tests: Add tests for IPSec async mode using the crypto SW scheduler

Type: test

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Iabc8f2b09ee10a82aacebd36acfe8648cf69b7d7

4 files changed, 189 insertions, 107 deletions

diff --git a/test/template_ipsec.py b/test/template_ipsec.py
index 48ac270df72..f7becf0f82a 100644
--- a/test/template_ipsec.py
+++ b/test/template_ipsec.py
@@ -57,6 +57,7 @@ class IPsecIPv4Params:
         self.tun_flags = (VppEnum.vl_api_tunnel_encap_decap_flags_t.
                           TUNNEL_API_ENCAP_DECAP_FLAG_NONE)
         self.dscp = 0
+        self.async_mode = False
 
 
 class IPsecIPv6Params:
@@ -101,6 +102,7 @@ class IPsecIPv6Params:
         self.tun_flags = (VppEnum.vl_api_tunnel_encap_decap_flags_t.
                           TUNNEL_API_ENCAP_DECAP_FLAG_NONE)
         self.dscp = 0
+        self.async_mode = False
 
 
 def mk_scapy_crypt_key(p):
@@ -295,28 +297,46 @@ class IpsecTcpTests(IpsecTcp):
 
 class IpsecTra4(object):
     """ verify methods for Transport v4 """
+    def get_replay_counts(self, p):
+        replay_node_name = ('/err/%s/SA replayed packet' %
+                            self.tra4_decrypt_node_name[0])
+        count = self.statistics.get_err_counter(replay_node_name)
+
+        if p.async_mode:
+            replay_post_node_name = ('/err/%s/SA replayed packet' %
+                                     self.tra4_decrypt_node_name[p.async_mode])
+            count += self.statistics.get_err_counter(replay_post_node_name)
+
+        return count
+
+    def get_hash_failed_counts(self, p):
+        if ESP == self.encryption_type and p.crypt_algo == "AES-GCM":
+            hash_failed_node_name = ('/err/%s/ESP decryption failed' %
+                                     self.tra4_decrypt_node_name[p.async_mode])
+        else:
+            hash_failed_node_name = ('/err/%s/Integrity check failed' %
+                                     self.tra4_decrypt_node_name[p.async_mode])
+        count = self.statistics.get_err_counter(hash_failed_node_name)
+
+        if p.async_mode:
+            count += self.statistics.get_err_counter(
+                '/err/crypto-dispatch/bad-hmac')
+
+        return count
+
     def verify_tra_anti_replay(self):
         p = self.params[socket.AF_INET]
         esn_en = p.vpp_tra_sa.esn_en
 
         seq_cycle_node_name = ('/err/%s/sequence number cycled' %
                                self.tra4_encrypt_node_name)
-        replay_node_name = ('/err/%s/SA replayed packet' %
-                            self.tra4_decrypt_node_name)
-        if ESP == self.encryption_type and p.crypt_algo == "AES-GCM":
-            hash_failed_node_name = ('/err/%s/ESP decryption failed' %
-                                     self.tra4_decrypt_node_name)
-        else:
-            hash_failed_node_name = ('/err/%s/Integrity check failed' %
-                                     self.tra4_decrypt_node_name)
-        replay_count = self.statistics.get_err_counter(replay_node_name)
-        hash_failed_count = self.statistics.get_err_counter(
-            hash_failed_node_name)
+        replay_count = self.get_replay_counts(p)
+        hash_failed_count = self.get_hash_failed_counts(p)
         seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name)
 
         if ESP == self.encryption_type:
             undersize_node_name = ('/err/%s/undersized packet' %
-                                   self.tra4_decrypt_node_name)
+                                   self.tra4_decrypt_node_name[0])
             undersize_count = self.statistics.get_err_counter(
                 undersize_node_name)
 
