diff options
| -rw-r--r-- | src/vnet/ipsec/esp_decrypt.c | 3 | ||||
| -rw-r--r-- | test/template_ipsec.py | 73 | ||||
| -rw-r--r-- | test/test_ipsec_ah.py | 8 | ||||
| -rw-r--r-- | test/test_ipsec_esp.py | 159 | ||||
| -rw-r--r-- | test/test_ipsec_tun_if_esp.py | 56 |
5 files changed, 191 insertions, 108 deletions
diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c index 0924351a9d4..274fbf810c0 100644 --- a/src/vnet/ipsec/esp_decrypt.c +++ b/src/vnet/ipsec/esp_decrypt.c @@ -1234,7 +1234,8 @@ esp_decrypt_inline (vlib_main_t * vm, /* no post process in async */ vlib_node_increment_counter (vm, node->node_index, - ESP_DECRYPT_ERROR_RX_PKTS, n_left); + ESP_DECRYPT_ERROR_RX_PKTS, + from_frame->n_vectors); if (n_async_drop) vlib_buffer_enqueue_to_next (vm, node, from, nexts, n_async_drop); diff --git a/test/template_ipsec.py b/test/template_ipsec.py index 48ac270df72..f7becf0f82a 100644 --- a/test/template_ipsec.py +++ b/test/template_ipsec.py @@ -57,6 +57,7 @@ class IPsecIPv4Params: self.tun_flags = (VppEnum.vl_api_tunnel_encap_decap_flags_t. TUNNEL_API_ENCAP_DECAP_FLAG_NONE) self.dscp = 0 + self.async_mode = False class IPsecIPv6Params: @@ -101,6 +102,7 @@ class IPsecIPv6Params: self.tun_flags = (VppEnum.vl_api_tunnel_encap_decap_flags_t. TUNNEL_API_ENCAP_DECAP_FLAG_NONE) self.dscp = 0 + self.async_mode = False def mk_scapy_crypt_key(p): @@ -295,28 +297,46 @@ class IpsecTcpTests(IpsecTcp): class IpsecTra4(object): """ verify methods for Transport v4 """ + def get_replay_counts(self, p): + replay_node_name = ('/err/%s/SA replayed packet' % + self.tra4_decrypt_node_name[0]) + count = self.statistics.get_err_counter(replay_node_name) + + if p.async_mode: + replay_post_node_name = ('/err/%s/SA replayed packet' % + self.tra4_decrypt_node_name[p.async_mode]) + count += self.statistics.get_err_counter(replay_post_node_name) + + return count + + def get_hash_failed_counts(self, p): + if ESP == self.encryption_type and p.crypt_algo == "AES-GCM": + hash_failed_node_name = ('/err/%s/ESP decryption failed' % + self.tra4_decrypt_node_name[p.async_mode]) + else: + hash_failed_node_name = ('/err/%s/Integrity check failed' % + self.tra4_decrypt_node_name[p.async_mode]) + count = self.statistics.get_err_counter(hash_failed_node_name) + + if p.async_mode: + count += self.statistics.get_err_counter( + '/err/crypto-dispatch/bad-hmac') + + return count + def verify_tra_anti_replay(self): p = self.params[socket.AF_INET] esn_en = p.vpp_tra_sa.esn_en seq_cycle_node_name = ('/err/%s/sequence number cycled' % self.tra4_encrypt_node_name) - replay_node_name = ('/err/%s/SA replayed packet' % - self.tra4_decrypt_node_name) - if ESP == self.encryption_type and p.crypt_algo == "AES-GCM": - hash_failed_node_name = ('/err/%s/ESP decryption failed' % - self.tra4_decrypt_node_name) - else: - hash_failed_node_name = ('/err/%s/Integrity check failed' % - self.tra4_decrypt_node_name) - replay_count = self.statistics.get_err_counter(replay_node_name) - hash_failed_count = self.statistics.get_err_counter( - hash_failed_node_name) + replay_count = self.get_replay_counts(p) + hash_failed_count = self.get_hash_failed_counts(p) seq_cycle_count = self.statistics.get_err_counter(seq_cycle_node_name) if ESP == self.encryption_type: undersize_node_name = ('/err/%s/undersized packet' % - self.tra4_decrypt_node_name) + self.tra4_decrypt_node_name[0]) undersize_count = self.statistics.get_err_counter( undersize_node_name) @@ -340,12 +360,14 @@ class IpsecTra4(object): # replayed packets are dropped self.send_and_assert_no_replies(self.tra_if, pkts) replay_count += len(pkts) - self.assert_error_counter_equal(replay_node_name, replay_count) + self.assertEqual(self.get_replay_counts(p), replay_count) # # now send a batch of packets all with the same sequence number # the first packet in the batch is legitimate, the rest bogus # + self.vapi.cli("clear