IPsec Multi-Tunnel performance test suite

Change-Id: I4b0ba83960e50089f29cab9a30ab760241c6f566
Signed-off-by: Kirill Rybalchenko <kirill.rybalchenko@intel.com>

1 files changed, 321 insertions, 10 deletions

diff --git a/resources/libraries/python/IPsecUtil.py b/resources/libraries/python/IPsecUtil.py
index 5a4a181fd0..a554a54bb4 100644
--- a/resources/libraries/python/IPsecUtil.py
+++ b/resources/libraries/python/IPsecUtil.py
@@ -13,7 +13,8 @@
 
 """IPsec utilities library."""
 
-from ipaddress import ip_network
+import os
+from ipaddress import ip_network, ip_address
 
 from enum import Enum
 
@@ -37,6 +38,7 @@ class CryptoAlg(Enum):
     AES_CBC_128 = ('aes-cbc-128', 'AES-CBC', 16)
     AES_CBC_192 = ('aes-cbc-192', 'AES-CBC', 24)
     AES_CBC_256 = ('aes-cbc-256', 'AES-CBC', 32)
+    AES_GCM_128 = ('aes-gcm-128', 'AES-GCM', 20)
 
     def __init__(self, alg_name, scapy_name, key_len):
         self.alg_name = alg_name
@@ -50,6 +52,7 @@ class IntegAlg(Enum):
     SHA_256_128 = ('sha-256-128', 'SHA2-256-128', 32)
     SHA_384_192 = ('sha-384-192', 'SHA2-384-192', 48)
     SHA_512_256 = ('sha-512-256', 'SHA2-512-256', 64)
+    AES_GCM_128 = ('aes-gcm-128', 'AES-GCM', 20)
 
     def __init__(self, alg_name, scapy_name, key_len):
         self.alg_name = alg_name
@@ -115,6 +118,15 @@ class IPsecUtil(object):
         return CryptoAlg.AES_CBC_256
 
     @staticmethod
+    def crypto_alg_aes_gcm_128():
+        """Return encryption algorithm aes-gcm-128.
+
+        :returns: CryptoAlg enum AES_GCM_128 object.
+        :rtype: CryptoAlg
+        """
+        return CryptoAlg.AES_GCM_128
+
+    @staticmethod
     def get_crypto_alg_key_len(crypto_alg):
         """Return encryption algorithm key length.
 
@@ -173,6 +185,15 @@ class IPsecUtil(object):
         return IntegAlg.SHA_512_256
 
     @staticmethod
+    def integ_alg_aes_gcm_128():
+        """Return integrity algorithm AES-GCM-128.
+
+        :returns: IntegAlg enum AES_GCM_128 object.
+        :rtype: IntegAlg
+        """
+        return IntegAlg.AES_GCM_128
+
+    @staticmethod
     def get_integ_alg_key_len(integ_alg):
         """Return integrity algorithm key length.
 
@@ -208,9 +229,9 @@ class IPsecUtil(object):
         :param integ_alg: The integrity algorithm name.
         :param integ_key: The integrity key string.
         :param tunnel_src: Tunnel header source IPv4 or IPv6 address. If not
-            specified ESP transport mode is used.
+        specified ESP transport mode is used.
         :param tunnel_dst: Tunnel header destination IPv4 or IPv6 address. If
-            not specified ESP transport mode is used.
+        not specified ESP transport mode is used.
         :type node: dict
         :type sad_id: int
         :type spi: int
@@ -237,6 +258,57 @@ class IPsecUtil(object):
             err_msg='Add SAD entry failed on {0}'.format(node['host']))
 