@@ -340,12 +360,14 @@ class IpsecTra4(object):
         # replayed packets are dropped
         self.send_and_assert_no_replies(self.tra_if, pkts)
         replay_count += len(pkts)
-        self.assert_error_counter_equal(replay_node_name, replay_count)
+        self.assertEqual(self.get_replay_counts(p), replay_count)
 
         #
         # now send a batch of packets all with the same sequence number
         # the first packet in the batch is legitimate, the rest bogus
         #
+        self.vapi.cli("clear error")
+        self.vapi.cli("clear node counters")
         pkts = (Ether(src=self.tra_if.remote_mac,
                       dst=self.tra_if.local_mac) /
                 p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
@@ -355,11 +377,12 @@ class IpsecTra4(object):
         recv_pkts = self.send_and_expect(self.tra_if, pkts * 8,
                                          self.tra_if, n_rx=1)
         replay_count += 7
-        self.assert_error_counter_equal(replay_node_name, replay_count)
+        self.assertEqual(self.get_replay_counts(p), replay_count)
 
         #
         # now move the window over to 257 (more than one byte) and into Case A
         #
+        self.vapi.cli("clear error")
         pkt = (Ether(src=self.tra_if.remote_mac,
                      dst=self.tra_if.local_mac) /
                p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
@@ -371,7 +394,7 @@ class IpsecTra4(object):
         # replayed packets are dropped
         self.send_and_assert_no_replies(self.tra_if, pkt * 3)
         replay_count += 3
-        self.assert_error_counter_equal(replay_node_name, replay_count)
+        self.assertEqual(self.get_replay_counts(p), replay_count)
 
         # the window size is 64 packets
         # in window are still accepted
@@ -399,8 +422,7 @@ class IpsecTra4(object):
         self.send_and_assert_no_replies(self.tra_if, pkt * 17)
 
         hash_failed_count += 17
-        self.assert_error_counter_equal(hash_failed_node_name,
-                                        hash_failed_count)
+        self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
 
         # a malformed 'runt' packet
         #  created by a mis-constructed SA
@@ -445,13 +467,11 @@ class IpsecTra4(object):
             # an out of window error with ESN looks like a high sequence
             # wrap. but since it isn't then the verify will fail.
             hash_failed_count += 17
-            self.assert_error_counter_equal(hash_failed_node_name,
-                                            hash_failed_count)
+            self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
 
         else:
             replay_count += 17
-            self.assert_error_counter_equal(replay_node_name,
-                                            replay_count)
+            self.assertEqual(self.get_replay_counts(p), replay_count)
 
         # valid packet moves the window over to 258
         pkt = (Ether(src=self.tra_if.remote_mac,
@@ -535,8 +555,7 @@ class IpsecTra4(object):
             self.send_and_assert_no_replies(self.tra_if, [pkt], self.tra_if)
 
             hash_failed_count += 1
-            self.assert_error_counter_equal(hash_failed_node_name,
-                                            hash_failed_count)
+            self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count)
 
             #
             # but if we move the wondow forward to case B, then we can wrap
@@ -613,7 +632,7 @@ class IpsecTra4(object):
                          (count, pkts))
 
         self.assert_packet_counter_equal(self.tra4_encrypt_node_name, count)
-        self.assert_packet_counter_equal(self.tra4_decrypt_node_name, count)
+        self.assert_packet_counter_equal(self.tra4_decrypt_node_name[0], count)
 
 
 class IpsecTra4Tests(IpsecTra4):
@@ -667,7 +686,7 @@ class IpsecTra6(object):
                          "incorrect SA out counts: expected %d != %d" %
                          (count, pkts))
         self.assert_packet_counter_equal(self.tra6_encrypt_node_name, count)
-        self.assert_packet_counter_equal(self.tra6_decrypt_node_name, count)
+        self.assert_packet_counter_equal(self.tra6_decrypt_node_name[0], count)
 
     def gen_encrypt_pkts_ext_hdrs6(self, sa, sw_intf, src, dst, count=1,
                                    payload_size=54):
@@ -816,7 +835,7 @@ class IpsecTun4(object):
                              (count, pkts))
 