error") + self.vapi.cli("clear node counters") pkts = (Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac) / p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4, @@ -355,11 +377,12 @@ class IpsecTra4(object): recv_pkts = self.send_and_expect(self.tra_if, pkts * 8, self.tra_if, n_rx=1) replay_count += 7 - self.assert_error_counter_equal(replay_node_name, replay_count) + self.assertEqual(self.get_replay_counts(p), replay_count) # # now move the window over to 257 (more than one byte) and into Case A # + self.vapi.cli("clear error") pkt = (Ether(src=self.tra_if.remote_mac, dst=self.tra_if.local_mac) / p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4, @@ -371,7 +394,7 @@ class IpsecTra4(object): # replayed packets are dropped self.send_and_assert_no_replies(self.tra_if, pkt * 3) replay_count += 3 - self.assert_error_counter_equal(replay_node_name, replay_count) + self.assertEqual(self.get_replay_counts(p), replay_count) # the window size is 64 packets # in window are still accepted @@ -399,8 +422,7 @@ class IpsecTra4(object): self.send_and_assert_no_replies(self.tra_if, pkt * 17) hash_failed_count += 17 - self.assert_error_counter_equal(hash_failed_node_name, - hash_failed_count) + self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count) # a malformed 'runt' packet # created by a mis-constructed SA @@ -445,13 +467,11 @@ class IpsecTra4(object): # an out of window error with ESN looks like a high sequence # wrap. but since it isn't then the verify will fail. hash_failed_count += 17 - self.assert_error_counter_equal(hash_failed_node_name, - hash_failed_count) + self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count) else: replay_count += 17 - self.assert_error_counter_equal(replay_node_name, - replay_count) + self.assertEqual(self.get_replay_counts(p), replay_count) # valid packet moves the window over to 258 pkt = (Ether(src=self.tra_if.remote_mac, @@ -535,8 +555,7 @@ class IpsecTra4(object): self.send_and_assert_no_replies(self.tra_if, [pkt], self.tra_if) hash_failed_count += 1 - self.assert_error_counter_equal(hash_failed_node_name, - hash_failed_count) + self.assertEqual(self.get_hash_failed_counts(p), hash_failed_count) # # but if we move the wondow forward to case B, then we can wrap @@ -613,7 +632,7 @@ class IpsecTra4(object): (count, pkts)) self.assert_packet_counter_equal(self.tra4_encrypt_node_name, count) - self.assert_packet_counter_equal(self.tra4_decrypt_node_name, count) + self.assert_packet_counter_equal(self.tra4_decrypt_node_name[0], count) class IpsecTra4Tests(IpsecTra4): @@ -667,7 +686,7 @@ class IpsecTra6(object): "incorrect SA out counts: expected %d != %d" % (count, pkts)) self.assert_packet_counter_equal(self.tra6_encrypt_node_name, count) - self.assert_packet_counter_equal(self.tra6_decrypt_node_name, count) + self.assert_packet_counter_equal(self.tra6_decrypt_node_name[0], count) def gen_encrypt_pkts_ext_hdrs6(self, sa, sw_intf, src, dst, count=1, payload_size=54): @@ -816,7 +835,7 @@ class IpsecTun4(object): (count, pkts)) self.assert_packet_counter_equal(self.tun4_encrypt_node_name, n_frags) - self.assert_packet_counter_equal(self.tun4_decrypt_node_name, count) + self.assert_packet_counter_equal(self.tun4_decrypt_node_name[0], count) def verify_decrypted(self, p, rxs): for rx in rxs: @@ -1034,7 +1053,7 @@ class IpsecTun6(object): "incorrect SA out counts: expected %d != %d" % (count, pkts)) self.assert_packet_counter_equal(self.tun6_encrypt_node_name, count) - self.assert_packet_counter_equal(self.tun6_decrypt_node_name, count) + self.assert_packet_counter_equal(self.tun6_decrypt_node_name[0], count) def verify_decrypted6(self, p, rxs): for rx in rxs: diff --git a/test/test_ipsec_ah.py b/test/test_ipsec_ah.py index ef6725e6a10..31e0516169f 100644 --- a/test/test_ipsec_ah.py +++ b/test/test_ipsec_ah.py @@ -43,13 +43,13 @@ class