IPSEC: tunnel rekey fix and test (VPP-1652)

Change-Id: I1c2b3e40c689bedcdcea7887792b6b6b6aeb48d5
Signed-off-by: Neale Ranns <nranns@cisco.com>

2 files changed, 81 insertions, 21 deletions

diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index f7cd95873db..8d0eef21ae0 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -230,6 +230,21 @@ ipsec_tun_mk_output_sa_id (u32 ti)
   return (0xc0000000 | ti);
 }
 
+static void
+ipsec_tunnel_feature_set (ipsec_tunnel_if_t * t, u8 enable)
+{
+  vnet_feature_enable_disable ("ip4-output",
+			       "esp4-encrypt-tun",
+			       t->sw_if_index, enable,
+			       &t->output_sa_index,
+			       sizeof (t->output_sa_index));
+  vnet_feature_enable_disable ("ip6-output",
+			       "esp6-encrypt-tun",
+			       t->sw_if_index, enable,
+			       &t->output_sa_index,
+			       sizeof (t->output_sa_index));
+}
+
 int
 ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 				  ipsec_add_del_tunnel_args_t * args,
@@ -362,16 +377,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 			       ~0);
       im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance;
 
-      vnet_feature_enable_disable ("ip4-output",
-				   "esp4-encrypt-tun",
-				   t->sw_if_index, 1,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
-      vnet_feature_enable_disable ("ip6-output",
-				   "esp6-encrypt-tun",
-				   t->sw_if_index, 1,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
+      ipsec_tunnel_feature_set (t, 1);
 
       /*1st interface, register protocol */
       if (pool_elts (im->tunnel_interfaces) == 1)
@@ -396,16 +402,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
       hi = vnet_get_hw_interface (vnm, t->hw_if_index);
       vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0);	/* admin down */
 
-      vnet_feature_enable_disable ("ip4-output",
-				   "esp4-encrypt-tun",
-				   hi->sw_if_index, 0,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
-      vnet_feature_enable_disable ("ip6-output",
-				   "esp6-encrypt-tun",
-				   hi->sw_if_index, 0,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
+      ipsec_tunnel_feature_set (t, 0);
       vnet_delete_hw_interface (vnm, t->hw_if_index);
 
       if (is_ip6)
@@ -649,7 +646,13 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
 	  return VNET_API_ERROR_INVALID_VALUE;
 	}
 
+      /*
+       * re-enable the feature to get the new SA in
+       * the workers are stopped so no packets are sent in the clear
+       */
+      ipsec_tunnel_feature_set (t, 0);
       t->output_sa_index = sa_index;
+      ipsec_tunnel_feature_set (t, 1);
     }
 
   /* remove sa_id to sa_index mapping on old SA */
@@ -661,7 +664,7 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
       clib_warning ("IPsec backend add/del callback returned error");
       return VNET_API_ERROR_SYSCALL_ERROR_1;
     }
-  pool_put (im->sad, old_sa);
+  ipsec_sa_del (old_sa->id);
 
   return 0;
 }
diff --git a/test/test_ipsec_tun_if_esp.py b/test/test_ipsec_tun_if_esp.py
index 018e00bc25e..8f1bd7cb14f 100644
--- a/test/test_ipsec_tun_if_esp.py
+++ b/test/test_ipsec_tun_if_esp.py
@@ -243,6 +243,55 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4):
     def tearDown(self):
         super(TestIpsec4TunIfEspAll, self).tearDown()
 
+    def rekey(self, p):
+        #
+        # change the key and the SPI
+        #
+        p.crypt_key = 'X' + p.crypt_key[1:]
+        p.scapy_tun_spi += 1
+        p.scapy_tun_sa_id += 1
+        p.vpp_tun_spi += 1
+        p.vpp_tun_sa_id += 1
+        p.tun_if.local_spi = p.vpp_tun_spi
+        p.tun_if.remote_spi = p.scapy_tun_spi
+
+        config_tun_params(p, self.encryption_type, self.tun_if)
+
+        p.tun_sa_in = VppIpsecSA(self,
+                                 p.scapy_tun_sa_id,
+                                 p.scapy_tun_spi,
+                                 p.auth_algo_vpp_id,
+                                 p.auth_key,
+                                 p.crypt_algo_vpp_id,
+                                 p.crypt_key,
+                                 self.vpp_esp_protocol,
+                                 self.tun_if.local_addr[p.addr_type],
+                                 self.tun_if.remote_addr[p.addr_type],
+                                 flags=p.flags,
+                                 salt=p.salt)
+        p.tun_sa_out = VppIpsecSA(self,
+                                  p.vpp_tun_sa_id,
+                                  p.vpp_tun_spi,
+                                  p.auth_algo_vpp_id,
+                                  p.auth_key,
+                                  p.crypt_algo_vpp_id,
+                                  p.crypt_key,
+                                  self.vpp_esp_protocol,
+                                  self.tun_if.remote_addr[p.addr_type],
+                                  self.tun_if.local_addr[p.addr_type],
+                                  flags=p.flags,
+                                  salt=p.salt)
+        p.tun_sa_in.add_vpp_config()
+        p.tun_sa_out.add_vpp_config()
+
+        self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index,
+                                         sa_id=p.tun_sa_in.id,
+                                         is_outbound=1)
+        self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index,
+                                         sa_id=p.tun_sa_out.id,
+                                         is_outbound=0)
+        self.logger.info(self.vapi.cli("sh ipsec sa"))
+
     def test_tun_44(self):
         """IPSEC tunnel all algos """
 
@@ -324,7 +373,15 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4):
                 c = p.tun_if.get_tx_stats()
                 self.assertEqual(c['packets'], 127)
 
+                #
+                # rekey the tunnel
+                #
+                self.rekey(p)
+                self.verify_tun_44(p, count=127)
+
                 self.unconfig_network(p)
+                p.tun_sa_out.remove_vpp_config()
+                p.tun_sa_in.remove_vpp_config()
 
 
 class TestIpsec6MultiTunIfEsp(TemplateIpsec, IpsecTun6):