         self.assert_packet_counter_equal(self.tun4_encrypt_node_name, n_frags)
-        self.assert_packet_counter_equal(self.tun4_decrypt_node_name, count)
+        self.assert_packet_counter_equal(self.tun4_decrypt_node_name[0], count)
 
     def verify_decrypted(self, p, rxs):
         for rx in rxs:
@@ -1034,7 +1053,7 @@ class IpsecTun6(object):
                              "incorrect SA out counts: expected %d != %d" %
                              (count, pkts))
         self.assert_packet_counter_equal(self.tun6_encrypt_node_name, count)
-        self.assert_packet_counter_equal(self.tun6_decrypt_node_name, count)
+        self.assert_packet_counter_equal(self.tun6_decrypt_node_name[0], count)
 
     def verify_decrypted6(self, p, rxs):
         for rx in rxs:
diff --git a/test/test_ipsec_ah.py b/test/test_ipsec_ah.py
index ef6725e6a10..31e0516169f 100644
--- a/test/test_ipsec_ah.py
+++ b/test/test_ipsec_ah.py
@@ -43,13 +43,13 @@ class ConfigIpsecAH(TemplateIpsec):
     encryption_type = AH
     net_objs = []
     tra4_encrypt_node_name = "ah4-encrypt"
-    tra4_decrypt_node_name = "ah4-decrypt"
+    tra4_decrypt_node_name = ["ah4-decrypt", "ah4-decrypt"]
     tra6_encrypt_node_name = "ah6-encrypt"
-    tra6_decrypt_node_name = "ah6-decrypt"
+    tra6_decrypt_node_name = ["ah6-decrypt", "ah6-decrypt"]
     tun4_encrypt_node_name = "ah4-encrypt"
-    tun4_decrypt_node_name = "ah4-decrypt"
+    tun4_decrypt_node_name = ["ah4-decrypt", "ah4-decrypt"]
     tun6_encrypt_node_name = "ah6-encrypt"
-    tun6_decrypt_node_name = "ah6-decrypt"
+    tun6_decrypt_node_name = ["ah6-decrypt", "ah6-decrypt"]
 
     @classmethod
     def setUpClass(cls):
diff --git a/test/test_ipsec_esp.py b/test/test_ipsec_esp.py
index 11d44049aeb..209298a30a4 100644
--- a/test/test_ipsec_esp.py
+++ b/test/test_ipsec_esp.py
@@ -27,13 +27,13 @@ engines_supporting_chain_bufs = ["openssl"]
 class ConfigIpsecESP(TemplateIpsec):
     encryption_type = ESP
     tra4_encrypt_node_name = "esp4-encrypt"
-    tra4_decrypt_node_name = "esp4-decrypt"
+    tra4_decrypt_node_name = ["esp4-decrypt", "esp4-decrypt-post"]
     tra6_encrypt_node_name = "esp6-encrypt"
-    tra6_decrypt_node_name = "esp6-decrypt"
+    tra6_decrypt_node_name = ["esp6-decrypt", "esp6-decrypt-post"]
     tun4_encrypt_node_name = "esp4-encrypt"
-    tun4_decrypt_node_name = "esp4-decrypt"
+    tun4_decrypt_node_name = ["esp4-decrypt", "esp4-decrypt-post"]
     tun6_encrypt_node_name = "esp6-encrypt"
-    tun6_decrypt_node_name = "esp6-decrypt"
+    tun6_decrypt_node_name = ["esp6-decrypt", "esp6-decrypt-post"]
 
     @classmethod
     def setUpClass(cls):
@@ -645,6 +645,14 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
                          IpsecTun4, IpsecTun6):
     """ Ipsec ESP all Algos """
 