ConfigIpsecAH(TemplateIpsec): encryption_type = AH net_objs = [] tra4_encrypt_node_name = "ah4-encrypt" - tra4_decrypt_node_name = "ah4-decrypt" + tra4_decrypt_node_name = ["ah4-decrypt", "ah4-decrypt"] tra6_encrypt_node_name = "ah6-encrypt" - tra6_decrypt_node_name = "ah6-decrypt" + tra6_decrypt_node_name = ["ah6-decrypt", "ah6-decrypt"] tun4_encrypt_node_name = "ah4-encrypt" - tun4_decrypt_node_name = "ah4-decrypt" + tun4_decrypt_node_name = ["ah4-decrypt", "ah4-decrypt"] tun6_encrypt_node_name = "ah6-encrypt" - tun6_decrypt_node_name = "ah6-decrypt" + tun6_decrypt_node_name = ["ah6-decrypt", "ah6-decrypt"] @classmethod def setUpClass(cls): diff --git a/test/test_ipsec_esp.py b/test/test_ipsec_esp.py index 11d44049aeb..209298a30a4 100644 --- a/test/test_ipsec_esp.py +++ b/test/test_ipsec_esp.py @@ -27,13 +27,13 @@ engines_supporting_chain_bufs = ["openssl"] class ConfigIpsecESP(TemplateIpsec): encryption_type = ESP tra4_encrypt_node_name = "esp4-encrypt" - tra4_decrypt_node_name = "esp4-decrypt" + tra4_decrypt_node_name = ["esp4-decrypt", "esp4-decrypt-post"] tra6_encrypt_node_name = "esp6-encrypt" - tra6_decrypt_node_name = "esp6-decrypt" + tra6_decrypt_node_name = ["esp6-decrypt", "esp6-decrypt-post"] tun4_encrypt_node_name = "esp4-encrypt" - tun4_decrypt_node_name = "esp4-decrypt" + tun4_decrypt_node_name = ["esp4-decrypt", "esp4-decrypt-post"] tun6_encrypt_node_name = "esp6-encrypt" - tun6_decrypt_node_name = "esp6-decrypt" + tun6_decrypt_node_name = ["esp6-decrypt", "esp6-decrypt-post"] @classmethod def setUpClass(cls): @@ -645,6 +645,14 @@ class RunTestIpsecEspAll(ConfigIpsecESP, IpsecTun4, IpsecTun6): """ Ipsec ESP all Algos """ + @classmethod + def setUpConstants(cls): + test_args = str.split(cls.__doc__, " ") + engine = test_args[0] + if engine == "async": + cls.worker_config = "workers 2" + super(RunTestIpsecEspAll, cls).setUpConstants() + def setUp(self): super(RunTestIpsecEspAll, self).setUp() test_args = str.split(self.__doc__, " ") @@ -656,6 +664,9 @@ class RunTestIpsecEspAll(ConfigIpsecESP, self.flag = params.flags[1] self.algo = params.algos[test_args[2]] + self.async_mode = False + if self.engine == "async": + self.async_mode = True def tearDown(self): super(RunTestIpsecEspAll, self).tearDown() @@ -664,10 +675,12 @@ class RunTestIpsecEspAll(ConfigIpsecESP, self.run_a_test(self.engine, self.flag, self.algo) def run_a_test(self, engine, flag, algo, payload_size=None): - if engine == "ia32": - engine = "native" - self.vapi.cli("set crypto handler all %s" % engine) + if self.async_mode: + self.vapi.cli("set ipsec async mode on") + else: + self.vapi.cli("set crypto handler all %s" % engine) + self.logger.info(self.vapi.cli("show crypto async status")) self.ipv4_params = IPsecIPv4Params() self.ipv6_params = IPsecIPv6Params() @@ -685,6 +698,7 @@ class RunTestIpsecEspAll(ConfigIpsecESP, p.salt = algo['salt'] p.flags = p.flags | flag p.outer_flow_label = 243224 + p.async_mode = self.async_mode self.reporter.send_keep_alive(self) @@ -747,7 +761,7 @@ class RunTestIpsecEspAll(ConfigIpsecESP, # To generate test classes, do: # grep '# GEN' test_ipsec_esp.py | sed -e 's/# GEN //g' | bash # -# GEN for ENG in ia32 ipsecmb openssl; do \ +# GEN for ENG in native ipsecmb openssl; do \ # GEN for FLG in noESN ESN; do for ALG in AES-GCM-128/NONE \ # GEN AES-GCM-192/NONE AES-GCM-256/NONE AES-CBC-128/MD5-96 \ # GEN AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96 \ @@ -760,118 +774,129 @@ class RunTestIpsecEspAll(ConfigIpsecESP, # GEN echo " def test_ipsec(self):"; # GEN echo " self.run_test()"; # GEN done; done; done +# +# GEN for FLG in noESN ESN; do for ALG in \ +# GEN AES-GCM-128/NONE AES-GCM-192/NONE AES-GCM-256/NONE \ +# GEN AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96; do \ +# GEN [[ ${FLG} == "ESN" && ${ALG} == *"NONE" ]] && continue +# GEN echo -e "\n\nclass