000142 crypt_algo=p.crypt_algo,
143 crypt_key=crypt_key,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200144 auth_algo=p.auth_algo,
145 auth_key=p.auth_key,
146 tunnel_header=ip_class_by_addr_type[p.addr_type](src=p.tun_dst, dst=p.tun_src),
Neale Ranns3833ffd2019-03-21 14:34:09 +0000147 nat_t_header=p.nat_header,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200148 esn_en=esn_en,
149 )
Neale Ranns2ac885c2019-03-20 18:24:43 +0000150 p.vpp_tun_sa = SecurityAssociation(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200151 encryption_type,
152 spi=p.scapy_tun_spi,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000153 crypt_algo=p.crypt_algo,
154 crypt_key=crypt_key,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200155 auth_algo=p.auth_algo,
156 auth_key=p.auth_key,
157 tunnel_header=ip_class_by_addr_type[p.addr_type](dst=p.tun_dst, src=p.tun_src),
Neale Ranns3833ffd2019-03-21 14:34:09 +0000158 nat_t_header=p.nat_header,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200159 esn_en=esn_en,
160 )
Neale Ranns2ac885c2019-03-20 18:24:43 +0000161
162
163def config_tra_params(p, encryption_type):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200164 esn_en = bool(
165 p.flags & (VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN)
166 )
Neale Ranns12989b52019-09-26 16:20:19 +0000167 crypt_key = mk_scapy_crypt_key(p)
Neale Ranns2ac885c2019-03-20 18:24:43 +0000168 p.scapy_tra_sa = SecurityAssociation(
169 encryption_type,
170 spi=p.vpp_tra_spi,
171 crypt_algo=p.crypt_algo,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000172 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000173 auth_algo=p.auth_algo,
174 auth_key=p.auth_key,
Neale Ranns3833ffd2019-03-21 14:34:09 +0000175 nat_t_header=p.nat_header,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200176 esn_en=esn_en,
177 )
Neale Ranns2ac885c2019-03-20 18:24:43 +0000178 p.vpp_tra_sa = SecurityAssociation(
179 encryption_type,
180 spi=p.scapy_tra_spi,
181 crypt_algo=p.crypt_algo,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000182 crypt_key=crypt_key,
Neale Ranns2ac885c2019-03-20 18:24:43 +0000183 auth_algo=p.auth_algo,
184 auth_key=p.auth_key,
Neale Ranns3833ffd2019-03-21 14:34:09 +0000185 nat_t_header=p.nat_header,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200186 esn_en=esn_en,
187 )
Neale Ranns2ac885c2019-03-20 18:24:43 +0000188
189
Klement Sekera31da2e32018-06-24 22:49:55 +0200190class TemplateIpsec(VppTestCase):
191 """
Dave Wallaced1706812021-08-12 18:36:02 -0400192 TRANSPORT MODE::
Klement Sekera31da2e32018-06-24 22:49:55 +0200193
Dave Wallaced1706812021-08-12 18:36:02 -0400194 ------ encrypt ---
195 |tra_if| <-------> |VPP|
196 ------ decrypt ---
Klement Sekera31da2e32018-06-24 22:49:55 +0200197
Dave Wallaced1706812021-08-12 18:36:02 -0400198 TUNNEL MODE::
Klement Sekera31da2e32018-06-24 22:49:55 +0200199
Dave Wallaced1706812021-08-12 18:36:02 -0400200 ------ encrypt --- plain ---
201 |tun_if| <------- |VPP| <------ |pg1|
202 ------ --- ---
Klement Sekera31da2e32018-06-24 22:49:55 +0200203
Dave Wallaced1706812021-08-12 18:36:02 -0400204 ------ decrypt --- plain ---
205 |tun_if| -------> |VPP| ------> |pg1|
206 ------ --- ---
Klement Sekera31da2e32018-06-24 22:49:55 +0200207 """
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200208
Neale Ranns4f33c802019-04-10 12:39:10 +0000209 tun_spd_id = 1
210 tra_spd_id = 2
Klement Sekera31da2e32018-06-24 22:49:55 +0200211
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800212 def ipsec_select_backend(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200213 """empty method to be overloaded when necessary"""
Klement Sekerab4d30532018-11-08 13:00:02 +0100214 pass
215
Paul Vinciguerra7f9b7f92019-03-12 19:23:27 -0700216 @classmethod
217 def setUpClass(cls):
218 super(TemplateIpsec, cls).setUpClass()
219
220 @classmethod
221 def tearDownClass(cls):
222 super(TemplateIpsec, cls).tearDownClass()
223
Neale Ranns3833ffd2019-03-21 14:34:09 +0000224 def setup_params(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200225 if not hasattr(self, "ipv4_params"):
Neale Ranns041add72020-01-02 04:06:10 +0000226 self.ipv4_params = IPsecIPv4Params()
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200227 if not hasattr(self, "ipv6_params"):
Neale Ranns041add72020-01-02 04:06:10 +0000228 self.ipv6_params = IPsecIPv6Params()
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200229 self.params = {
230 self.ipv4_params.addr_type: self.ipv4_params,
231 self.ipv6_params.addr_type: self.ipv6_params,
232 }
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800233
Neale Ranns4f33c802019-04-10 12:39:10 +0000234 def config_interfaces(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800235 self.create_pg_interfaces(range(3))
236 self.interfaces = list(self.pg_interfaces)
237 for i in self.interfaces:
Klement Sekera31da2e32018-06-24 22:49:55 +0200238 i.admin_up()
239 i.config_ip4()
240 i.resolve_arp()
Klement Sekera611864f2018-09-26 11:19:00 +0200241 i.config_ip6()
242 i.resolve_ndp()
Neale Ranns4f33c802019-04-10 12:39:10 +0000243
244 def setUp(self):
245 super(TemplateIpsec, self).setUp()
246
247 self.setup_params()
248
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200249 self.vpp_esp_protocol = VppEnum.vl_api_ipsec_proto_t.IPSEC_API_PROTO_ESP
250 self.vpp_ah_protocol = VppEnum.vl_api_ipsec_proto_t.IPSEC_API_PROTO_AH
Neale Ranns4f33c802019-04-10 12:39:10 +0000251
252 self.config_interfaces()
Paul Vinciguerra90cf21b2019-03-13 09:23:05 -0700253
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800254 self.ipsec_select_backend()
Klement Sekera31da2e32018-06-24 22:49:55 +0200255
Neale Ranns4f33c802019-04-10 12:39:10 +0000256 def unconfig_interfaces(self):
Neale Ranns8e4a89b2019-01-23 08:16:17 -0800257 for i in self.interfaces:
258 i.admin_down()
259 i.unconfig_ip4()
260 i.unconfig_ip6()
261
Neale Ranns4f33c802019-04-10 12:39:10 +0000262 def tearDown(self):
263 super(TemplateIpsec, self).tearDown()
264
265 self.unconfig_interfaces()
266
Paul Vinciguerra90cf21b2019-03-13 09:23:05 -0700267 def show_commands_at_teardown(self):
268 self.logger.info(self.vapi.cli("show hardware"))
Klement Sekera31da2e32018-06-24 22:49:55 +0200269
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200270 def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1, payload_size=54):
271 return [
272 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
273 / sa.encrypt(IP(src=src, dst=dst) / ICMP() / Raw(b"X" * payload_size))
274 for i in range(count)
275 ]
Klement Sekera31da2e32018-06-24 22:49:55 +0200276
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200277 def gen_encrypt_pkts6(self, p, sa, sw_intf, src, dst, count=1, payload_size=54):
278 return [
279 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
280 / sa.encrypt(
281 IPv6(src=src, dst=dst, hlim=p.inner_hop_limit, fl=p.inner_flow_label)
282 / ICMPv6EchoRequest(id=0, seq=1, data="X" * payload_size)
283 )
284 for i in range(count)
285 ]
Klement Sekera611864f2018-09-26 11:19:00 +0200286
Neale Rannsd7603d92019-03-28 08:56:10 +0000287 def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200288 return [
289 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
290 / IP(src=src, dst=dst)
291 / ICMP()
292 / Raw(b"X" * payload_size)
293 for i in range(count)
294 ]
Klement Sekera31da2e32018-06-24 22:49:55 +0200295
Neale Ranns9ec846c2021-02-09 14:04:02 +0000296 def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200297 return [
298 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
299 / IPv6(src=src, dst=dst, hlim=p.inner_hop_limit, fl=p.inner_flow_label)
300 / ICMPv6EchoRequest(id=0, seq=1, data="X" * payload_size)
301 for i in range(count)
302 ]
Klement Sekera611864f2018-09-26 11:19:00 +0200303
Klement Sekera31da2e32018-06-24 22:49:55 +0200304
Neale Ranns4f33c802019-04-10 12:39:10 +0000305class IpsecTcp(object):
306 def verify_tcp_checksum(self):
Florin Corasa1175b72022-01-26 00:15:03 -0800307 # start http cli server listener on http://0.0.0.0:80
308 self.vapi.cli("http cli server")
Klement Sekera611864f2018-09-26 11:19:00 +0200309 p = self.params[socket.AF_INET]
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200310 send = Ether(
311 src=self.tun_if.remote_mac, dst=self.tun_if.local_mac
312 ) / p.scapy_tun_sa.encrypt(
313 IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
314 / TCP(flags="S", dport=80)
315 )
Klement Sekera31da2e32018-06-24 22:49:55 +0200316 self.logger.debug(ppp("Sending packet:", send))
Klement Sekera611864f2018-09-26 11:19:00 +0200317 recv = self.send_and_expect(self.tun_if, [send], self.tun_if)
Klement Sekera31da2e32018-06-24 22:49:55 +0200318 recv = recv[0]
Neale Ranns2ac885c2019-03-20 18:24:43 +0000319 decrypted = p.vpp_tun_sa.decrypt(recv[IP])
Klement Sekera31da2e32018-06-24 22:49:55 +0200320 self.assert_packet_checksums_valid(decrypted)
321
322
Neale Ranns4f33c802019-04-10 12:39:10 +0000323class IpsecTcpTests(IpsecTcp):
324 def test_tcp_checksum(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200325 """verify checksum correctness for vpp generated packets"""
Neale Ranns4f33c802019-04-10 12:39:10 +0000326 self.verify_tcp_checksum()
327
328
329class IpsecTra4(object):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200330 """verify methods for Transport v4"""
331
Neale Ranns8c609af2021-02-25 10:05:32 +0000332 def get_replay_counts(self, p):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200333 replay_node_name = "/err/%s/SA replayed packet" % self.tra4_decrypt_node_name[0]
Neale Ranns8c609af2021-02-25 10:05:32 +0000334 count = self.statistics.get_err_counter(replay_node_name)
335
336 if p.async_mode:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200337 replay_post_node_name = (
338 "/err/%s/SA replayed packet" % self.tra4_decrypt_node_name[p.async_mode]
339 )
Neale Ranns8c609af2021-02-25 10:05:32 +0000340 count += self.statistics.get_err_counter(replay_post_node_name)
341
342 return count
343
344 def get_hash_failed_counts(self, p):
345 if ESP == self.encryption_type and p.crypt_algo == "AES-GCM":
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200346 hash_failed_node_name = (
347 "/err/%s/ESP decryption failed"
348 % self.tra4_decrypt_node_name[p.async_mode]
349 )
Neale Ranns8c609af2021-02-25 10:05:32 +0000350 else:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200351 hash_failed_node_name = (
352 "/err/%s/Integrity check failed"
353 % self.tra4_decrypt_node_name[p.async_mode]
354 )
Neale Ranns8c609af2021-02-25 10:05:32 +0000355 count = self.statistics.get_err_counter(hash_failed_node_name)
356
357 if p.async_mode:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200358 count += self.statistics.get_err_counter("/err/crypto-dispatch/bad-hmac")
Neale Ranns8c609af2021-02-25 10:05:32 +0000359
360 return count
361
Neale Ranns5b891102021-06-28 13:31:28 +0000362 def verify_hi_seq_num(self):
363 p = self.params[socket.AF_INET]
364 saf = VppEnum.vl_api_ipsec_sad_flags_t
365 esn_on = p.vpp_tra_sa.esn_en
366 ar_on = p.flags & saf.IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY
367
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200368 seq_cycle_node_name = (
369 "/err/%s/sequence number cycled (packet dropped)"
370 % self.tra4_encrypt_node_name
371 )
Neale Ranns5b891102021-06-28 13:31:28 +0000372 replay_count = self.get_replay_counts(p)
373 hash_failed_count = self.get_hash_failed_counts(p)
374 seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name)
375
376 # a few packets so we get the rx seq number above the window size and
377 # thus can simulate a wrap with an out of window packet
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200378 pkts = [
379 (
380 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
381 / p.scapy_tra_sa.encrypt(
382 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
383 seq_num=seq,
384 )
385 )
386 for seq in range(63, 80)
387 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000388 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
389
390 # these 4 packets will all choose seq-num 0 to decrpyt since none
391 # are out of window when first checked. however, once #200 has
392 # decrypted it will move the window to 200 and has #81 is out of
393 # window. this packet should be dropped.