+    @classmethod
+    def setUpConstants(cls):
+        test_args = str.split(cls.__doc__, " ")
+        engine = test_args[0]
+        if engine == "async":
+            cls.worker_config = "workers 2"
+        super(RunTestIpsecEspAll, cls).setUpConstants()
+
     def setUp(self):
         super(RunTestIpsecEspAll, self).setUp()
         test_args = str.split(self.__doc__, " ")
@@ -656,6 +664,9 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
             self.flag = params.flags[1]
 
         self.algo = params.algos[test_args[2]]
+        self.async_mode = False
+        if self.engine == "async":
+            self.async_mode = True
 
     def tearDown(self):
         super(RunTestIpsecEspAll, self).tearDown()
@@ -664,10 +675,12 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
         self.run_a_test(self.engine, self.flag, self.algo)
 
     def run_a_test(self, engine, flag, algo, payload_size=None):
-        if engine == "ia32":
-            engine = "native"
-        self.vapi.cli("set crypto handler all %s" % engine)
+        if self.async_mode:
+            self.vapi.cli("set ipsec async mode on")
+        else:
+            self.vapi.cli("set crypto handler all %s" % engine)
 
+        self.logger.info(self.vapi.cli("show crypto async status"))
         self.ipv4_params = IPsecIPv4Params()
         self.ipv6_params = IPsecIPv6Params()
 
@@ -685,6 +698,7 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
             p.salt = algo['salt']
             p.flags = p.flags | flag
             p.outer_flow_label = 243224
+            p.async_mode = self.async_mode
 
         self.reporter.send_keep_alive(self)
 
@@ -747,7 +761,7 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
 # To generate test classes, do:
 #   grep '# GEN' test_ipsec_esp.py | sed -e 's/# GEN //g' | bash
 #
-# GEN for ENG in ia32 ipsecmb openssl; do \
+# GEN for ENG in native ipsecmb openssl; do \
 # GEN   for FLG in noESN ESN; do for ALG in AES-GCM-128/NONE \
 # GEN     AES-GCM-192/NONE AES-GCM-256/NONE AES-CBC-128/MD5-96 \
 # GEN     AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96 \
@@ -760,118 +774,129 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
 # GEN      echo "    def test_ipsec(self):";
 # GEN      echo "        self.run_test()";
 # GEN done; done; done
+#
+# GEN   for FLG in noESN ESN; do for ALG in \
+# GEN     AES-GCM-128/NONE AES-GCM-192/NONE AES-GCM-256/NONE \
+# GEN     AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96; do \
+# GEN      [[ ${FLG} == "ESN" &&  ${ALG} == *"NONE" ]] && continue
+# GEN      echo -e "\n\nclass Test_async_${FLG}_${ALG}(RunTestIpsecEspAll):" |
+# GEN             sed -e 's/-/_/g' -e 's#/#_#g' ; \
+# GEN      echo '    """'async $FLG $ALG IPSec test'"""' ;
+# GEN      echo "    def test_ipsec(self):";
+# GEN      echo "        self.run_test()";
+# GEN done; done;
 