     @staticmethod
+    def vpp_ipsec_add_sad_entries(node, n_entries, sad_id, spi, crypto_alg,
+                                  crypto_key, integ_alg, integ_key,
+                                  tunnel_src=None, tunnel_dst=None):
+        """Create multiple Security Association Database entries on VPP node.
+
+        :param node: VPP node to add SAD entry on.
+        :param n_entries: Number of SAD entries to be created.
+        :param sad_id: First SAD entry ID. All subsequent SAD entries will have
+        id incremented by 1.
+        :param spi: Security Parameter Index of first SAD entry. All subsequent
+        SAD entries will have spi incremented by 1.
+        :param crypto_alg: The encryption algorithm name.
+        :param crypto_key: The encryption key string.
+        :param integ_alg: The integrity algorithm name.
+        :param integ_key: The integrity key string.
+        :param tunnel_src: Tunnel header source IPv4 or IPv6 address. If not
+        specified ESP transport mode is used.
+        :param tunnel_dst: Tunnel header destination IPv4 or IPv6 address. If
+        not specified ESP transport mode is used.
+        :type node: dict
+        :type n_entries: int
+        :type sad_id: int
+        :type spi: int
+        :type crypto_alg: CryptoAlg
+        :type crypto_key: str
+        :type integ_alg: IntegAlg
+        :type integ_key: str
+        :type tunnel_src: str
+        :type tunnel_dst: str
+        """
+        tmp_filename = '/tmp/ipsec_sad_{}_add_del_entry.vat'.format(sad_id)
+        ckey = crypto_key.encode('hex')
+        ikey = integ_key.encode('hex')
+        tunnel = 'tunnel_src {0} tunnel_dst {1}'.format(tunnel_src, tunnel_dst)\
+            if tunnel_src is not None and tunnel_dst is not None else ''
+
+        integ = 'integ_alg {0} integ_key {1}'.format(integ_alg.alg_name, ikey)\
+            if crypto_alg.alg_name != 'aes-gcm-128' else ''
+
+        with open(tmp_filename, 'w') as tmp_file:
+            for i in range(0, n_entries):
+                buf_str = 'ipsec_sad_add_del_entry esp sad_id {0} spi {1} ' \
+                          'crypto_alg {2} crypto_key {3} {4} {5}\n'.format(
+                              sad_id+i, spi+i, crypto_alg.alg_name, ckey, integ,
+                              tunnel)
+                tmp_file.write(buf_str)
+        vat = VatExecutor()
+        vat.scp_and_execute_script(tmp_filename, node, 300)
+        os.remove(tmp_filename)
+
+    @staticmethod
     def vpp_ipsec_sa_set_key(node, sa_id, crypto_key, integ_key):
         """Update Security Association (SA) keys.
 
@@ -308,19 +380,19 @@ class IPsecUtil(object):
         :param priority: SPD entry priority, higher number = higher priority.
         :param action: Policy action.
         :param inbound: If True policy is for inbound traffic, otherwise
-            outbound.
+        outbound.
         :param sa_id: SAD entry ID for protect action.
         :param laddr_range: Policy selector local IPv4 or IPv6 address range in
-            format IP/prefix or IP/mask. If no mask is provided, it's considered
-            to be /32.
+        format IP/prefix or IP/mask. If no mask is provided, it's considered
+        to be /32.
         :param raddr_range: Policy selector remote IPv4 or IPv6 address range in
-            format IP/prefix or IP/mask. If no mask is provided, it's considered
-            to be /32.
+        format IP/prefix or IP/mask. If no mask is provided, it's considered
+        to be /32.
         :param proto: Policy selector next layer protocol number.
         :param lport_range: Policy selector local TCP/UDP port range in format
-            <port_start>-<port_end>.
+        <port_start>-<port_end>.
         :param rport_range: Policy selector remote TCP/UDP port range in format
-            <port_start>-<port_end>.
+        <port_start>-<port_end>.
         :type node: dict
         :type spd_id: int
         :type priority: int
@@ -368,6 +440,245 @@ class IPsecUtil(object):
                                                                 node['host']))
 