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200394 pkts = [
395 (
396 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
397 / p.scapy_tra_sa.encrypt(
398 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
399 seq_num=200,
400 )
401 ),
402 (
403 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
404 / p.scapy_tra_sa.encrypt(
405 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
406 seq_num=81,
407 )
408 ),
409 (
410 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
411 / p.scapy_tra_sa.encrypt(
412 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
413 seq_num=201,
414 )
415 ),
416 (
417 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
418 / p.scapy_tra_sa.encrypt(
419 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
420 seq_num=202,
421 )
422 ),
423 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000424
425 # if anti-replay is off then we won't drop #81
426 n_rx = 3 if ar_on else 4
427 self.send_and_expect(self.tra_if, pkts, self.tra_if, n_rx=n_rx)
428 # this packet is one before the wrap
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200429 pkts = [
430 (
431 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
432 / p.scapy_tra_sa.encrypt(
433 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
434 seq_num=203,
435 )
436 )
437 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000438 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
439
440 # move the window over half way to a wrap
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200441 pkts = [
442 (
443 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
444 / p.scapy_tra_sa.encrypt(
445 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
446 seq_num=0x80000001,
447 )
448 )
449 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000450 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
451
452 # anti-replay will drop old packets, no anti-replay will not
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200453 pkts = [
454 (
455 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
456 / p.scapy_tra_sa.encrypt(
457 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
458 seq_num=0x44000001,
459 )
460 )
461 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000462
463 if ar_on:
464 self.send_and_assert_no_replies(self.tra_if, pkts)
465 else:
466 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
467
468 if esn_on:
469 #
470 # validate wrapping the ESN
471 #
472
473 # wrap scapy's TX SA SN
474 p.scapy_tra_sa.seq_num = 0x100000005
475
476 # send a packet that wraps the window for both AR and no AR
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200477 pkts = [
478 (
479 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
480 / p.scapy_tra_sa.encrypt(
481 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
482 / ICMP(),
483 seq_num=0x100000005,
484 )
485 )
486 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000487
488 rxs = self.send_and_expect(self.tra_if, pkts, self.tra_if)
489 for rx in rxs:
490 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
491
492 # move the window forward to half way to the next wrap
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200493 pkts = [
494 (
495 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
496 / p.scapy_tra_sa.encrypt(
497 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
498 / ICMP(),
499 seq_num=0x180000005,
500 )
501 )
502 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000503
504 rxs = self.send_and_expect(self.tra_if, pkts, self.tra_if)
505
506 # a packet less than 2^30 from the current position is:
507 # - AR: out of window and dropped
508 # - non-AR: accepted
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200509 pkts = [
510 (
511 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
512 / p.scapy_tra_sa.encrypt(
513 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
514 / ICMP(),
515 seq_num=0x170000005,
516 )
517 )
518 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000519
520 if ar_on:
521 self.send_and_assert_no_replies(self.tra_if, pkts)
522 else:
523 self.send_and_expect(self.tra_if, pkts, self.tra_if)
524
525 # a packet more than 2^30 from the current position is:
526 # - AR: out of window and dropped
527 # - non-AR: considered a wrap, but since it's not a wrap
528 # it won't decrpyt and so will be dropped
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200529 pkts = [
530 (
531 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
532 / p.scapy_tra_sa.encrypt(
533 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
534 / ICMP(),
535 seq_num=0x130000005,
536 )
537 )
538 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000539
540 self.send_and_assert_no_replies(self.tra_if, pkts)
541
542 # a packet less than 2^30 from the current position and is a
543 # wrap; (the seq is currently at 0x180000005).
544 # - AR: out of window so considered a wrap, so accepted
545 # - non-AR: not considered a wrap, so won't decrypt
546 p.scapy_tra_sa.seq_num = 0x260000005
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200547 pkts = [
548 (
549 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
550 / p.scapy_tra_sa.encrypt(
551 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
552 / ICMP(),
553 seq_num=0x260000005,
554 )
555 )
556 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000557 if ar_on:
558 self.send_and_expect(self.tra_if, pkts, self.tra_if)
559 else:
560 self.send_and_assert_no_replies(self.tra_if, pkts)
561
562 #
563 # window positions are different now for AR/non-AR
564 # move non-AR forward
565 #
566 if not ar_on:
567 # a packet more than 2^30 from the current position and is a
568 # wrap; (the seq is currently at 0x180000005).
569 # - AR: accepted
570 # - non-AR: not considered a wrap, so won't decrypt
571
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200572 pkts = [
573 (
574 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
575 / p.scapy_tra_sa.encrypt(
576 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
577 / ICMP(),
578 seq_num=0x200000005,
579 )
580 ),
581 (
582 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
583 / p.scapy_tra_sa.encrypt(
584 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
585 / ICMP(),
586 seq_num=0x200000006,
587 )
588 ),
589 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000590 self.send_and_expect(self.tra_if, pkts, self.tra_if)
591
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200592 pkts = [
593 (
594 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
595 / p.scapy_tra_sa.encrypt(
596 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4)
597 / ICMP(),
598 seq_num=0x260000005,
599 )
600 )
601 ]
Neale Ranns5b891102021-06-28 13:31:28 +0000602 self.send_and_expect(self.tra_if, pkts, self.tra_if)
603
Neale Ranns6afaae12019-07-17 15:07:14 +0000604 def verify_tra_anti_replay(self):
Neale Rannsde847272018-11-28 01:38:34 -0800605 p = self.params[socket.AF_INET]
snaramre5d4b8912019-12-13 23:39:35 +0000606 esn_en = p.vpp_tra_sa.esn_en
Neale Rannsde847272018-11-28 01:38:34 -0800607
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200608 seq_cycle_node_name = (
609 "/err/%s/sequence number cycled (packet dropped)"
610 % self.tra4_encrypt_node_name
611 )
Neale Ranns8c609af2021-02-25 10:05:32 +0000612 replay_count = self.get_replay_counts(p)
613 hash_failed_count = self.get_hash_failed_counts(p)
Neale Ranns6afaae12019-07-17 15:07:14 +0000614 seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name)
Neale Rannsde847272018-11-28 01:38:34 -0800615
Neale Ranns6afaae12019-07-17 15:07:14 +0000616 if ESP == self.encryption_type:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200617 undersize_node_name = (
618 "/err/%s/undersized packet" % self.tra4_decrypt_node_name[0]
619 )
620 undersize_count = self.statistics.get_err_counter(undersize_node_name)
Neale Ranns6afaae12019-07-17 15:07:14 +0000621
622 #
623 # send packets with seq numbers 1->34
624 # this means the window size is still in Case B (see RFC4303
625 # Appendix A)
626 #
627 # for reasons i haven't investigated Scapy won't create a packet with
628 # seq_num=0
629 #
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200630 pkts = [
631 (
632 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
633 / p.scapy_tra_sa.encrypt(
634 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
635 seq_num=seq,
636 )
637 )
638 for seq in range(1, 34)
639 ]
Neale Ranns6afaae12019-07-17 15:07:14 +0000640 recv_pkts = self.send_and_expect(self.tra_if, pkts, self.tra_if)
641
642 # replayed packets are dropped
Neale Ranns5b891102021-06-28 13:31:28 +0000643 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
Neale Ranns6afaae12019-07-17 15:07:14 +0000644 replay_count += len(pkts)
Neale Ranns8c609af2021-02-25 10:05:32 +0000645 self.assertEqual(self.get_replay_counts(p), replay_count)
Neale Ranns6afaae12019-07-17 15:07:14 +0000646
647 #
Neale Ranns3b9374f2019-08-01 04:45:15 -0700648 # now send a batch of packets all with the same sequence number
649 # the first packet in the batch is legitimate, the rest bogus
650 #
Neale Ranns8c609af2021-02-25 10:05:32 +0000651 self.vapi.cli("clear error")
652 self.vapi.cli("clear node counters")
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200653 pkts = Ether(
654 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
655 ) / p.scapy_tra_sa.encrypt(
656 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
657 seq_num=35,
658 )
659 recv_pkts = self.send_and_expect(self.tra_if, pkts * 8, self.tra_if, n_rx=1)
Neale Ranns3b9374f2019-08-01 04:45:15 -0700660 replay_count += 7
Neale Ranns8c609af2021-02-25 10:05:32 +0000661 self.assertEqual(self.get_replay_counts(p), replay_count)
Neale Ranns3b9374f2019-08-01 04:45:15 -0700662
663 #
Neale Ranns6afaae12019-07-17 15:07:14 +0000664 # now move the window over to 257 (more than one byte) and into Case A
665 #
Neale Ranns8c609af2021-02-25 10:05:32 +0000666 self.vapi.cli("clear error")
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200667 pkt = Ether(
668 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
669 ) / p.scapy_tra_sa.encrypt(
670 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
671 seq_num=257,
672 )
Neale Rannsde847272018-11-28 01:38:34 -0800673 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
674
Neale Ranns3833ffd2019-03-21 14:34:09 +0000675 # replayed packets are dropped
Neale Ranns5b891102021-06-28 13:31:28 +0000676 self.send_and_assert_no_replies(self.tra_if, pkt * 3, timeout=0.2)
Neale Ranns6afaae12019-07-17 15:07:14 +0000677 replay_count += 3
Neale Ranns8c609af2021-02-25 10:05:32 +0000678 self.assertEqual(self.get_replay_counts(p), replay_count)
Neale Ranns3833ffd2019-03-21 14:34:09 +0000679
Neale Rannsde847272018-11-28 01:38:34 -0800680 # the window size is 64 packets
681 # in window are still accepted
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200682 pkt = Ether(
683 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
684 ) / p.scapy_tra_sa.encrypt(
685 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
686 seq_num=200,
687 )
Neale Rannsde847272018-11-28 01:38:34 -0800688 recv_pkts = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
689
Neale Rannsde847272018-11-28 01:38:34 -0800690 # a packet that does not decrypt does not move the window forward
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200691 bogus_sa = SecurityAssociation(
692 self.encryption_type,
693 p.vpp_tra_spi,
694 crypt_algo=p.crypt_algo,
695 crypt_key=mk_scapy_crypt_key(p)[::-1],
696 auth_algo=p.auth_algo,
697 auth_key=p.auth_key[::-1],
698 )
699 pkt = Ether(
700 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
701 ) / bogus_sa.encrypt(
702 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
703 seq_num=350,
704 )
Neale Ranns5b891102021-06-28 13:31:28 +0000705 self.send_and_assert_no_replies(self.tra_if, pkt * 17, timeout=0.2)
Neale Rannsde847272018-11-28 01:38:34 -0800706
Neale Ranns6afaae12019-07-17 15:07:14 +0000707 hash_failed_count += 17
Neale Ranns8c609af2021-02-25 10:05:32 +0000708 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
Neale Rannsde847272018-11-28 01:38:34 -0800709
Damjan Mariona829b132019-04-24 23:39:16 +0200710 # a malformed 'runt' packet
711 # created by a mis-constructed SA
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200712 if ESP == self.encryption_type and p.crypt_algo != "NULL":
713 bogus_sa = SecurityAssociation(self.encryption_type, p.vpp_tra_spi)
714 pkt = Ether(
715 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
716 ) / bogus_sa.encrypt(
717 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
718 seq_num=350,
719 )
Neale Ranns5b891102021-06-28 13:31:28 +0000720 self.send_and_assert_no_replies(self.tra_if, pkt * 17, timeout=0.2)
Damjan Mariona829b132019-04-24 23:39:16 +0200721
Neale Ranns6afaae12019-07-17 15:07:14 +0000722 undersize_count += 17
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200723 self.assert_error_counter_equal(undersize_node_name, undersize_count)
Damjan Mariona829b132019-04-24 23:39:16 +0200724
Neale Rannsde847272018-11-28 01:38:34 -0800725 # which we can determine since this packet is still in the window
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200726 pkt = Ether(
727 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
728 ) / p.scapy_tra_sa.encrypt(
729 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
730 seq_num=234,
731 )
Klement Sekera14d7e902018-12-10 13:46:09 +0100732 self.send_and_expect(self.tra_if, [pkt], self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -0800733
Neale Ranns6afaae12019-07-17 15:07:14 +0000734 #
Neale Ranns3833ffd2019-03-21 14:34:09 +0000735 # out of window are dropped
Neale Ranns6afaae12019-07-17 15:07:14 +0000736 # this is Case B. So VPP will consider this to be a high seq num wrap
737 # and so the decrypt attempt will fail
738 #
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200739 pkt = Ether(
740 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
741 ) / p.scapy_tra_sa.encrypt(
742 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
743 seq_num=17,
744 )
Neale Ranns5b891102021-06-28 13:31:28 +0000745 self.send_and_assert_no_replies(self.tra_if, pkt * 17, timeout=0.2)
Neale Ranns00a44202019-03-21 16:36:28 +0000746
snaramre5d4b8912019-12-13 23:39:35 +0000747 if esn_en:
Neale Ranns3833ffd2019-03-21 14:34:09 +0000748 # an out of window error with ESN looks like a high sequence
749 # wrap. but since it isn't then the verify will fail.