 
-class Test_ia32_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
-    """ia32 noESN AES-GCM-128/NONE IPSec test"""
+class Test_native_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
+    """native noESN AES-GCM-128/NONE IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
-    """ia32 noESN AES-GCM-192/NONE IPSec test"""
+class Test_native_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
+    """native noESN AES-GCM-192/NONE IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
-    """ia32 noESN AES-GCM-256/NONE IPSec test"""
+class Test_native_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
+    """native noESN AES-GCM-256/NONE IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
-    """ia32 noESN AES-CBC-128/MD5-96 IPSec test"""
+class Test_native_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
+    """native noESN AES-CBC-128/MD5-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
-    """ia32 noESN AES-CBC-192/SHA1-96 IPSec test"""
+class Test_native_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
+    """native noESN AES-CBC-192/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
-    """ia32 noESN AES-CBC-256/SHA1-96 IPSec test"""
+class Test_native_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
+    """native noESN AES-CBC-256/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
-    """ia32 noESN 3DES-CBC/SHA1-96 IPSec test"""
+class Test_native_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
+    """native noESN 3DES-CBC/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
-    """ia32 noESN NONE/SHA1-96 IPSec test"""
+class Test_native_noESN_NONE_SHA1_96(RunTestIpsecEspAll):
+    """native noESN NONE/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
-    """ia32 noESN AES-CTR-128/SHA1-96 IPSec test"""
+class Test_native_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
+    """native noESN AES-CTR-128/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
-    """ia32 noESN AES-CTR-192/SHA1-96 IPSec test"""
+class Test_native_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
+    """native noESN AES-CTR-192/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
-    """ia32 noESN AES-CTR-256/SHA1-96 IPSec test"""
+class Test_native_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
+    """native noESN AES-CTR-256/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
-    """ia32 ESN AES-CBC-128/MD5-96 IPSec test"""
+class Test_native_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll):
+    """native ESN AES-CBC-128/MD5-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
-    """ia32 ESN AES-CBC-192/SHA1-96 IPSec test"""
+class Test_native_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
+    """native ESN AES-CBC-192/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
-    """ia32 ESN AES-CBC-256/SHA1-96 IPSec test"""
+class Test_native_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
+    """native ESN AES-CBC-256/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
-    """ia32 ESN 3DES-CBC/SHA1-96 IPSec test"""
+class Test_native_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll):
+    """native ESN 3DES-CBC/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
-    """ia32 ESN NONE/SHA1-96 IPSec test"""
+class Test_native_ESN_NONE_SHA1_96(RunTestIpsecEspAll):
+    """native ESN NONE/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
-    """ia32 ESN AES-CTR-128/SHA1-96 IPSec test"""
+class Test_native_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll):
+    """native ESN AES-CTR-128/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
-    """ia32 ESN AES-CTR-192/SHA1-96 IPSec test"""
+class Test_native_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll):
+    """native ESN AES-CTR-192/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
 
-class Test_ia32_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
-    """ia32 ESN AES-CTR-256/SHA1-96 IPSec test"""
+class Test_native_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
+    """native ESN AES-CTR-256/SHA1-96 IPSec test"""
     def test_ipsec(self):
         self.run_test()
 
@@ -1104,5 +1129,43 @@ class Test_openssl_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll):
         self.run_test()
 
 
-if __name__ == '__main__':
-    unittest.main(testRunner=VppTestRunner)
+class Test_async_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll):
+    """async noESN AES-GCM-128/NONE IPSec test"""
+    def test_ipsec(self):
+        self.run_test()
+
+
+class Test_async_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll):
+    """async noESN AES-GCM-192/NONE IPSec test"""
+    def test_ipsec(self):
+        self.run_test()
+
+
+class Test_async_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll):
+    """async noESN AES-GCM-256/NONE IPSec test"""
+    def test_ipsec(self):
+        self.run_test()
+
+
+class Test_async_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
+    """async noESN AES-CBC-192/SHA1-96 IPSec test"""
+    def test_ipsec(self):
+        self.run_test()
+
+
+class Test_async_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
+    """async noESN AES-CBC-256/SHA1-96 IPSec test"""
+    def test_ipsec(self):
+        self.run_test()
+
+
+class Test_async_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll):
+    """async ESN AES-CBC-192/SHA1-96 IPSec test"""
+    def test_ipsec(self):
+        self.run_test()
+
+
+class Test_async_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll):
+    """async ESN AES-CBC-256/SHA1-96 IPSec test"""
+    def test_ipsec(self):
+        self.run_test()
diff --git a/test/test_ipsec_tun_if_esp.py b/test/test_ipsec_tun_if_esp.py
index 6f7752915d0..158e911e0c7 100644
--- a/test/test_ipsec_tun_if_esp.py
+++ b/test/test_ipsec_tun_if_esp.py
@@ -90,7 +90,7 @@ class TemplateIpsec4TunProtect(object):
 
     encryption_type = ESP
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     tun4_input_node = "ipsec4-tun-input"
 
     def config_sa_tra(self, p):
@@ -207,7 +207,7 @@ class TemplateIpsec4TunIfEspUdp(TemplateIpsec4TunProtect,
     """ IPsec UDP tunnel interface tests """
 
