diff options
| author |   Neale Ranns <nranns@cisco.com> | 2019-04-17 16:29:00 -0700 |
|---|---|---|
| committer |   Damjan Marion <dmarion@me.com> | 2019-04-18 07:51:57 +0000 |
| commit | d6c9e82fa3f7caf01502b7f877bb3c7a1d9aaa34 (patch) | |
| tree | 54dfb31d6b095953be6e5e9cbec6127c71148515 /test | |
| parent | a11bf45b1aba14246cc1259fff1dfb8e9c60581f (diff) | |
IPSEC: tunnel rekey fix and test (VPP-1652)
Change-Id: I1c2b3e40c689bedcdcea7887792b6b6b6aeb48d5
Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'test')
| -rw-r--r-- | test/test_ipsec_tun_if_esp.py | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/test/test_ipsec_tun_if_esp.py b/test/test_ipsec_tun_if_esp.py index 018e00bc25e..8f1bd7cb14f 100644 --- a/test/test_ipsec_tun_if_esp.py +++ b/test/test_ipsec_tun_if_esp.py @@ -243,6 +243,55 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4): def tearDown(self): super(TestIpsec4TunIfEspAll, self).tearDown() + def rekey(self, p): + # + # change the key and the SPI + # + p.crypt_key = 'X' + p.crypt_key[1:] + p.scapy_tun_spi += 1 + p.scapy_tun_sa_id += 1 + p.vpp_tun_spi += 1 + p.vpp_tun_sa_id += 1 + p.tun_if.local_spi = p.vpp_tun_spi + p.tun_if.remote_spi = p.scapy_tun_spi + + config_tun_params(p, self.encryption_type, self.tun_if) + + p.tun_sa_in = VppIpsecSA(self, + p.scapy_tun_sa_id, + p.scapy_tun_spi, + p.auth_algo_vpp_id, + p.auth_key, + p.crypt_algo_vpp_id, + p.crypt_key, + self.vpp_esp_protocol, + self.tun_if.local_addr[p.addr_type], + self.tun_if.remote_addr[p.addr_type], + flags=p.flags, + salt=p.salt) + p.tun_sa_out = VppIpsecSA(self, + p.vpp_tun_sa_id, + p.vpp_tun_spi, + p.auth_algo_vpp_id, + p.auth_key, + p.crypt_algo_vpp_id, + p.crypt_key, + self.vpp_esp_protocol, + self.tun_if.remote_addr[p.addr_type], + self.tun_if.local_addr[p.addr_type], + flags=p.flags, + salt=p.salt) + p.tun_sa_in.add_vpp_config() + p.tun_sa_out.add_vpp_config() + + self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index, + sa_id=p.tun_sa_in.id, + is_outbound=1) + self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index, + sa_id=p.tun_sa_out.id, + is_outbound=0) + self.logger.info(self.vapi.cli("sh ipsec sa")) + def test_tun_44(self): """IPSEC tunnel all algos """ @@ -324,7 +373,15 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4): c = p.tun_if.get_tx_stats() self.assertEqual(c['packets'], 127) + # + # rekey the tunnel + # + self.rekey(p) + self.verify_tun_44(p, count=127) + self.unconfig_network(p) + p.tun_sa_out.remove_vpp_config() + p.tun_sa_in.remove_vpp_config() class TestIpsec6MultiTunIfEsp(TemplateIpsec, IpsecTun6): |