Neale Ranns6afaae12019-07-17 15:07:14 +0000750 hash_failed_count += 17
Neale Ranns8c609af2021-02-25 10:05:32 +0000751 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
Neale Ranns3833ffd2019-03-21 14:34:09 +0000752
753 else:
Neale Ranns6afaae12019-07-17 15:07:14 +0000754 replay_count += 17
Neale Ranns8c609af2021-02-25 10:05:32 +0000755 self.assertEqual(self.get_replay_counts(p), replay_count)
Neale Ranns3833ffd2019-03-21 14:34:09 +0000756
Neale Ranns6afaae12019-07-17 15:07:14 +0000757 # valid packet moves the window over to 258
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200758 pkt = Ether(
759 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
760 ) / p.scapy_tra_sa.encrypt(
761 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
762 seq_num=258,
763 )
Neale Ranns3833ffd2019-03-21 14:34:09 +0000764 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
765 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
766
Neale Ranns6afaae12019-07-17 15:07:14 +0000767 #
768 # move VPP's SA TX seq-num to just before the seq-number wrap.
769 # then fire in a packet that VPP should drop on TX because it
770 # causes the TX seq number to wrap; unless we're using extened sequence
771 # numbers.
772 #
Neale Ranns3833ffd2019-03-21 14:34:09 +0000773 self.vapi.cli("test ipsec sa %d seq 0xffffffff" % p.scapy_tra_sa_id)
Neale Ranns6afaae12019-07-17 15:07:14 +0000774 self.logger.info(self.vapi.ppcli("show ipsec sa 0"))
775 self.logger.info(self.vapi.ppcli("show ipsec sa 1"))
Neale Ranns3833ffd2019-03-21 14:34:09 +0000776
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200777 pkts = [
778 (
779 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
780 / p.scapy_tra_sa.encrypt(
781 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
782 seq_num=seq,
783 )
784 )
785 for seq in range(259, 280)
786 ]
Neale Ranns3833ffd2019-03-21 14:34:09 +0000787
snaramre5d4b8912019-12-13 23:39:35 +0000788 if esn_en:
Neale Ranns6afaae12019-07-17 15:07:14 +0000789 rxs = self.send_and_expect(self.tra_if, pkts, self.tra_if)
Neale Ranns3833ffd2019-03-21 14:34:09 +0000790
Neale Ranns6afaae12019-07-17 15:07:14 +0000791 #
792 # in order for scapy to decrypt its SA's high order number needs
793 # to wrap
794 #
795 p.vpp_tra_sa.seq_num = 0x100000000
796 for rx in rxs:
797 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
798
799 #
800 # wrap scapy's TX high sequence number. VPP is in case B, so it
801 # will consider this a high seq wrap also.
802 # The low seq num we set it to will place VPP's RX window in Case A
803 #
Neale Ranns3833ffd2019-03-21 14:34:09 +0000804 p.scapy_tra_sa.seq_num = 0x100000005
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200805 pkt = Ether(
806 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
807 ) / p.scapy_tra_sa.encrypt(
808 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
809 seq_num=0x100000005,
810 )
Neale Ranns3833ffd2019-03-21 14:34:09 +0000811 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
Neale Ranns5b891102021-06-28 13:31:28 +0000812
Neale Ranns3833ffd2019-03-21 14:34:09 +0000813 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
Neale Ranns6afaae12019-07-17 15:07:14 +0000814
815 #
816 # A packet that has seq num between (2^32-64) and 5 is within
817 # the window
818 #
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200819 p.scapy_tra_sa.seq_num = 0xFFFFFFFD
820 pkt = Ether(
821 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
822 ) / p.scapy_tra_sa.encrypt(
823 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
824 seq_num=0xFFFFFFFD,
825 )
Neale Ranns6afaae12019-07-17 15:07:14 +0000826 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
827 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
828
829 #
830 # While in case A we cannot wrap the high sequence number again
Neale Ranns5b891102021-06-28 13:31:28 +0000831 # because VPP will consider this packet to be one that moves the
Neale Ranns6afaae12019-07-17 15:07:14 +0000832 # window forward
833 #
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200834 pkt = Ether(
835 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
836 ) / p.scapy_tra_sa.encrypt(
837 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
838 seq_num=0x200000999,
839 )
840 self.send_and_assert_no_replies(
841 self.tra_if, [pkt], self.tra_if, timeout=0.2
842 )
Neale Ranns6afaae12019-07-17 15:07:14 +0000843
844 hash_failed_count += 1
Neale Ranns8c609af2021-02-25 10:05:32 +0000845 self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
Neale Ranns6afaae12019-07-17 15:07:14 +0000846
847 #
Neale Ranns5b891102021-06-28 13:31:28 +0000848 # but if we move the window forward to case B, then we can wrap
Neale Ranns6afaae12019-07-17 15:07:14 +0000849 # again
850 #
851 p.scapy_tra_sa.seq_num = 0x100000555
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200852 pkt = Ether(
853 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
854 ) / p.scapy_tra_sa.encrypt(
855 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
856 seq_num=0x100000555,
857 )
Neale Ranns6afaae12019-07-17 15:07:14 +0000858 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
859 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
860
861 p.scapy_tra_sa.seq_num = 0x200000444
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200862 pkt = Ether(
863 src=self.tra_if.remote_mac, dst=self.tra_if.local_mac
864 ) / p.scapy_tra_sa.encrypt(
865 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
866 seq_num=0x200000444,
867 )
Neale Ranns6afaae12019-07-17 15:07:14 +0000868 rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
869 decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
870
Neale Ranns3833ffd2019-03-21 14:34:09 +0000871 else:
Neale Ranns6afaae12019-07-17 15:07:14 +0000872 #
873 # without ESN TX sequence numbers can't wrap and packets are
874 # dropped from here on out.
