ikev2: handoff packets

current approach saves state in per-thread data structure. in
multi-worker + nat-t cases udp/500 and udp/4500 might be dispatched on
different workers. this patch adds hands off packet to 1 explicit thread
- 1st worker (or main thread in case there're no workers) or to thread
  that was explicitly set by user via configuration

Type: improvement

Change-Id: Ib5cd9a4b8612dfaa63b276035709524f7a492d4f
Signed-off-by: Stanislav Zaikin <stanislav.zaikin@46labs.com>

1 files changed, 35 insertions, 23 deletions

diff --git a/test/test_ikev2.py b/test/test_ikev2.py
index be14df10203..341556d1294 100644
--- a/test/test_ikev2.py
+++ b/test/test_ikev2.py
@@ -675,7 +675,7 @@ class IkePeer(VppTestCase):
         self.assertIsNotNone(self.p.query_vpp_config())
         if self.sa.is_initiator:
             self.sa.generate_dh_data()
-        self.vapi.cli("ikev2 set logging level 4")
+        self.vapi.cli("ikev2 set logging level 5")
         self.vapi.cli("event-lo clear")
 
     def assert_counter(self, count, name, version="ip4"):
@@ -2023,20 +2023,21 @@ class TestApi(VppTestCase):
             self.assertEqual(ap.tun_itf, 0xFFFFFFFF)
 
 
-@tag_fixme_vpp_workers
 class TestResponderBehindNAT(TemplateResponder, Ikev2Params):
     """test responder - responder behind NAT"""
 
     IKE_NODE_SUFFIX = "ip4-natt"
+    vpp_worker_count = 2
 
     def config_tc(self):
         self.config_params({"r_natt": True})
 
 
-@tag_fixme_vpp_workers
 class TestInitiatorNATT(TemplateInitiator, Ikev2Params):
     """test ikev2 initiator - NAT traversal (intitiator behind NAT)"""
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params(
             {
@@ -2065,10 +2066,11 @@ class TestInitiatorNATT(TemplateInitiator, Ikev2Params):
         )
 
 
-@tag_fixme_vpp_workers
 class TestInitiatorPsk(TemplateInitiator, Ikev2Params):
     """test ikev2 initiator - pre shared key auth"""
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params(
             {
@@ -2096,10 +2098,11 @@ class TestInitiatorPsk(TemplateInitiator, Ikev2Params):
         )
 
 
-@tag_fixme_vpp_workers
 class TestInitiatorRequestWindowSize(TestInitiatorPsk):
     """test initiator - request window size (1)"""
 
+    vpp_worker_count = 2
+
     def rekey_respond(self, req, update_child_sa_data):
         ih = self.get_ike_header(req)
         plain = self.sa.hmac_and_decrypt(ih)
@@ -2145,10 +2148,11 @@ class TestInitiatorRequestWindowSize(TestInitiatorPsk):
         self.verify_ipsec_sas(is_rekey=True)
 
 
-@tag_fixme_vpp_workers
 class TestInitiatorRekey(TestInitiatorPsk):
     """test ikev2 initiator - rekey"""
 
+    vpp_worker_count = 2
+
     def rekey_from_initiator(self):
         ispi = int.from_bytes(self.sa.child_sas[0].ispi, "little")
         self.pg0.enable_capture()
@@ -2190,10 +2194,11 @@ class TestInitiatorRekey(TestInitiatorPsk):
         self.verify_ipsec_sas(is_rekey=True)
 
 
-@tag_fixme_vpp_workers
 class TestInitiatorDelSAFromResponder(TemplateInitiator, Ikev2Params):
     """test ikev2 initiator - delete IKE SA from responder"""
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params(
             {
@@ -2223,30 +2228,32 @@ class TestInitiatorDelSAFromResponder(TemplateInitiator, Ikev2Params):
         )
 
 
-@tag_fixme_vpp_workers
 class TestResponderInitBehindNATT(TemplateResponder, Ikev2Params):
     """test ikev2 responder - initiator behind NAT"""
 
     IKE_NODE_SUFFIX = "ip4-natt"
+    vpp_worker_count = 2
 
     def config_tc(self):
         self.config_params({"i_natt": True})
 
 
-@tag_fixme_vpp_workers
 class TestResponderPsk(TemplateResponder, Ikev2Params):
     """test ikev2 responder - pre shared key auth"""
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params()
 
 
-@tag_fixme_vpp_workers
 class TestResponderDpd(TestResponderPsk):
     """
     Dead peer detection test
     """
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params({"dpd_disabled": False})
 
@@ -2274,11 +2281,11 @@ class TestResponderDpd(TestResponderPsk):
         self.assertEqual(len(ipsec_sas), 0)
 
 
-@tag_fixme_vpp_workers
 class TestResponderRekey(TestResponderPsk):
     """test ikev2 responder - rekey"""
 
     WITH_KEX = False
+    vpp_worker_count = 2
 
     def send_rekey_from_initiator(self):
         if self.WITH_KEX:
@@ -2316,10 +2323,11 @@ class TestResponderRekey(TestResponderPsk):
         self.assertEqual(r[0].sa.stats.n_rekey_req, 1)
 