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
 
     @classmethod
@@ -284,7 +284,7 @@ class TemplateIpsec4TunIfEspUdp(TemplateIpsec4TunProtect,
 class TestIpsec4TunIfEsp1(TemplateIpsec4TunIfEsp, IpsecTun4Tests):
     """ Ipsec ESP - TUN tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
 
     def test_tun_basic64(self):
         """ ipsec 6o4 tunnel basic test """
@@ -451,7 +451,7 @@ class TestIpsec6TunIfEsp1(TemplateIpsec6TunIfEsp,
                           IpsecTun6Tests):
     """ Ipsec ESP - TUN tests """
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
 
     def test_tun_basic46(self):
         """ ipsec 4o6 tunnel basic test """
@@ -468,7 +468,7 @@ class TestIpsec6TunIfEspHandoff(TemplateIpsec6TunIfEsp,
                                 IpsecTun6HandoffTests):
     """ Ipsec ESP 6 Handoff tests """
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
 
     def test_tun_handoff_66_police(self):
         """ ESP 6o6 tunnel with policer worker hand-off test """
@@ -540,7 +540,7 @@ class TestIpsec4TunIfEspHandoff(TemplateIpsec4TunIfEsp,
                                 IpsecTun4HandoffTests):
     """ Ipsec ESP 4 Handoff tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
 
     def test_tun_handoff_44_police(self):
         """ ESP 4o4 tunnel with policer worker hand-off test """
@@ -616,7 +616,7 @@ class TestIpsec4MultiTunIfEsp(TemplateIpsec4TunProtect,
 
     encryption_type = ESP
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec4MultiTunIfEsp, self).setUp()
@@ -688,7 +688,7 @@ class TestIpsec4TunIfEspAll(TemplateIpsec4TunProtect,
 
     encryption_type = ESP
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec4TunIfEspAll, self).setUp()
@@ -846,7 +846,7 @@ class TestIpsec4TunIfEspNoAlgo(TemplateIpsec4TunProtect,
 
     encryption_type = ESP
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec4TunIfEspNoAlgo, self).setUp()
@@ -891,7 +891,7 @@ class TestIpsec6MultiTunIfEsp(TemplateIpsec6TunProtect,
 
     encryption_type = ESP
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec6MultiTunIfEsp, self).setUp()
@@ -939,7 +939,7 @@ class TestIpsecGreTebIfEsp(TemplateIpsec,
                            IpsecTun4Tests):
     """ Ipsec GRE TEB ESP - TUN tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
     omac = "00:11:22:33:44:55"
 
@@ -1050,7 +1050,7 @@ class TestIpsecGreTebVlanIfEsp(TemplateIpsec,
                                IpsecTun4Tests):
     """ Ipsec GRE TEB ESP - TUN tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
     omac = "00:11:22:33:44:55"
 
@@ -1170,7 +1170,7 @@ class TestIpsecGreTebIfEspTra(TemplateIpsec,
                               IpsecTun4Tests):
     """ Ipsec GRE TEB ESP - Tra tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
     omac = "00:11:22:33:44:55"
 
@@ -1275,7 +1275,7 @@ class TestIpsecGreTebUdpIfEspTra(TemplateIpsec,
                                  IpsecTun4Tests):
     """ Ipsec GRE TEB UDP ESP - Tra tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
     omac = "00:11:22:33:44:55"
 