875 #
Neale Ranns5b891102021-06-28 13:31:28 +0000876 self.send_and_assert_no_replies(self.tra_if, pkts, timeout=0.2)
Neale Ranns6afaae12019-07-17 15:07:14 +0000877 seq_cycle_count += len(pkts)
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200878 self.assert_error_counter_equal(seq_cycle_node_name, seq_cycle_count)
Neale Ranns00a44202019-03-21 16:36:28 +0000879
Neale Rannsde847272018-11-28 01:38:34 -0800880 # move the security-associations seq number on to the last we used
Neale Ranns00a44202019-03-21 16:36:28 +0000881 self.vapi.cli("test ipsec sa %d seq 0x15f" % p.scapy_tra_sa_id)
Neale Rannsde847272018-11-28 01:38:34 -0800882 p.scapy_tra_sa.seq_num = 351
883 p.vpp_tra_sa.seq_num = 351
884
Neale Rannse11203e2021-09-21 12:34:19 +0000885 def verify_tra_lost(self):
886 p = self.params[socket.AF_INET]
887 esn_en = p.vpp_tra_sa.esn_en
888
889 #
890 # send packets with seq numbers 1->34
891 # this means the window size is still in Case B (see RFC4303
892 # Appendix A)
893 #
894 # for reasons i haven't investigated Scapy won't create a packet with
895 # seq_num=0
896 #
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200897 pkts = [
898 (
899 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
900 / p.scapy_tra_sa.encrypt(
901 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
902 seq_num=seq,
903 )
904 )
905 for seq in range(1, 3)
906 ]
Neale Rannse11203e2021-09-21 12:34:19 +0000907 self.send_and_expect(self.tra_if, pkts, self.tra_if)
908
909 self.assertEqual(p.tra_sa_out.get_lost(), 0)
910
911 # skip a sequence number
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200912 pkts = [
913 (
914 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
915 / p.scapy_tra_sa.encrypt(
916 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
917 seq_num=seq,
918 )
919 )
920 for seq in range(4, 6)
921 ]
Neale Rannse11203e2021-09-21 12:34:19 +0000922 self.send_and_expect(self.tra_if, pkts, self.tra_if)
923
924 self.assertEqual(p.tra_sa_out.get_lost(), 0)
925
926 # the lost packet are counted untill we get up past the first
927 # sizeof(replay_window) packets
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200928 pkts = [
929 (
930 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
931 / p.scapy_tra_sa.encrypt(
932 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
933 seq_num=seq,
934 )
935 )
936 for seq in range(6, 100)
937 ]
Neale Rannse11203e2021-09-21 12:34:19 +0000938 self.send_and_expect(self.tra_if, pkts, self.tra_if)
939
940 self.assertEqual(p.tra_sa_out.get_lost(), 1)
941
942 # lost of holes in the sequence
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200943 pkts = [
944 (
945 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
946 / p.scapy_tra_sa.encrypt(
947 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
948 seq_num=seq,
949 )
950 )
951 for seq in range(100, 200, 2)
952 ]
Neale Rannse11203e2021-09-21 12:34:19 +0000953 self.send_and_expect(self.tra_if, pkts, self.tra_if, n_rx=50)
954
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200955 pkts = [
956 (
957 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
958 / p.scapy_tra_sa.encrypt(
959 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
960 seq_num=seq,
961 )
962 )
963 for seq in range(200, 300)
964 ]
Neale Rannse11203e2021-09-21 12:34:19 +0000965 self.send_and_expect(self.tra_if, pkts, self.tra_if)
966
967 self.assertEqual(p.tra_sa_out.get_lost(), 51)
968
969 # a big hole in the seq number space
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200970 pkts = [
971 (
972 Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac)
973 / p.scapy_tra_sa.encrypt(
974 IP(src=self.tra_if.remote_ip4, dst=self.tra_if.local_ip4) / ICMP(),
975 seq_num=seq,
976 )
977 )
978 for seq in range(400, 500)
979 ]
Neale Rannse11203e2021-09-21 12:34:19 +0000980 self.send_and_expect(self.tra_if, pkts, self.tra_if)
981
982 self.assertEqual(p.tra_sa_out.get_lost(), 151)
983
Filip Tehlarefcad1a2020-02-04 09:36:04 +0000984 def verify_tra_basic4(self, count=1, payload_size=54):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200985 """ipsec v4 transport basic test"""
Klement Sekera10d066e2018-11-13 11:12:57 +0100986 self.vapi.cli("clear errors")
Neale Ranns6afaae12019-07-17 15:07:14 +0000987 self.vapi.cli("clear ipsec sa")
Klement Sekera31da2e32018-06-24 22:49:55 +0200988 try:
Klement Sekera611864f2018-09-26 11:19:00 +0200989 p = self.params[socket.AF_INET]
Klement Sekerad9b0c6f2022-04-26 19:02:15 +0200990 send_pkts = self.gen_encrypt_pkts(
991 p,
992 p.scapy_tra_sa,
993 self.tra_if,
994 src=self.tra_if.remote_ip4,
995 dst=self.tra_if.local_ip4,
996 count=count,
997 payload_size=payload_size,
998 )
999 recv_pkts = self.send_and_expect(self.tra_if, send_pkts, self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -08001000 for rx in recv_pkts:
Neale Ranns1b582b82019-04-18 19:49:13 -07001001 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
1002 self.assert_packet_checksums_valid(rx)
Klement Sekera611864f2018-09-26 11:19:00 +02001003 try:
Neale Rannsde847272018-11-28 01:38:34 -08001004 decrypted = p.vpp_tra_sa.decrypt(rx[IP])
Klement Sekera611864f2018-09-26 11:19:00 +02001005 self.assert_packet_checksums_valid(decrypted)
1006 except:
Neale Rannsde847272018-11-28 01:38:34 -08001007 self.logger.debug(ppp("Unexpected packet:", rx))
Klement Sekera611864f2018-09-26 11:19:00 +02001008 raise
Klement Sekera31da2e32018-06-24 22:49:55 +02001009 finally:
1010 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -04001011 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +02001012
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001013 pkts = p.tra_sa_in.get_stats()["packets"]
1014 self.assertEqual(
1015 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
1016 )
1017 pkts = p.tra_sa_out.get_stats()["packets"]
1018 self.assertEqual(
1019 pkts, count, "incorrect SA out counts: expected %d != %d" % (count, pkts)
1020 )
Neale Rannse11203e2021-09-21 12:34:19 +00001021 self.assertEqual(p.tra_sa_out.get_lost(), 0)
1022 self.assertEqual(p.tra_sa_in.get_lost(), 0)
Neale Rannseba31ec2019-02-17 18:04:27 +00001023
Klement Sekera10d066e2018-11-13 11:12:57 +01001024 self.assert_packet_counter_equal(self.tra4_encrypt_node_name, count)
Neale Ranns8c609af2021-02-25 10:05:32 +00001025 self.assert_packet_counter_equal(self.tra4_decrypt_node_name[0], count)
Klement Sekera10d066e2018-11-13 11:12:57 +01001026
Neale Ranns4f33c802019-04-10 12:39:10 +00001027
1028class IpsecTra4Tests(IpsecTra4):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001029 """UT test methods for Transport v4"""
1030
Neale Ranns4f33c802019-04-10 12:39:10 +00001031 def test_tra_anti_replay(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001032 """ipsec v4 transport anti-replay test"""
Neale Ranns6afaae12019-07-17 15:07:14 +00001033 self.verify_tra_anti_replay()
Neale Ranns4f33c802019-04-10 12:39:10 +00001034
Neale Rannse11203e2021-09-21 12:34:19 +00001035 def test_tra_lost(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001036 """ipsec v4 transport lost packet test"""
Neale Rannse11203e2021-09-21 12:34:19 +00001037 self.verify_tra_lost()
1038
Neale Ranns4f33c802019-04-10 12:39:10 +00001039 def test_tra_basic(self, count=1):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001040 """ipsec v4 transport basic test"""
Neale Ranns4f33c802019-04-10 12:39:10 +00001041 self.verify_tra_basic4(count=1)
1042
Klement Sekera31da2e32018-06-24 22:49:55 +02001043 def test_tra_burst(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001044 """ipsec v4 transport burst test"""
Neale Ranns4f33c802019-04-10 12:39:10 +00001045 self.verify_tra_basic4(count=257)
Klement Sekera611864f2018-09-26 11:19:00 +02001046
Neale Ranns53f526b2019-02-25 14:32:02 +00001047
Neale Ranns4f33c802019-04-10 12:39:10 +00001048class IpsecTra6(object):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001049 """verify methods for Transport v6"""
1050
Filip Tehlarefcad1a2020-02-04 09:36:04 +00001051 def verify_tra_basic6(self, count=1, payload_size=54):
Klement Sekera10d066e2018-11-13 11:12:57 +01001052 self.vapi.cli("clear errors")
Filip Tehlarefcad1a2020-02-04 09:36:04 +00001053 self.vapi.cli("clear ipsec sa")
Klement Sekera31da2e32018-06-24 22:49:55 +02001054 try:
Klement Sekera611864f2018-09-26 11:19:00 +02001055 p = self.params[socket.AF_INET6]
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001056 send_pkts = self.gen_encrypt_pkts6(
1057 p,
1058 p.scapy_tra_sa,
1059 self.tra_if,
1060 src=self.tra_if.remote_ip6,
1061 dst=self.tra_if.local_ip6,
1062 count=count,
1063 payload_size=payload_size,
1064 )
1065 recv_pkts = self.send_and_expect(self.tra_if, send_pkts, self.tra_if)
Neale Rannsde847272018-11-28 01:38:34 -08001066 for rx in recv_pkts:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001067 self.assertEqual(len(rx) - len(Ether()) - len(IPv6()), rx[IPv6].plen)
Klement Sekera611864f2018-09-26 11:19:00 +02001068 try:
Neale Rannsde847272018-11-28 01:38:34 -08001069 decrypted = p.vpp_tra_sa.decrypt(rx[IPv6])
Klement Sekera611864f2018-09-26 11:19:00 +02001070 self.assert_packet_checksums_valid(decrypted)
1071 except:
Neale Rannsde847272018-11-28 01:38:34 -08001072 self.logger.debug(ppp("Unexpected packet:", rx))
Klement Sekera611864f2018-09-26 11:19:00 +02001073 raise
Klement Sekera31da2e32018-06-24 22:49:55 +02001074 finally:
1075 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -04001076 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +02001077
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001078 pkts = p.tra_sa_in.get_stats()["packets"]
1079 self.assertEqual(
1080 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
1081 )
1082 pkts = p.tra_sa_out.get_stats()["packets"]
1083 self.assertEqual(
1084 pkts, count, "incorrect SA out counts: expected %d != %d" % (count, pkts)
1085 )
Klement Sekera10d066e2018-11-13 11:12:57 +01001086 self.assert_packet_counter_equal(self.tra6_encrypt_node_name, count)
Neale Ranns8c609af2021-02-25 10:05:32 +00001087 self.assert_packet_counter_equal(self.tra6_decrypt_node_name[0], count)
Klement Sekera10d066e2018-11-13 11:12:57 +01001088
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001089 def gen_encrypt_pkts_ext_hdrs6(
1090 self, sa, sw_intf, src, dst, count=1, payload_size=54
1091 ):
1092 return [
1093 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
1094 / sa.encrypt(
1095 IPv6(src=src, dst=dst)
1096 / ICMPv6EchoRequest(id=0, seq=1, data="X" * payload_size)
1097 )
1098 for i in range(count)
1099 ]
Neale Ranns02950402019-12-20 00:54:57 +00001100
1101 def gen_pkts_ext_hdrs6(self, sw_intf, src, dst, count=1, payload_size=54):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001102 return [
1103 Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac)
1104 / IPv6(src=src, dst=dst)
1105 / IPv6ExtHdrHopByHop()
1106 / IPv6ExtHdrFragment(id=2, offset=200)
1107 / Raw(b"\xff" * 200)
1108 for i in range(count)
1109 ]
Neale Ranns02950402019-12-20 00:54:57 +00001110
1111 def verify_tra_encrypted6(self, p, sa, rxs):
1112 decrypted = []
1113 for rx in rxs:
1114 self.assert_packet_checksums_valid(rx)
1115 try:
1116 decrypt_pkt = p.vpp_tra_sa.decrypt(rx[IPv6])
