diff options
| author |   Neale Ranns <neale@graphiant.com> | 2022-01-10 10:38:43 +0000 |
|---|---|---|
| committer |   Matthew Smith <mgsmith@netgate.com> | 2022-01-17 19:55:13 +0000 |
| commit | 49378f206b8e780a898e632f7dd8db912b9b118e (patch) | |
| tree | 35c6629f14b753878251fe92d5afcdd9c837554b /test/test_ipsec_tun_if_esp.py | |
| parent | 88a9c0e02ab919cadd4e035133995a6afb4d1c32 (diff) | |
ipsec: IPSec interface correct drop w/ no protection
Type: improvement
When an IPSec interface is first constructed, the end node of the feature arc is not changed, which means it is interface-output.
This means that traffic directed into adjacencies on the link, that do not have protection (w/ an SA), drop like this:
...
00:00:01:111710: ip4-midchain
tx_sw_if_index 4 dpo-idx 24 : ipv4 via 0.0.0.0 ipsec0: mtu:9000 next:6 flags:[]
stacked-on:
[@1]: dpo-drop ip4 flow hash: 0x00000000
00000000: 4500005c000100003f01cb8cac100202010101010800ecf40000000058585858
00000020: 58585858585858585858585858585858585858585858585858585858
00:00:01:111829: local0-output
ipsec0
00000000: 4500005c000100003f01cb8cac100202010101010800ecf40000000058585858
00000020: 5858585858585858585858585858585858585858585858585858585858585858
00000040: 58585858585858585858585858585858585858585858585858585858c2cf08c0
00000060: 2a2c103cd0126bd8b03c4ec20ce2bd02dd77b3e3a4f49664
00:00:01:112017: error-drop
rx:pg1
00:00:01:112034: drop
local0-output: interface is down
although that's a drop, no packets should go to local0, and we want all IPvX packets to go through ipX-drop.
This change sets the interface's end-arc node to the appropriate drop node when the interface is created, and when the last protection is removed.
The resulting drop is:
...
00:00:01:111504: ip4-midchain
tx_sw_if_index 4 dpo-idx 24 : ipv4 via 0.0.0.0 ipsec0: mtu:9000 next:0 flags:[]
stacked-on:
[@1]: dpo-drop ip4 flow hash: 0x00000000
00000000: 4500005c000100003f01cb8cac100202010101010800ecf40000000058585858
00000020: 58585858585858585858585858585858585858585858585858585858
00:00:01:111533: ip4-drop
ICMP: 172.16.2.2 -> 1.1.1.1
tos 0x00, ttl 63, length 92, checksum 0xcb8c dscp CS0 ecn NON_ECN
fragment id 0x0001
ICMP echo_request checksum 0xecf4 id 0
00:00:01:111620: error-drop
rx:pg1
00:00:01:111640: drop
null-node: blackholed packets
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I7e7de23c541d9f1210a05e6984a688f1f821a155
Diffstat (limited to 'test/test_ipsec_tun_if_esp.py')
| -rw-r--r-- | test/test_ipsec_tun_if_esp.py | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/test/test_ipsec_tun_if_esp.py b/test/test_ipsec_tun_if_esp.py index 6865c9050a9..8b6f619b47f 100644 --- a/test/test_ipsec_tun_if_esp.py +++ b/test/test_ipsec_tun_if_esp.py @@ -2345,7 +2345,7 @@ class TestIpsec6TunProtect(TemplateIpsec, p.tun_protect.update_vpp_config(np3.tun_sa_out, [np3.tun_sa_in]) self.verify_tun_66(np3, np3, count=127) - self.verify_drop_tun_66(np, count=127) + self.verify_drop_tun_rx_66(np, count=127) self.assertEqual(p.tun_if.get_rx_stats(), 127*9) self.assertEqual(p.tun_if.get_tx_stats(), 127*8) @@ -2621,6 +2621,10 @@ class TestIpsecItf4(TemplateIpsec, p = self.ipv4_params self.config_network(p) + config_tun_params(p, self.encryption_type, None, + self.pg0.local_ip4, + self.pg0.remote_ip4) + self.verify_tun_dropped_44(p, count=n_pkts) self.config_sa_tun(p, self.pg0.local_ip4, self.pg0.remote_ip4) @@ -2693,7 +2697,7 @@ class TestIpsecItf4(TemplateIpsec, self.pg0.remote_ip4) self.config_protect(p) - self.logger.error(self.vapi.cli("sh ipsec sa")) + self.logger.info(self.vapi.cli("sh ipsec sa")) self.verify_tun_44(p, count=n_pkts) # teardown @@ -2912,7 +2916,7 @@ class TestIpsecItf6(TemplateIpsec, def tearDown(self): super(TestIpsecItf6, self).tearDown() - def test_tun_44(self): + def test_tun_66(self): """IPSEC interface IPv6""" tf = VppEnum.vl_api_tunnel_encap_decap_flags_t @@ -2924,6 +2928,10 @@ class TestIpsecItf6(TemplateIpsec, p.tun_flags = tf.TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_HOP_LIMIT self.config_network(p) + config_tun_params(p, self.encryption_type, None, + self.pg0.local_ip6, + self.pg0.remote_ip6) + self.verify_drop_tun_66(p, count=n_pkts) self.config_sa_tun(p, self.pg0.local_ip6, self.pg0.remote_ip6) |