 
-@tag_fixme_vpp_workers
 class TestResponderRekeyRepeat(TestResponderRekey):
     """test ikev2 responder - rekey repeat"""
 
+    vpp_worker_count = 2
+
     def test_responder(self):
         super(TestResponderRekeyRepeat, self).test_responder()
         # rekey request is not accepted until old IPsec SA is expired
@@ -2342,24 +2350,25 @@ class TestResponderRekeyRepeat(TestResponderRekey):
         self.verify_ipsec_sas(sa_count=3)
 
 
-@tag_fixme_vpp_workers
 class TestResponderRekeyKEX(TestResponderRekey):
     """test ikev2 responder - rekey with key exchange"""
 
     WITH_KEX = True
+    vpp_worker_count = 2
 
 
-@tag_fixme_vpp_workers
 class TestResponderRekeyRepeatKEX(TestResponderRekeyRepeat):
     """test ikev2 responder - rekey repeat with key exchange"""
 
     WITH_KEX = True
+    vpp_worker_count = 2
 
 
-@tag_fixme_vpp_workers
 class TestResponderRekeySA(TestResponderPsk):
     """test ikev2 responder - rekey IKE SA"""
 
+    vpp_worker_count = 2
+
     def send_rekey_from_initiator(self, newsa):
         packet = self.create_sa_rekey_request(
             spi=newsa.ispi,
@@ -2409,8 +2418,7 @@ class TestResponderVrf(TestResponderPsk, Ikev2Params):
 
         globals()["ikev2"] = _ikev2
         super(IkePeer, cls).setUpClass()
-        if (is_distro_debian11 == True) and not hasattr(cls, "vpp"):
-            return
+
         cls.create_pg_interfaces(range(1))
         cls.vapi.cli("ip table add 1")
         cls.vapi.cli("set interface ip table pg0 1")
@@ -2425,7 +2433,7 @@ class TestResponderVrf(TestResponderPsk, Ikev2Params):
         self.config_params({"dpd_disabled": False})
 
     def test_responder(self):
-        self.vapi.ikev2_profile_set_liveness(period=2, max_retries=1)
+        self.vapi.ikev2_profile_set_liveness(period=2, max_retries=3)
         super(TestResponderVrf, self).test_responder()
         self.pg0.enable_capture()
         self.pg_start()
@@ -2436,10 +2444,11 @@ class TestResponderVrf(TestResponderPsk, Ikev2Params):
         self.assertEqual(plain, b"")
 
 
-@tag_fixme_vpp_workers
 class TestResponderRsaSign(TemplateResponder, Ikev2Params):
     """test ikev2 responder - cert based auth"""
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params(
             {
@@ -2453,7 +2462,6 @@ class TestResponderRsaSign(TemplateResponder, Ikev2Params):
         )
 
 
-@tag_fixme_vpp_workers
 class Test_IKE_AES_CBC_128_SHA256_128_MODP2048_ESP_AES_CBC_192_SHA_384_192(
     TemplateResponder, Ikev2Params
 ):
@@ -2461,6 +2469,8 @@ class Test_IKE_AES_CBC_128_SHA256_128_MODP2048_ESP_AES_CBC_192_SHA_384_192(
     IKE:AES_CBC_128_SHA256_128,DH=modp2048 ESP:AES_CBC_192_SHA_384_192
     """
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params(
             {
@@ -2475,7 +2485,6 @@ class Test_IKE_AES_CBC_128_SHA256_128_MODP2048_ESP_AES_CBC_192_SHA_384_192(
         )
 
 
-@tag_fixme_vpp_workers
 class TestAES_CBC_128_SHA256_128_MODP3072_ESP_AES_GCM_16(
     TemplateResponder, Ikev2Params
 ):
@@ -2483,6 +2492,8 @@ class TestAES_CBC_128_SHA256_128_MODP3072_ESP_AES_GCM_16(
     IKE:AES_CBC_128_SHA256_128,DH=modp3072 ESP:AES_GCM_16
     """
 
+    vpp_worker_count = 2
+
     def config_tc(self):
         self.config_params(
             {
@@ -2495,13 +2506,13 @@ class TestAES_CBC_128_SHA256_128_MODP3072_ESP_AES_GCM_16(
         )
 
 
-@tag_fixme_vpp_workers
 class Test_IKE_AES_GCM_16_256(TemplateResponder, Ikev2Params):
     """
     IKE:AES_GCM_16_256
     """
 
     IKE_NODE_SUFFIX = "ip6"
+    vpp_worker_count = 2
 
     def config_tc(self):
         self.config_params(
@@ -2518,12 +2529,13 @@ class Test_IKE_AES_GCM_16_256(TemplateResponder, Ikev2Params):
         )
 
 
-@tag_fixme_vpp_workers
 class TestInitiatorKeepaliveMsg(TestInitiatorPsk):
     """
     Test for keep alive messages
     """
 
+    vpp_worker_count = 2
+
     def send_empty_req_from_responder(self):
         packet = self.create_empty_request()
         self.pg0.add_stream(packet)