1117 decrypted.append(decrypt_pkt)
1118 self.assert_equal(decrypt_pkt.src, self.tra_if.local_ip6)
1119 self.assert_equal(decrypt_pkt.dst, self.tra_if.remote_ip6)
1120 except:
1121 self.logger.debug(ppp("Unexpected packet:", rx))
1122 try:
1123 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
1124 except:
1125 pass
1126 raise
1127 return decrypted
1128
1129 def verify_tra_66_ext_hdrs(self, p):
1130 count = 63
1131
1132 #
1133 # check we can decrypt with options
1134 #
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001135 tx = self.gen_encrypt_pkts_ext_hdrs6(
1136 p.scapy_tra_sa,
1137 self.tra_if,
1138 src=self.tra_if.remote_ip6,
1139 dst=self.tra_if.local_ip6,
1140 count=count,
1141 )
Neale Ranns02950402019-12-20 00:54:57 +00001142 self.send_and_expect(self.tra_if, tx, self.tra_if)
1143
1144 #
1145 # injecting a packet from ourselves to be routed of box is a hack
1146 # but it matches an outbout policy, alors je ne regrette rien
1147 #
1148
1149 # one extension before ESP
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001150 tx = (
1151 Ether(src=self.pg2.remote_mac, dst=self.pg2.local_mac)
1152 / IPv6(src=self.tra_if.local_ip6, dst=self.tra_if.remote_ip6)
1153 / IPv6ExtHdrFragment(id=2, offset=200)
1154 / Raw(b"\xff" * 200)
1155 )
Neale Ranns02950402019-12-20 00:54:57 +00001156
1157 rxs = self.send_and_expect(self.pg2, [tx], self.tra_if)
1158 dcs = self.verify_tra_encrypted6(p, p.vpp_tra_sa, rxs)
1159
1160 for dc in dcs:
1161 # for reasons i'm not going to investigate scapy does not
1162 # created the correct headers after decrypt. but reparsing
1163 # the ipv6 packet fixes it
1164 dc = IPv6(raw(dc[IPv6]))
1165 self.assert_equal(dc[IPv6ExtHdrFragment].id, 2)
1166
1167 # two extensions before ESP
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001168 tx = (
1169 Ether(src=self.pg2.remote_mac, dst=self.pg2.local_mac)
1170 / IPv6(src=self.tra_if.local_ip6, dst=self.tra_if.remote_ip6)
1171 / IPv6ExtHdrHopByHop()
1172 / IPv6ExtHdrFragment(id=2, offset=200)
1173 / Raw(b"\xff" * 200)
1174 )
Neale Ranns02950402019-12-20 00:54:57 +00001175
1176 rxs = self.send_and_expect(self.pg2, [tx], self.tra_if)
1177 dcs = self.verify_tra_encrypted6(p, p.vpp_tra_sa, rxs)
1178
1179 for dc in dcs:
1180 dc = IPv6(raw(dc[IPv6]))
1181 self.assertTrue(dc[IPv6ExtHdrHopByHop])
1182 self.assert_equal(dc[IPv6ExtHdrFragment].id, 2)
1183
1184 # two extensions before ESP, one after
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001185 tx = (
1186 Ether(src=self.pg2.remote_mac, dst=self.pg2.local_mac)
1187 / IPv6(src=self.tra_if.local_ip6, dst=self.tra_if.remote_ip6)
1188 / IPv6ExtHdrHopByHop()
1189 / IPv6ExtHdrFragment(id=2, offset=200)
1190 / IPv6ExtHdrDestOpt()
1191 / Raw(b"\xff" * 200)
1192 )
Neale Ranns02950402019-12-20 00:54:57 +00001193
1194 rxs = self.send_and_expect(self.pg2, [tx], self.tra_if)
1195 dcs = self.verify_tra_encrypted6(p, p.vpp_tra_sa, rxs)
1196
1197 for dc in dcs:
1198 dc = IPv6(raw(dc[IPv6]))
1199 self.assertTrue(dc[IPv6ExtHdrDestOpt])
1200 self.assertTrue(dc[IPv6ExtHdrHopByHop])
1201 self.assert_equal(dc[IPv6ExtHdrFragment].id, 2)
1202
Neale Ranns4f33c802019-04-10 12:39:10 +00001203
1204class IpsecTra6Tests(IpsecTra6):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001205 """UT test methods for Transport v6"""
1206
Neale Ranns4f33c802019-04-10 12:39:10 +00001207 def test_tra_basic6(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001208 """ipsec v6 transport basic test"""
Neale Ranns4f33c802019-04-10 12:39:10 +00001209 self.verify_tra_basic6(count=1)
1210
Klement Sekera611864f2018-09-26 11:19:00 +02001211 def test_tra_burst6(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001212 """ipsec v6 transport burst test"""
Neale Ranns4f33c802019-04-10 12:39:10 +00001213 self.verify_tra_basic6(count=257)
Klement Sekera31da2e32018-06-24 22:49:55 +02001214
Klement Sekera611864f2018-09-26 11:19:00 +02001215
Neale Ranns02950402019-12-20 00:54:57 +00001216class IpsecTra6ExtTests(IpsecTra6):
1217 def test_tra_ext_hdrs_66(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001218 """ipsec 6o6 tra extension headers test"""
Neale Ranns02950402019-12-20 00:54:57 +00001219 self.verify_tra_66_ext_hdrs(self.params[socket.AF_INET6])
1220
1221
Neale Ranns53f526b2019-02-25 14:32:02 +00001222class IpsecTra46Tests(IpsecTra4Tests, IpsecTra6Tests):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001223 """UT test methods for Transport v6 and v4"""
1224
Neale Ranns53f526b2019-02-25 14:32:02 +00001225 pass
1226
1227
Neale Ranns2ac885c2019-03-20 18:24:43 +00001228class IpsecTun4(object):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001229 """verify methods for Tunnel v4"""
1230
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001231 def verify_counters4(self, p, count, n_frags=None, worker=None):
Klement Sekera6aa58b72019-05-16 14:34:55 +02001232 if not n_frags:
1233 n_frags = count
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001234 if hasattr(p, "spd_policy_in_any"):
1235 pkts = p.spd_policy_in_any.get_stats(worker)["packets"]
1236 self.assertEqual(
1237 pkts,
1238 count,
1239 "incorrect SPD any policy: expected %d != %d" % (count, pkts),
1240 )
Neale Ranns987aea82019-03-27 13:40:35 +00001241
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001242 if hasattr(p, "tun_sa_in"):
1243 pkts = p.tun_sa_in.get_stats(worker)["packets"]
1244 self.assertEqual(
1245 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
1246 )
1247 pkts = p.tun_sa_out.get_stats(worker)["packets"]
1248 self.assertEqual(
1249 pkts,
1250 n_frags,
1251 "incorrect SA out counts: expected %d != %d" % (count, pkts),
1252 )
Neale Ranns987aea82019-03-27 13:40:35 +00001253
Klement Sekera6aa58b72019-05-16 14:34:55 +02001254 self.assert_packet_counter_equal(self.tun4_encrypt_node_name, n_frags)
Neale Ranns8c609af2021-02-25 10:05:32 +00001255 self.assert_packet_counter_equal(self.tun4_decrypt_node_name[0], count)
Neale Ranns987aea82019-03-27 13:40:35 +00001256
Neale Rannsf05e7322019-03-29 20:23:58 +00001257 def verify_decrypted(self, p, rxs):
1258 for rx in rxs:
1259 self.assert_equal(rx[IP].src, p.remote_tun_if_host)
1260 self.assert_equal(rx[IP].dst, self.pg1.remote_ip4)
1261 self.assert_packet_checksums_valid(rx)
1262
Christian Hoppsfb7e7ed2019-11-03 07:02:15 -05001263 def verify_esp_padding(self, sa, esp_payload, decrypt_pkt):
1264 align = sa.crypt_algo.block_size
1265 if align < 4:
1266 align = 4
1267 exp_len = (len(decrypt_pkt) + 2 + (align - 1)) & ~(align - 1)
1268 exp_len += sa.crypt_algo.iv_size
1269 exp_len += sa.crypt_algo.icv_size or sa.auth_algo.icv_size
1270 self.assertEqual(exp_len, len(esp_payload))
1271
Neale Rannsf05e7322019-03-29 20:23:58 +00001272 def verify_encrypted(self, p, sa, rxs):
1273 decrypt_pkts = []
1274 for rx in rxs:
Neale Ranns41afb332019-07-16 06:19:35 -07001275 if p.nat_header:
1276 self.assertEqual(rx[UDP].dport, 4500)
Neale Ranns1b582b82019-04-18 19:49:13 -07001277 self.assert_packet_checksums_valid(rx)
1278 self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
Neale Rannsf05e7322019-03-29 20:23:58 +00001279 try:
Christian Hoppsfb7e7ed2019-11-03 07:02:15 -05001280 rx_ip = rx[IP]
1281 decrypt_pkt = p.vpp_tun_sa.decrypt(rx_ip)
Neale Rannsf05e7322019-03-29 20:23:58 +00001282 if not decrypt_pkt.haslayer(IP):
1283 decrypt_pkt = IP(decrypt_pkt[Raw].load)
Christian Hoppsfb7e7ed2019-11-03 07:02:15 -05001284 if rx_ip.proto == socket.IPPROTO_ESP:
1285 self.verify_esp_padding(sa, rx_ip[ESP].data, decrypt_pkt)
Neale Rannsf05e7322019-03-29 20:23:58 +00001286 decrypt_pkts.append(decrypt_pkt)
1287 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
1288 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
1289 except:
1290 self.logger.debug(ppp("Unexpected packet:", rx))
1291 try:
1292 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
1293 except:
1294 pass
1295 raise
1296 pkts = reassemble4(decrypt_pkts)
1297 for pkt in pkts:
1298 self.assert_packet_checksums_valid(pkt)
1299
Neale Rannsd7603d92019-03-28 08:56:10 +00001300 def verify_tun_44(self, p, count=1, payload_size=64, n_rx=None):
Klement Sekera10d066e2018-11-13 11:12:57 +01001301 self.vapi.cli("clear errors")
Neale Ranns02950402019-12-20 00:54:57 +00001302 self.vapi.cli("clear ipsec counters")
Neale Ranns28287212019-12-16 00:53:11 +00001303 self.vapi.cli("clear ipsec sa")
Neale Rannsd7603d92019-03-28 08:56:10 +00001304 if not n_rx:
1305 n_rx = count
Klement Sekera31da2e32018-06-24 22:49:55 +02001306 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001307 send_pkts = self.gen_encrypt_pkts(
1308 p,
1309 p.scapy_tun_sa,
1310 self.tun_if,
1311 src=p.remote_tun_if_host,
1312 dst=self.pg1.remote_ip4,
1313 count=count,
1314 payload_size=payload_size,
1315 )
Klement Sekera611864f2018-09-26 11:19:00 +02001316 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
Neale Rannsf05e7322019-03-29 20:23:58 +00001317 self.verify_decrypted(p, recv_pkts)
1318
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001319 send_pkts = self.gen_pkts(
1320 self.pg1,
1321 src=self.pg1.remote_ip4,
1322 dst=p.remote_tun_if_host,
1323 count=count,
1324 payload_size=payload_size,
1325 )
1326 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if, n_rx)
Neale Rannsf05e7322019-03-29 20:23:58 +00001327 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
1328
Neale Rannsf3a66222020-01-02 05:04:00 +00001329 for rx in recv_pkts:
1330 self.assertEqual(rx[IP].src, p.tun_src)
1331 self.assertEqual(rx[IP].dst, p.tun_dst)
1332
Klement Sekera31da2e32018-06-24 22:49:55 +02001333 finally:
1334 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -04001335 self.logger.info(self.vapi.ppcli("show ipsec all"))
Klement Sekera31da2e32018-06-24 22:49:55 +02001336
Neale Ranns02950402019-12-20 00:54:57 +00001337 self.logger.info(self.vapi.ppcli("show ipsec sa 0"))
1338 self.logger.info(self.vapi.ppcli("show ipsec sa 4"))
Klement Sekera6aa58b72019-05-16 14:34:55 +02001339 self.verify_counters4(p, count, n_rx)
Neale Rannseba31ec2019-02-17 18:04:27 +00001340
Neale Ranns28287212019-12-16 00:53:11 +00001341 def verify_tun_dropped_44(self, p, count=1, payload_size=64, n_rx=None):
1342 self.vapi.cli("clear errors")
1343 if not n_rx:
1344 n_rx = count
1345 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001346 send_pkts = self.gen_encrypt_pkts(
1347 p,
1348 p.scapy_tun_sa,
1349 self.tun_if,
1350 src=p.remote_tun_if_host,
1351 dst=self.pg1.remote_ip4,
1352 count=count,
1353 )
Neale Ranns28287212019-12-16 00:53:11 +00001354 self.send_and_assert_no_replies(self.tun_if, send_pkts)
1355
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001356 send_pkts = self.gen_pkts(
1357 self.pg1,
1358 src=self.pg1.remote_ip4,
1359 dst=p.remote_tun_if_host,
1360 count=count,
1361 payload_size=payload_size,
1362 )
Neale Ranns28287212019-12-16 00:53:11 +00001363 self.send_and_assert_no_replies(self.pg1, send_pkts)
1364
1365 finally:
1366 self.logger.info(self.vapi.ppcli("show error"))
1367 self.logger.info(self.vapi.ppcli("show ipsec all"))
1368
Neale Ranns14046982019-07-29 14:49:52 +00001369 def verify_tun_reass_44(self, p):
1370 self.vapi.cli("clear errors")