@@ -1396,7 +1396,7 @@ class TestIpsecGreIfEsp(TemplateIpsec,
                         IpsecTun4Tests):
     """ Ipsec GRE ESP - TUN tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
 
     def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1,
@@ -1499,7 +1499,7 @@ class TestIpsecGreIfEspTra(TemplateIpsec,
                            IpsecTun4Tests):
     """ Ipsec GRE ESP - TRA tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
 
     def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1,
@@ -1605,7 +1605,7 @@ class TestIpsecGreIfEspTra(TemplateIpsec,
                                           dst=self.pg1.remote_ip6)
         self.send_and_assert_no_replies(self.tun_if, tx)
         node_name = ('/err/%s/unsupported payload' %
-                     self.tun4_decrypt_node_name)
+                     self.tun4_decrypt_node_name[0])
         self.assertEqual(1, self.statistics.get_err_counter(node_name))
 
 
@@ -1613,7 +1613,7 @@ class TestIpsecGre6IfEspTra(TemplateIpsec,
                             IpsecTun6Tests):
     """ Ipsec GRE ESP - TRA tests """
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
     encryption_type = ESP
 
     def gen_encrypt_pkts6(self, p, sa, sw_intf, src, dst, count=1,
@@ -1711,7 +1711,7 @@ class TestIpsecGre6IfEspTra(TemplateIpsec,
 class TestIpsecMGreIfEspTra4(TemplateIpsec, IpsecTun4):
     """ Ipsec mGRE ESP v4 TRA tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
 
     def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1,
@@ -1843,7 +1843,7 @@ class TestIpsecMGreIfEspTra4(TemplateIpsec, IpsecTun4):
 class TestIpsecMGreIfEspTra6(TemplateIpsec, IpsecTun6):
     """ Ipsec mGRE ESP v6 TRA tests """
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
     encryption_type = ESP
 
     def gen_encrypt_pkts6(self, p, sa, sw_intf, src, dst, count=1,
@@ -2092,7 +2092,7 @@ class TestIpsec4TunProtectTun(TemplateIpsec,
 
     encryption_type = ESP
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec4TunProtectTun, self).setUp()
@@ -2206,7 +2206,7 @@ class TestIpsec4TunProtectTunDrop(TemplateIpsec,
 
     encryption_type = ESP
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec4TunProtectTunDrop, self).setUp()
@@ -2255,7 +2255,7 @@ class TestIpsec6TunProtect(TemplateIpsec,
 
     encryption_type = ESP
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec6TunProtect, self).setUp()
@@ -2382,7 +2382,7 @@ class TestIpsec6TunProtectTun(TemplateIpsec,
 
     encryption_type = ESP
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec6TunProtectTun, self).setUp()
@@ -2485,7 +2485,7 @@ class TestIpsec6TunProtectTunDrop(TemplateIpsec,
 
     encryption_type = ESP
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
 
     def setUp(self):
         super(TestIpsec6TunProtectTunDrop, self).setUp()
@@ -2532,7 +2532,7 @@ class TemplateIpsecItf4(object):
 
     encryption_type = ESP
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     tun4_input_node = "ipsec4-tun-input"
 
     def config_sa_tun(self, p, src, dst):
@@ -2843,7 +2843,7 @@ class TemplateIpsecItf6(object):
 
     encryption_type = ESP
     tun6_encrypt_node_name = "esp6-encrypt-tun"
-    tun6_decrypt_node_name = "esp6-decrypt-tun"
+    tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"]
     tun6_input_node = "ipsec6-tun-input"
 
     def config_sa_tun(self, p, src, dst):
@@ -3062,7 +3062,7 @@ class TestIpsecItf6(TemplateIpsec,
 class TestIpsecMIfEsp4(TemplateIpsec, IpsecTun4):
     """ Ipsec P2MP ESP v4 tests """
     tun4_encrypt_node_name = "esp4-encrypt-tun"
-    tun4_decrypt_node_name = "esp4-decrypt-tun"
+    tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"]
     encryption_type = ESP
 
     def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1,