     @staticmethod
+    def vpp_ipsec_spd_add_entries(node, n_entries, spd_id, priority, inbound,
+                                  sa_id, raddr_ip, raddr_range):
+        """Create multiple Security Policy Database entries on the VPP node.
+
+        :param node: VPP node to add SPD entries on.
+        :param n_entries: Number of SPD entries to be added.
+        :param spd_id: SPD ID to add entries on.
+        :param priority: SPD entries priority, higher number = higher priority.
+        :param inbound: If True policy is for inbound traffic, otherwise
+        outbound.
+        :param sa_id: SAD entry ID for first entry. Each subsequent entry will
+        SAD entry ID incremented by 1.
+        :param raddr_ip: Policy selector remote IPv4 start address for the first
+        entry. Remote IPv4 end address will be calculated depending on
+        raddr_range parameter. Each subsequent entry will have start address
+        next after IPv4 end address of previous entry.
+        :param raddr_range: Mask specifying range of Policy selector Remote IPv4
+        addresses. Valid values are from 1 to 32.
+        :type node: dict
+        :type n_entries: int
+        :type spd_id: int
+        :type priority: int
+        :type inbound: bool
+        :type sa_id: int
+        :type raddr_ip: string
+        :type raddr_range: int
+        """
+        tmp_filename = '/tmp/ipsec_spd_{}_add_del_entry.vat'.format(sa_id)
+        direction = 'inbound' if inbound else 'outbound'
+        addr_incr = 1 << (32 - raddr_range)
+        addr_ip = int(ip_address(unicode(raddr_ip)))
+        start_str = 'ipsec_spd_add_del_entry spd_id {0} priority {1} {2} ' \
+                    'action protect sa_id'.format(spd_id, priority, direction)
+        with open(tmp_filename, 'w') as tmp_file:
+            for i in range(0, n_entries):
+                r_ip_s = ip_address(addr_ip + addr_incr * i)
+                r_ip_e = ip_address(addr_ip + addr_incr * (i+1) - 1)
+                buf_str = '{0} {1} raddr_start {2} raddr_stop {3}\n'.format(
+                    start_str, sa_id+i, r_ip_s, r_ip_e)
+                tmp_file.write(buf_str)
+        vat = VatExecutor()
+        vat.scp_and_execute_script(tmp_filename, node, 300)
+        os.remove(tmp_filename)
+
+    @staticmethod
+    def vpp_ipsec_create_tunnel_interfaces(node1, node2, if1_ip_addr,
+                                           if2_ip_addr, n_tunnels, crypto_alg,
+                                           crypto_key, integ_alg, integ_key,
+                                           raddr_ip1, raddr_ip2, raddr_range):
+        """Create multiple IPsec tunnel interfaces between two VPP nodes.
+
+        :param node1: VPP node 1 to create tunnel interfaces.
+        :param node2: VPP node 2 to create tunnel interfaces.
+        :param if1_ip_addr: VPP node 1 interface IP4 address.
+        :param if2_ip_addr: VPP node 2 interface IP4 address.
+        :param n_tunnels: Number of tunnell interfaces to create.
+        :param crypto_alg: The encryption algorithm name.
+        :param crypto_key: The encryption key string.
+        :param integ_alg: The integrity algorithm name.
+        :param integ_key: The integrity key string.
+        :param raddr_ip1: Policy selector remote IPv4 start address for the
+        first tunnel in direction node1->node2.
+        :param raddr_ip2: Policy selector remote IPv4 start address for the
+        first tunnel in direction node2->node1.
+        :param raddr_range: Mask specifying range of Policy selector Remote IPv4
+        addresses. Valid values are from 1 to 32.
+        :type node1: dict
+        :type node2: dict
+        :type if1_ip_addr: str
+        :type if2_ip_addr: str
+        :type n_tunnels: int
+        :type crypto_alg: CryptoAlg
+        :type crypto_key: str
+        :type integ_alg: IntegAlg
+        :type integ_key: str
+        :type raddr_ip1: string
+        :type raddr_ip2: string
+        :type raddr_range: int
+        """
+
+        spi_1 = 10000