1371 self.vapi.ip_reassembly_enable_disable(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001372 sw_if_index=self.tun_if.sw_if_index, enable_ip4=True
1373 )
Neale Ranns14046982019-07-29 14:49:52 +00001374
1375 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001376 send_pkts = self.gen_encrypt_pkts(
1377 p,
1378 p.scapy_tun_sa,
1379 self.tun_if,
1380 src=p.remote_tun_if_host,
1381 dst=self.pg1.remote_ip4,
1382 payload_size=1900,
1383 count=1,
1384 )
Neale Ranns14046982019-07-29 14:49:52 +00001385 send_pkts = fragment_rfc791(send_pkts[0], 1400)
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001386 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1, n_rx=1)
Neale Ranns14046982019-07-29 14:49:52 +00001387 self.verify_decrypted(p, recv_pkts)
1388
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001389 send_pkts = self.gen_pkts(
1390 self.pg1, src=self.pg1.remote_ip4, dst=p.remote_tun_if_host, count=1
1391 )
1392 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
Neale Ranns14046982019-07-29 14:49:52 +00001393 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
1394
1395 finally:
1396 self.logger.info(self.vapi.ppcli("show error"))
1397 self.logger.info(self.vapi.ppcli("show ipsec all"))
1398
1399 self.verify_counters4(p, 1, 1)
1400 self.vapi.ip_reassembly_enable_disable(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001401 sw_if_index=self.tun_if.sw_if_index, enable_ip4=False
1402 )
Neale Ranns14046982019-07-29 14:49:52 +00001403
Neale Ranns987aea82019-03-27 13:40:35 +00001404 def verify_tun_64(self, p, count=1):
1405 self.vapi.cli("clear errors")
Neale Rannsdd4ccf22020-06-30 07:47:14 +00001406 self.vapi.cli("clear ipsec sa")
Neale Ranns987aea82019-03-27 13:40:35 +00001407 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001408 send_pkts = self.gen_encrypt_pkts6(
1409 p,
1410 p.scapy_tun_sa,
1411 self.tun_if,
1412 src=p.remote_tun_if_host6,
1413 dst=self.pg1.remote_ip6,
1414 count=count,
1415 )
Neale Ranns987aea82019-03-27 13:40:35 +00001416 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
1417 for recv_pkt in recv_pkts:
1418 self.assert_equal(recv_pkt[IPv6].src, p.remote_tun_if_host6)
1419 self.assert_equal(recv_pkt[IPv6].dst, self.pg1.remote_ip6)
1420 self.assert_packet_checksums_valid(recv_pkt)
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001421 send_pkts = self.gen_pkts6(
1422 p,
1423 self.pg1,
1424 src=self.pg1.remote_ip6,
1425 dst=p.remote_tun_if_host6,
1426 count=count,
1427 )
Neale Ranns987aea82019-03-27 13:40:35 +00001428 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
1429 for recv_pkt in recv_pkts:
1430 try:
1431 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IP])
1432 if not decrypt_pkt.haslayer(IPv6):
1433 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
1434 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
1435 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host6)
1436 self.assert_packet_checksums_valid(decrypt_pkt)
1437 except:
1438 self.logger.error(ppp("Unexpected packet:", recv_pkt))
1439 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001440 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
Neale Ranns987aea82019-03-27 13:40:35 +00001441 except:
1442 pass
1443 raise
1444 finally:
1445 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -04001446 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Rannseba31ec2019-02-17 18:04:27 +00001447
Klement Sekera6aa58b72019-05-16 14:34:55 +02001448 self.verify_counters4(p, count)
Klement Sekera10d066e2018-11-13 11:12:57 +01001449
Neale Ranns41afb332019-07-16 06:19:35 -07001450 def verify_keepalive(self, p):
Neale Ranns992a4d02022-01-10 11:21:17 +00001451 # the sizeof Raw is calculated to pad to the minimum ehternet
1452 # frame size of 64 btyes
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001453 pkt = (
1454 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
1455 / IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
1456 / UDP(sport=333, dport=4500)
1457 / Raw(b"\xff")
1458 / Padding(0 * 21)
1459 )
1460 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
Neale Ranns41afb332019-07-16 06:19:35 -07001461 self.assert_error_counter_equal(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001462 "/err/%s/NAT Keepalive" % self.tun4_input_node, 31
1463 )
Neale Ranns41afb332019-07-16 06:19:35 -07001464
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001465 pkt = (
1466 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
1467 / IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
1468 / UDP(sport=333, dport=4500)
1469 / Raw(b"\xfe")
1470 )
1471 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
1472 self.assert_error_counter_equal("/err/%s/Too Short" % self.tun4_input_node, 31)
Neale Ranns41afb332019-07-16 06:19:35 -07001473
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001474 pkt = (
1475 Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac)
1476 / IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4)
1477 / UDP(sport=333, dport=4500)
1478 / Raw(b"\xfe")
1479 / Padding(0 * 21)
1480 )
1481 self.send_and_assert_no_replies(self.tun_if, pkt * 31)
1482 self.assert_error_counter_equal("/err/%s/Too Short" % self.tun4_input_node, 62)
Neale Ranns992a4d02022-01-10 11:21:17 +00001483
Neale Ranns2ac885c2019-03-20 18:24:43 +00001484
1485class IpsecTun4Tests(IpsecTun4):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001486 """UT test methods for Tunnel v4"""
1487
Neale Ranns2ac885c2019-03-20 18:24:43 +00001488 def test_tun_basic44(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001489 """ipsec 4o4 tunnel basic test"""
Neale Ranns2ac885c2019-03-20 18:24:43 +00001490 self.verify_tun_44(self.params[socket.AF_INET], count=1)
Neale Ranns02950402019-12-20 00:54:57 +00001491 self.tun_if.admin_down()
1492 self.tun_if.resolve_arp()
1493 self.tun_if.admin_up()
1494 self.verify_tun_44(self.params[socket.AF_INET], count=1)
Neale Ranns2ac885c2019-03-20 18:24:43 +00001495
Neale Ranns14046982019-07-29 14:49:52 +00001496 def test_tun_reass_basic44(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001497 """ipsec 4o4 tunnel basic reassembly test"""
Neale Ranns14046982019-07-29 14:49:52 +00001498 self.verify_tun_reass_44(self.params[socket.AF_INET])
1499
Klement Sekera611864f2018-09-26 11:19:00 +02001500 def test_tun_burst44(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001501 """ipsec 4o4 tunnel burst test"""
Neale Ranns02950402019-12-20 00:54:57 +00001502 self.verify_tun_44(self.params[socket.AF_INET], count=127)
1503
1504
Neale Ranns2ac885c2019-03-20 18:24:43 +00001505class IpsecTun6(object):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001506 """verify methods for Tunnel v6"""
1507
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001508 def verify_counters6(self, p_in, p_out, count, worker=None):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001509 if hasattr(p_in, "tun_sa_in"):
1510 pkts = p_in.tun_sa_in.get_stats(worker)["packets"]
1511 self.assertEqual(
1512 pkts, count, "incorrect SA in counts: expected %d != %d" % (count, pkts)
1513 )
1514 if hasattr(p_out, "tun_sa_out"):
1515 pkts = p_out.tun_sa_out.get_stats(worker)["packets"]
1516 self.assertEqual(
1517 pkts,
1518 count,
1519 "incorrect SA out counts: expected %d != %d" % (count, pkts),
1520 )
Neale Ranns987aea82019-03-27 13:40:35 +00001521 self.assert_packet_counter_equal(self.tun6_encrypt_node_name, count)
Neale Ranns8c609af2021-02-25 10:05:32 +00001522 self.assert_packet_counter_equal(self.tun6_decrypt_node_name[0], count)
Neale Ranns987aea82019-03-27 13:40:35 +00001523
Neale Rannsc87b66c2019-02-07 07:26:12 -08001524 def verify_decrypted6(self, p, rxs):
1525 for rx in rxs:
1526 self.assert_equal(rx[IPv6].src, p.remote_tun_if_host)
1527 self.assert_equal(rx[IPv6].dst, self.pg1.remote_ip6)
1528 self.assert_packet_checksums_valid(rx)
1529
1530 def verify_encrypted6(self, p, sa, rxs):
1531 for rx in rxs:
1532 self.assert_packet_checksums_valid(rx)
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001533 self.assertEqual(len(rx) - len(Ether()) - len(IPv6()), rx[IPv6].plen)
Neale Ranns9ec846c2021-02-09 14:04:02 +00001534 self.assert_equal(rx[IPv6].hlim, p.outer_hop_limit)
1535 if p.outer_flow_label:
1536 self.assert_equal(rx[IPv6].fl, p.outer_flow_label)
Neale Rannsc87b66c2019-02-07 07:26:12 -08001537 try:
1538 decrypt_pkt = p.vpp_tun_sa.decrypt(rx[IPv6])
1539 if not decrypt_pkt.haslayer(IPv6):
1540 decrypt_pkt = IPv6(decrypt_pkt[Raw].load)
1541 self.assert_packet_checksums_valid(decrypt_pkt)
1542 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip6)
1543 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host)
Neale Ranns9ec846c2021-02-09 14:04:02 +00001544 self.assert_equal(decrypt_pkt.hlim, p.inner_hop_limit - 1)
1545 self.assert_equal(decrypt_pkt.fl, p.inner_flow_label)
Neale Rannsc87b66c2019-02-07 07:26:12 -08001546 except:
1547 self.logger.debug(ppp("Unexpected packet:", rx))
1548 try:
1549 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
1550 except:
1551 pass
1552 raise
1553
Neale Ranns49378f22022-01-10 10:38:43 +00001554 def verify_drop_tun_tx_66(self, p_in, count=1, payload_size=64):
1555 self.vapi.cli("clear errors")
1556 self.vapi.cli("clear ipsec sa")
1557
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001558 send_pkts = self.gen_pkts6(
1559 p_in,
1560 self.pg1,
1561 src=self.pg1.remote_ip6,
1562 dst=p_in.remote_tun_if_host,
1563 count=count,
1564 payload_size=payload_size,
1565 )
Neale Ranns49378f22022-01-10 10:38:43 +00001566 self.send_and_assert_no_replies(self.tun_if, send_pkts)
1567 self.logger.info(self.vapi.cli("sh punt stats"))
1568
1569 def verify_drop_tun_rx_66(self, p_in, count=1, payload_size=64):
Klement Sekera10d066e2018-11-13 11:12:57 +01001570 self.vapi.cli("clear errors")
Neale Rannsc87b66c2019-02-07 07:26:12 -08001571 self.vapi.cli("clear ipsec sa")
1572
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001573 send_pkts = self.gen_encrypt_pkts6(
1574 p_in,
1575 p_in.scapy_tun_sa,
1576 self.tun_if,
1577 src=p_in.remote_tun_if_host,
1578 dst=self.pg1.remote_ip6,
1579 count=count,
1580 )
Neale Rannsc87b66c2019-02-07 07:26:12 -08001581 self.send_and_assert_no_replies(self.tun_if, send_pkts)
Neale Ranns49378f22022-01-10 10:38:43 +00001582
1583 def verify_drop_tun_66(self, p_in, count=1, payload_size=64):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001584 self.verify_drop_tun_tx_66(p_in, count=count, payload_size=payload_size)
1585 self.verify_drop_tun_rx_66(p_in, count=count, payload_size=payload_size)
Neale Rannsc87b66c2019-02-07 07:26:12 -08001586
1587 def verify_tun_66(self, p_in, p_out=None, count=1, payload_size=64):
1588 self.vapi.cli("clear errors")
1589 self.vapi.cli("clear ipsec sa")
1590 if not p_out:
1591 p_out = p_in
Klement Sekera31da2e32018-06-24 22:49:55 +02001592 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001593 send_pkts = self.gen_encrypt_pkts6(
1594 p_in,
1595 p_in.scapy_tun_sa,
1596 self.tun_if,
1597 src=p_in.remote_tun_if_host,
1598 dst=self.pg1.remote_ip6,
1599 count=count,
1600 payload_size=payload_size,
1601 )
Klement Sekera611864f2018-09-26 11:19:00 +02001602 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