+        spi_2 = 20000
+
+        raddr_ip1_i = int(ip_address(unicode(raddr_ip1)))
+        raddr_ip2_i = int(ip_address(unicode(raddr_ip2)))
+        addr_incr = 1 << (32 - raddr_range)
+
+        tmp_fn1 = '/tmp/ipsec_create_tunnel_dut1.config'
+        tmp_fn2 = '/tmp/ipsec_create_tunnel_dut2.config'
+
+        ckey = crypto_key.encode('hex')
+        ikey = integ_key.encode('hex')
+
+        with open(tmp_fn1, 'w') as tmp_f1, open(tmp_fn2, 'w') as tmp_f2:
+            for i in range(0, n_tunnels):
+                if_s = 'ipsec{}'.format(i)
+                dut1_tunnel_s = 'create ipsec tunnel local-ip {0} local-spi ' \
+                                '{1} remote-ip {2} remote-spi {3}\n'.format(
+                                    if1_ip_addr, spi_1+i, if2_ip_addr, spi_2+i)
+                tmp_f1.write(dut1_tunnel_s)
+                dut2_tunnel_s = 'create ipsec tunnel local-ip {0} local-spi ' \
+                                '{1} remote-ip {2} remote-spi {3}\n'.format(
+                                    if2_ip_addr, spi_2+i, if1_ip_addr, spi_1+i)
+                tmp_f2.write(dut2_tunnel_s)
+                loc_c_key = 'set interface ipsec key {0} local crypto {1} ' \
+                            '{2}\n'.format(if_s, crypto_alg.alg_name, ckey)
+                tmp_f1.write(loc_c_key)
+                tmp_f2.write(loc_c_key)
+                rem_c_key = 'set interface ipsec key {0} remote crypto {1} ' \
+                            '{2}\n'.format(if_s, crypto_alg.alg_name, ckey)
+                tmp_f1.write(rem_c_key)
+                tmp_f2.write(rem_c_key)
+                if crypto_alg.alg_name != 'aes-gcm-128':
+                    loc_i_key = 'set interface ipsec key {0} local integ {1} ' \
+                                '{2}\n'.format(if_s, integ_alg.alg_name, ikey)
+                    tmp_f1.write(loc_i_key)
+                    tmp_f2.write(loc_i_key)
+                    rem_i_key = 'set interface ipsec key {0} remote integ {1}' \
+                                ' {2}\n'.format(if_s, integ_alg.alg_name, ikey)
+                    tmp_f1.write(rem_i_key)
+                    tmp_f2.write(rem_i_key)
+                raddr_ip1_s = ip_address(raddr_ip1_i + addr_incr*i)
+                raddr_ip2_s = ip_address(raddr_ip2_i + addr_incr*i)
+                dut1_rte_s = 'ip route add {0}/{1} via {2} {3}\n'.format(
+                    raddr_ip2_s, raddr_range, if2_ip_addr, if_s)
+                tmp_f1.write(dut1_rte_s)
+                dut2_rte_s = 'ip route add {0}/{1} via {2} {3}\n'.format(
+                    raddr_ip1_s, raddr_range, if1_ip_addr, if_s)
+                tmp_f2.write(dut2_rte_s)
+                up_s = 'set int state {0} up\n'.format(if_s)
+                tmp_f1.write(up_s)
+                tmp_f2.write(up_s)
+
+        vat = VatExecutor()
+        vat.scp_and_execute_cli_script(tmp_fn1, node1, 300)
+        vat.scp_and_execute_cli_script(tmp_fn2, node2, 300)
+        os.remove(tmp_fn1)
+        os.remove(tmp_fn2)
+
+    @staticmethod
+    def vpp_ipsec_add_multiple_tunnels(node1, node2, interface1, interface2,
+                                       n_tunnels, crypto_alg, crypto_key,
+                                       integ_alg, integ_key, tunnel_ip1,
+                                       tunnel_ip2, raddr_ip1, raddr_ip2,
+                                       raddr_range):
+        """Create multiple IPsec tunnels between two VPP nodes.
+
+        :param node1: VPP node 1 to create tunnels.
+        :param node2: VPP node 2 to create tunnels.
+        :param interface1: Interface name or sw_if_index on node 1.
+        :param interface2: Interface name or sw_if_index on node 2.
+        :param n_tunnels: Number of tunnels to create.
+        :param crypto_alg: The encryption algorithm name.
+        :param crypto_key: The encryption key string.
+        :param integ_alg: The integrity algorithm name.
+        :param integ_key: The integrity key string.
+        :param tunnel_ip1: Tunnel node1 IPv4 address.