Neale Rannsc87b66c2019-02-07 07:26:12 -08001603 self.verify_decrypted6(p_in, recv_pkts)
1604
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001605 send_pkts = self.gen_pkts6(
1606 p_in,
1607 self.pg1,
1608 src=self.pg1.remote_ip6,
1609 dst=p_out.remote_tun_if_host,
1610 count=count,
1611 payload_size=payload_size,
1612 )
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001613 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
Neale Rannsc87b66c2019-02-07 07:26:12 -08001614 self.verify_encrypted6(p_out, p_out.vpp_tun_sa, recv_pkts)
1615
Neale Rannsf3a66222020-01-02 05:04:00 +00001616 for rx in recv_pkts:
1617 self.assertEqual(rx[IPv6].src, p_out.tun_src)
1618 self.assertEqual(rx[IPv6].dst, p_out.tun_dst)
1619
Klement Sekera31da2e32018-06-24 22:49:55 +02001620 finally:
1621 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -04001622 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Rannsc87b66c2019-02-07 07:26:12 -08001623 self.verify_counters6(p_in, p_out, count)
Klement Sekera31da2e32018-06-24 22:49:55 +02001624
Neale Ranns14046982019-07-29 14:49:52 +00001625 def verify_tun_reass_66(self, p):
1626 self.vapi.cli("clear errors")
1627 self.vapi.ip_reassembly_enable_disable(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001628 sw_if_index=self.tun_if.sw_if_index, enable_ip6=True
1629 )
Neale Ranns14046982019-07-29 14:49:52 +00001630
1631 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001632 send_pkts = self.gen_encrypt_pkts6(
1633 p,
1634 p.scapy_tun_sa,
1635 self.tun_if,
1636 src=p.remote_tun_if_host,
1637 dst=self.pg1.remote_ip6,
1638 count=1,
1639 payload_size=1850,
1640 )
Neale Ranns14046982019-07-29 14:49:52 +00001641 send_pkts = fragment_rfc8200(send_pkts[0], 1, 1400, self.logger)
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001642 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1, n_rx=1)
Neale Ranns14046982019-07-29 14:49:52 +00001643 self.verify_decrypted6(p, recv_pkts)
1644
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001645 send_pkts = self.gen_pkts6(
1646 p,
1647 self.pg1,
1648 src=self.pg1.remote_ip6,
1649 dst=p.remote_tun_if_host,
1650 count=1,
1651 payload_size=64,
1652 )
1653 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
Neale Ranns14046982019-07-29 14:49:52 +00001654 self.verify_encrypted6(p, p.vpp_tun_sa, recv_pkts)
1655 finally:
1656 self.logger.info(self.vapi.ppcli("show error"))
1657 self.logger.info(self.vapi.ppcli("show ipsec all"))
1658 self.verify_counters6(p, p, 1)
1659 self.vapi.ip_reassembly_enable_disable(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001660 sw_if_index=self.tun_if.sw_if_index, enable_ip6=False
1661 )
Neale Ranns14046982019-07-29 14:49:52 +00001662
Neale Ranns987aea82019-03-27 13:40:35 +00001663 def verify_tun_46(self, p, count=1):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001664 """ipsec 4o6 tunnel basic test"""
Neale Ranns987aea82019-03-27 13:40:35 +00001665 self.vapi.cli("clear errors")
Neale Rannsdd4ccf22020-06-30 07:47:14 +00001666 self.vapi.cli("clear ipsec sa")
Neale Ranns987aea82019-03-27 13:40:35 +00001667 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001668 send_pkts = self.gen_encrypt_pkts(
1669 p,
1670 p.scapy_tun_sa,
1671 self.tun_if,
1672 src=p.remote_tun_if_host4,
1673 dst=self.pg1.remote_ip4,
1674 count=count,
1675 )
Neale Ranns987aea82019-03-27 13:40:35 +00001676 recv_pkts = self.send_and_expect(self.tun_if, send_pkts, self.pg1)
1677 for recv_pkt in recv_pkts:
1678 self.assert_equal(recv_pkt[IP].src, p.remote_tun_if_host4)
1679 self.assert_equal(recv_pkt[IP].dst, self.pg1.remote_ip4)
1680 self.assert_packet_checksums_valid(recv_pkt)
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001681 send_pkts = self.gen_pkts(
1682 self.pg1,
1683 src=self.pg1.remote_ip4,
1684 dst=p.remote_tun_if_host4,
1685 count=count,
1686 )
Neale Ranns987aea82019-03-27 13:40:35 +00001687 recv_pkts = self.send_and_expect(self.pg1, send_pkts, self.tun_if)
1688 for recv_pkt in recv_pkts:
1689 try:
1690 decrypt_pkt = p.vpp_tun_sa.decrypt(recv_pkt[IPv6])
1691 if not decrypt_pkt.haslayer(IP):
1692 decrypt_pkt = IP(decrypt_pkt[Raw].load)
1693 self.assert_equal(decrypt_pkt.src, self.pg1.remote_ip4)
1694 self.assert_equal(decrypt_pkt.dst, p.remote_tun_if_host4)
1695 self.assert_packet_checksums_valid(decrypt_pkt)
1696 except:
1697 self.logger.debug(ppp("Unexpected packet:", recv_pkt))
1698 try:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001699 self.logger.debug(ppp("Decrypted packet:", decrypt_pkt))
Neale Ranns987aea82019-03-27 13:40:35 +00001700 except:
1701 pass
1702 raise
1703 finally:
1704 self.logger.info(self.vapi.ppcli("show error"))
Paul Vinciguerra9673e3e2019-05-10 20:41:08 -04001705 self.logger.info(self.vapi.ppcli("show ipsec all"))
Neale Rannsc87b66c2019-02-07 07:26:12 -08001706 self.verify_counters6(p, p, count)
Klement Sekera10d066e2018-11-13 11:12:57 +01001707
Neale Ranns2ac885c2019-03-20 18:24:43 +00001708
1709class IpsecTun6Tests(IpsecTun6):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001710 """UT test methods for Tunnel v6"""
Neale Ranns2ac885c2019-03-20 18:24:43 +00001711
1712 def test_tun_basic66(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001713 """ipsec 6o6 tunnel basic test"""
Neale Ranns2ac885c2019-03-20 18:24:43 +00001714 self.verify_tun_66(self.params[socket.AF_INET6], count=1)
1715
Neale Ranns14046982019-07-29 14:49:52 +00001716 def test_tun_reass_basic66(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001717 """ipsec 6o6 tunnel basic reassembly test"""
Neale Ranns14046982019-07-29 14:49:52 +00001718 self.verify_tun_reass_66(self.params[socket.AF_INET6])
1719
Klement Sekera611864f2018-09-26 11:19:00 +02001720 def test_tun_burst66(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001721 """ipsec 6o6 tunnel burst test"""
Neale Ranns2ac885c2019-03-20 18:24:43 +00001722 self.verify_tun_66(self.params[socket.AF_INET6], count=257)
Klement Sekera611864f2018-09-26 11:19:00 +02001723
1724
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001725class IpsecTun6HandoffTests(IpsecTun6):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001726 """UT test methods for Tunnel v6 with multiple workers"""
1727
Klement Sekera8d815022021-03-15 16:58:10 +01001728 vpp_worker_count = 2
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001729
1730 def test_tun_handoff_66(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001731 """ipsec 6o6 tunnel worker hand-off test"""
Brian Russell7a29a2d2021-02-22 18:42:24 +00001732 self.vapi.cli("clear errors")
1733 self.vapi.cli("clear ipsec sa")
1734
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001735 N_PKTS = 15
1736 p = self.params[socket.AF_INET6]
1737
1738 # inject alternately on worker 0 and 1. all counts on the SA
1739 # should be against worker 0
1740 for worker in [0, 1, 0, 1]:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001741 send_pkts = self.gen_encrypt_pkts6(
1742 p,
1743 p.scapy_tun_sa,
1744 self.tun_if,
1745 src=p.remote_tun_if_host,
1746 dst=self.pg1.remote_ip6,
1747 count=N_PKTS,
1748 )
1749 recv_pkts = self.send_and_expect(
1750 self.tun_if, send_pkts, self.pg1, worker=worker
1751 )
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001752 self.verify_decrypted6(p, recv_pkts)
1753
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001754 send_pkts = self.gen_pkts6(
1755 p,
1756 self.pg1,
1757 src=self.pg1.remote_ip6,
1758 dst=p.remote_tun_if_host,
1759 count=N_PKTS,
1760 )
1761 recv_pkts = self.send_and_expect(
1762 self.pg1, send_pkts, self.tun_if, worker=worker
1763 )
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001764 self.verify_encrypted6(p, p.vpp_tun_sa, recv_pkts)
1765
1766 # all counts against the first worker that was used
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001767 self.verify_counters6(p, p, 4 * N_PKTS, worker=0)
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001768
1769
1770class IpsecTun4HandoffTests(IpsecTun4):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001771 """UT test methods for Tunnel v4 with multiple workers"""
1772
Klement Sekera8d815022021-03-15 16:58:10 +01001773 vpp_worker_count = 2
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001774
1775 def test_tun_handooff_44(self):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001776 """ipsec 4o4 tunnel worker hand-off test"""
Brian Russell7a29a2d2021-02-22 18:42:24 +00001777 self.vapi.cli("clear errors")
1778 self.vapi.cli("clear ipsec sa")
1779
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001780 N_PKTS = 15
1781 p = self.params[socket.AF_INET]
1782
1783 # inject alternately on worker 0 and 1. all counts on the SA
1784 # should be against worker 0
1785 for worker in [0, 1, 0, 1]:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001786 send_pkts = self.gen_encrypt_pkts(
1787 p,
1788 p.scapy_tun_sa,
1789 self.tun_if,
1790 src=p.remote_tun_if_host,
1791 dst=self.pg1.remote_ip4,
1792 count=N_PKTS,
1793 )
1794 recv_pkts = self.send_and_expect(
1795 self.tun_if, send_pkts, self.pg1, worker=worker
1796 )
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001797 self.verify_decrypted(p, recv_pkts)
1798
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001799 send_pkts = self.gen_pkts(
1800 self.pg1,
1801 src=self.pg1.remote_ip4,
1802 dst=p.remote_tun_if_host,
1803 count=N_PKTS,
1804 )
1805 recv_pkts = self.send_and_expect(
1806 self.pg1, send_pkts, self.tun_if, worker=worker
1807 )
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001808 self.verify_encrypted(p, p.vpp_tun_sa, recv_pkts)
1809
1810 # all counts against the first worker that was used
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001811 self.verify_counters4(p, 4 * N_PKTS, worker=0)
Neale Ranns4a56f4e2019-12-23 04:10:25 +00001812
1813
Neale Ranns53f526b2019-02-25 14:32:02 +00001814class IpsecTun46Tests(IpsecTun4Tests, IpsecTun6Tests):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001815 """UT test methods for Tunnel v6 & v4"""
1816
Klement Sekera611864f2018-09-26 11:19:00 +02001817 pass
1818
Klement Sekera31da2e32018-06-24 22:49:55 +02001819
Zachary Leaf26fec712021-10-26 10:05:58 -05001820class IPSecIPv4Fwd(VppTestCase):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001821 """Test IPSec by capturing and verifying IPv4 forwarded pkts"""
1822
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001823 @classmethod
1824 def setUpConstants(cls):
Zachary Leaf26fec712021-10-26 10:05:58 -05001825 super(IPSecIPv4Fwd, cls).setUpConstants()
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001826
1827 def setUp(self):
Zachary Leaf26fec712021-10-26 10:05:58 -05001828 super(IPSecIPv4Fwd, self).setUp()
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001829 # store SPD objects so we can remove configs on tear down
1830 self.spd_objs = []
1831 self.spd_policies = []
1832
1833 def tearDown(self):
1834 # remove SPD policies
1835 for obj in self.spd_policies:
1836 obj.remove_vpp_config()
1837 self.spd_policies = []
1838 # remove SPD items (interface bindings first, then SPD)
1839 for obj in reversed(self.spd_objs):
1840 obj.remove_vpp_config()