+        :param tunnel_ip2: Tunnel node2 IPv4 address.
+        :param raddr_ip1: Policy selector remote IPv4 start address for the
+        first tunnel in direction node1->node2.
+        :param raddr_ip2: Policy selector remote IPv4 start address for the
+        first tunnel in direction node2->node1.
+        :param raddr_range: Mask specifying range of Policy selector Remote IPv4
+        addresses. Valid values are from 1 to 32.
+        :type node1: dict
+        :type node2: dict
+        :type interface1: str or int
+        :type interface2: str or int
+        :type n_tunnels: int
+        :type crypto_alg: CryptoAlg
+        :type crypto_key: str
+        :type integ_alg: str
+        :type integ_key: str
+        :type tunnel_ip1: str
+        :type tunnel_ip2: str
+        :type raddr_ip1: string
+        :type raddr_ip2: string
+        :type raddr_range: int
+        """
+        spd_id = 1
+        p_hi = 100
+        p_lo = 10
+        sa_id_1 = 10000
+        sa_id_2 = 20000
+        spi_1 = 30000
+        spi_2 = 40000
+        proto = 50
+
+        IPsecUtil.vpp_ipsec_add_spd(node1, spd_id)
+        IPsecUtil.vpp_ipsec_spd_add_if(node1, spd_id, interface1)
+        IPsecUtil.vpp_ipsec_spd_add_entry(node1, spd_id, p_hi,
+                                          PolicyAction.BYPASS, inbound=False,
+                                          proto=proto)
+        IPsecUtil.vpp_ipsec_spd_add_entry(node1, spd_id, p_hi,
+                                          PolicyAction.BYPASS, inbound=True,
+                                          proto=proto)
+
+        IPsecUtil.vpp_ipsec_add_spd(node2, spd_id)
+        IPsecUtil.vpp_ipsec_spd_add_if(node2, spd_id, interface2)
+        IPsecUtil.vpp_ipsec_spd_add_entry(node2, spd_id, p_hi,
+                                          PolicyAction.BYPASS, inbound=False,
+                                          proto=proto)
+        IPsecUtil.vpp_ipsec_spd_add_entry(node2, spd_id, p_hi,
+                                          PolicyAction.BYPASS, inbound=True,
+                                          proto=proto)
+
+        IPsecUtil.vpp_ipsec_add_sad_entries(node1, n_tunnels, sa_id_1, spi_1,
+                                            crypto_alg, crypto_key, integ_alg,
+                                            integ_key, tunnel_ip1, tunnel_ip2)
+
+        IPsecUtil.vpp_ipsec_spd_add_entries(node1, n_tunnels, spd_id, p_lo,
+                                            False, sa_id_1, raddr_ip2,
+                                            raddr_range)
+
+        IPsecUtil.vpp_ipsec_add_sad_entries(node2, n_tunnels, sa_id_1, spi_1,
+                                            crypto_alg, crypto_key, integ_alg,
+                                            integ_key, tunnel_ip1, tunnel_ip2)
+
+        IPsecUtil.vpp_ipsec_spd_add_entries(node2, n_tunnels, spd_id, p_lo,
+                                            True, sa_id_1, raddr_ip2,
+                                            raddr_range)
+
+        IPsecUtil.vpp_ipsec_add_sad_entries(node2, n_tunnels, sa_id_2, spi_2,
+                                            crypto_alg, crypto_key, integ_alg,
+                                            integ_key, tunnel_ip2, tunnel_ip1)
+
+        IPsecUtil.vpp_ipsec_spd_add_entries(node2, n_tunnels, spd_id, p_lo,
+                                            False, sa_id_2, raddr_ip1,
+                                            raddr_range)
+
+        IPsecUtil.vpp_ipsec_add_sad_entries(node1, n_tunnels, sa_id_2, spi_2,
+                                            crypto_alg, crypto_key, integ_alg,
+                                            integ_key, tunnel_ip2, tunnel_ip1)
+
+        IPsecUtil.vpp_ipsec_spd_add_entries(node1, n_tunnels, spd_id, p_lo,
+                                            True, sa_id_2, raddr_ip1,
+                                            raddr_range)
+
+    @staticmethod
     def vpp_ipsec_show(node):
         """Run "show ipsec" debug CLI command.