1841 self.spd_objs = []
1842 # close down pg intfs
1843 for pg in self.pg_interfaces:
1844 pg.unconfig_ip4()
1845 pg.admin_down()
Zachary Leaf26fec712021-10-26 10:05:58 -05001846 super(IPSecIPv4Fwd, self).tearDown()
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001847
1848 def create_interfaces(self, num_ifs=2):
1849 # create interfaces pg0 ... pg<num_ifs>
1850 self.create_pg_interfaces(range(num_ifs))
1851 for pg in self.pg_interfaces:
1852 # put the interface up
1853 pg.admin_up()
1854 # configure IPv4 address on the interface
1855 pg.config_ip4()
1856 # resolve ARP, so that we know VPP MAC
1857 pg.resolve_arp()
1858 self.logger.info(self.vapi.ppcli("show int addr"))
1859
1860 def spd_create_and_intf_add(self, spd_id, pg_list):
1861 spd = VppIpsecSpd(self, spd_id)
1862 spd.add_vpp_config()
1863 self.spd_objs.append(spd)
1864 for pg in pg_list:
1865 spdItf = VppIpsecSpdItfBinding(self, spd, pg)
1866 spdItf.add_vpp_config()
1867 self.spd_objs.append(spdItf)
1868
1869 def get_policy(self, policy_type):
1870 e = VppEnum.vl_api_ipsec_spd_action_t
1871 if policy_type == "protect":
1872 return e.IPSEC_API_SPD_ACTION_PROTECT
1873 elif policy_type == "bypass":
1874 return e.IPSEC_API_SPD_ACTION_BYPASS
1875 elif policy_type == "discard":
1876 return e.IPSEC_API_SPD_ACTION_DISCARD
1877 else:
1878 raise Exception("Invalid policy type: %s", policy_type)
1879
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001880 def spd_add_rem_policy(
1881 self,
1882 spd_id,
1883 src_if,
1884 dst_if,
1885 proto,
1886 is_out,
1887 priority,
1888 policy_type,
1889 remove=False,
1890 all_ips=False,
Fan Zhangab0bf0c2022-05-25 20:03:40 +00001891 ip_range=False,
1892 local_ip_start=ip_address("0.0.0.0"),
1893 local_ip_stop=ip_address("255.255.255.255"),
1894 remote_ip_start=ip_address("0.0.0.0"),
1895 remote_ip_stop=ip_address("255.255.255.255"),
1896 remote_port_start=0,
1897 remote_port_stop=65535,
1898 local_port_start=0,
1899 local_port_stop=65535,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001900 ):
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001901 spd = VppIpsecSpd(self, spd_id)
1902
1903 if all_ips:
1904 src_range_low = ip_address("0.0.0.0")
1905 src_range_high = ip_address("255.255.255.255")
1906 dst_range_low = ip_address("0.0.0.0")
1907 dst_range_high = ip_address("255.255.255.255")
Fan Zhangab0bf0c2022-05-25 20:03:40 +00001908
1909 elif ip_range:
1910 src_range_low = local_ip_start
1911 src_range_high = local_ip_stop
1912 dst_range_low = remote_ip_start
1913 dst_range_high = remote_ip_stop
1914
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001915 else:
1916 src_range_low = src_if.remote_ip4
1917 src_range_high = src_if.remote_ip4
1918 dst_range_low = dst_if.remote_ip4
1919 dst_range_high = dst_if.remote_ip4
1920
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001921 spdEntry = VppIpsecSpdEntry(
1922 self,
1923 spd,
1924 0,
1925 src_range_low,
1926 src_range_high,
1927 dst_range_low,
1928 dst_range_high,
1929 proto,
1930 priority=priority,
1931 policy=self.get_policy(policy_type),
1932 is_outbound=is_out,
Fan Zhangab0bf0c2022-05-25 20:03:40 +00001933 remote_port_start=remote_port_start,
1934 remote_port_stop=remote_port_stop,
1935 local_port_start=local_port_start,
1936 local_port_stop=local_port_stop,
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001937 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001938
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001939 if remove is False:
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001940 spdEntry.add_vpp_config()
1941 self.spd_policies.append(spdEntry)
1942 else:
1943 spdEntry.remove_vpp_config()
1944 self.spd_policies.remove(spdEntry)
1945 self.logger.info(self.vapi.ppcli("show ipsec all"))
1946 return spdEntry
1947
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001948 def create_stream(self, src_if, dst_if, pkt_count, src_prt=1234, dst_prt=5678):
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001949 packets = []
1950 for i in range(pkt_count):
1951 # create packet info stored in the test case instance
1952 info = self.create_packet_info(src_if, dst_if)
1953 # convert the info into packet payload
1954 payload = self.info_to_payload(info)
1955 # create the packet itself
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001956 p = (
1957 Ether(dst=src_if.local_mac, src=src_if.remote_mac)
1958 / IP(src=src_if.remote_ip4, dst=dst_if.remote_ip4)
1959 / UDP(sport=src_prt, dport=dst_prt)
1960 / Raw(payload)
1961 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001962 # store a copy of the packet in the packet info
1963 info.data = p.copy()
1964 # append the packet to the list
1965 packets.append(p)
1966 # return the created packet list
1967 return packets
1968
1969 def verify_capture(self, src_if, dst_if, capture):
1970 packet_info = None
1971 for packet in capture:
1972 try:
1973 ip = packet[IP]
1974 udp = packet[UDP]
1975 # convert the payload to packet info object
1976 payload_info = self.payload_to_info(packet)
1977 # make sure the indexes match
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001978 self.assert_equal(
1979 payload_info.src, src_if.sw_if_index, "source sw_if_index"
1980 )
1981 self.assert_equal(
1982 payload_info.dst, dst_if.sw_if_index, "destination sw_if_index"
1983 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001984 packet_info = self.get_next_packet_info_for_interface2(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001985 src_if.sw_if_index, dst_if.sw_if_index, packet_info
1986 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001987 # make sure we didn't run out of saved packets
1988 self.assertIsNotNone(packet_info)
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001989 self.assert_equal(
1990 payload_info.index, packet_info.index, "packet info index"
1991 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001992 saved_packet = packet_info.data # fetch the saved packet
1993 # assert the values match
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001994 self.assert_equal(ip.src, saved_packet[IP].src, "IP source address")
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001995 # ... more assertions here
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001996 self.assert_equal(udp.sport, saved_packet[UDP].sport, "UDP source port")
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001997 except Exception as e:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02001998 self.logger.error(ppp("Unexpected or invalid packet:", packet))
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00001999 raise
2000 remaining_packet = self.get_next_packet_info_for_interface2(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002001 src_if.sw_if_index, dst_if.sw_if_index, packet_info
2002 )
2003 self.assertIsNone(
2004 remaining_packet,
2005 "Interface %s: Packet expected from interface "
2006 "%s didn't arrive" % (dst_if.name, src_if.name),
2007 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002008
2009 def verify_policy_match(self, pkt_count, spdEntry):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002010 self.logger.info("XXXX %s %s", str(spdEntry), str(spdEntry.get_stats()))
2011 matched_pkts = spdEntry.get_stats().get("packets")
2012 self.logger.info("Policy %s matched: %d pkts", str(spdEntry), matched_pkts)
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002013 self.assert_equal(pkt_count, matched_pkts)
2014
Zachary Leaf26fec712021-10-26 10:05:58 -05002015
2016class SpdFlowCacheTemplate(IPSecIPv4Fwd):
2017 @classmethod
2018 def setUpConstants(cls):
2019 super(SpdFlowCacheTemplate, cls).setUpConstants()
2020 # Override this method with required cmdline parameters e.g.
2021 # cls.vpp_cmdline.extend(["ipsec", "{",
2022 # "ipv4-outbound-spd-flow-cache on",
2023 # "}"])
2024 # cls.logger.info("VPP modified cmdline is %s" % " "
2025 # .join(cls.vpp_cmdline))
2026
2027 def setUp(self):
2028 super(SpdFlowCacheTemplate, self).setUp()
2029
2030 def tearDown(self):
2031 super(SpdFlowCacheTemplate, self).tearDown()
2032
Zachary Leaf7cd35f52021-06-25 08:11:15 -05002033 def get_spd_flow_cache_entries(self, outbound):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002034 """'show ipsec spd' output:
Zachary Leaf7cd35f52021-06-25 08:11:15 -05002035 ipv4-inbound-spd-flow-cache-entries: 0
2036 ipv4-outbound-spd-flow-cache-entries: 0
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002037 """
2038 show_ipsec_reply = self.vapi.cli("show ipsec spd")
2039 # match the relevant section of 'show ipsec spd' output
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002040 if outbound:
Zachary Leaf7cd35f52021-06-25 08:11:15 -05002041 regex_match = re.search(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002042 "ipv4-outbound-spd-flow-cache-entries: (.*)",
2043 show_ipsec_reply,
2044 re.DOTALL,
2045 )
Zachary Leaf7cd35f52021-06-25 08:11:15 -05002046 else:
2047 regex_match = re.search(
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002048 "ipv4-inbound-spd-flow-cache-entries: (.*)", show_ipsec_reply, re.DOTALL
2049 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002050 if regex_match is None:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002051 raise Exception(
2052 "Unable to find spd flow cache entries \
2053 in 'show ipsec spd' CLI output - regex failed to match"
2054 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002055 else:
2056 try:
2057 num_entries = int(regex_match.group(1))
2058 except ValueError:
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002059 raise Exception(
2060 "Unable to get spd flow cache entries \
2061 from 'show ipsec spd' string: %s",
2062 regex_match.group(0),
2063 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002064 self.logger.info("%s", regex_match.group(0))
2065 return num_entries
2066
2067 def verify_num_outbound_flow_cache_entries(self, expected_elements):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002068 self.assertEqual(
2069 self.get_spd_flow_cache_entries(outbound=True), expected_elements
2070 )
Zachary Leaf7cd35f52021-06-25 08:11:15 -05002071
2072 def verify_num_inbound_flow_cache_entries(self, expected_elements):
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002073 self.assertEqual(
2074 self.get_spd_flow_cache_entries(outbound=False), expected_elements
2075 )
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002076
2077 def crc32_supported(self):
2078 # lscpu is part of util-linux package, available on all Linux Distros
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002079 stream = os.popen("lscpu")
Govindarajan Mohandoss6d7dfcb2021-03-19 19:20:49 +00002080 cpu_info = stream.read()
2081 # feature/flag "crc32" on Aarch64 and "sse4_2" on x86
2082 # see vppinfra/crc32.h
2083 if "crc32" or "sse4_2" in cpu_info:
2084 self.logger.info("\ncrc32 supported:\n" + cpu_info)
2085 return True
2086 else:
2087 self.logger.info("\ncrc32 NOT supported:\n" + cpu_info)
2088 return False
2089
Klement Sekerad9b0c6f2022-04-26 19:02:15 +02002090
2091if __name__ == "__main__":
Klement Sekera31da2e32018-06-24 22:49:55 +02002092 unittest.main(testRunner=VppTestRunner)