Test_async_${FLG}_${ALG}(RunTestIpsecEspAll):" | +# GEN sed -e 's/-/_/g' -e 's#/#_#g' ; \ +# GEN echo ' """'async $FLG $ALG IPSec test'"""' ; +# GEN echo " def test_ipsec(self):"; +# GEN echo " self.run_test()"; +# GEN done; done; -class Test_ia32_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): - """ia32 noESN AES-GCM-128/NONE IPSec test""" +class Test_native_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): + """native noESN AES-GCM-128/NONE IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll): - """ia32 noESN AES-GCM-192/NONE IPSec test""" +class Test_native_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll): + """native noESN AES-GCM-192/NONE IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll): - """ia32 noESN AES-GCM-256/NONE IPSec test""" +class Test_native_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll): + """native noESN AES-GCM-256/NONE IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): - """ia32 noESN AES-CBC-128/MD5-96 IPSec test""" +class Test_native_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): + """native noESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): - """ia32 noESN AES-CBC-192/SHA1-96 IPSec test""" +class Test_native_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): + """native noESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): - """ia32 noESN AES-CBC-256/SHA1-96 IPSec test""" +class Test_native_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): + """native noESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): - """ia32 noESN 3DES-CBC/SHA1-96 IPSec test""" +class Test_native_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): + """native noESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_NONE_SHA1_96(RunTestIpsecEspAll): - """ia32 noESN NONE/SHA1-96 IPSec test""" +class Test_native_noESN_NONE_SHA1_96(RunTestIpsecEspAll): + """native noESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): - """ia32 noESN AES-CTR-128/SHA1-96 IPSec test""" +class Test_native_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """native noESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): - """ia32 noESN AES-CTR-192/SHA1-96 IPSec test""" +class Test_native_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """native noESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): - """ia32 noESN AES-CTR-256/SHA1-96 IPSec test""" +class Test_native_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """native noESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): - """ia32 ESN AES-CBC-128/MD5-96 IPSec test""" +class Test_native_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): + """native ESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): - """ia32 ESN AES-CBC-192/SHA1-96 IPSec test""" +class Test_native_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): + """native ESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): - """ia32 ESN AES-CBC-256/SHA1-96 IPSec test""" +class Test_native_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): + """native ESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): - """ia32 ESN 3DES-CBC/SHA1-96 IPSec test""" +class Test_native_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): + """native ESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_NONE_SHA1_96(RunTestIpsecEspAll): - """ia32 ESN NONE/SHA1-96 IPSec test""" +class Test_native_ESN_NONE_SHA1_96(RunTestIpsecEspAll): + """native ESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): - """ia32 ESN AES-CTR-128/SHA1-96 IPSec test""" +class Test_native_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): + """native ESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): - """ia32 ESN AES-CTR-192/SHA1-96 IPSec test""" +class Test_native_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): + """native ESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() -class Test_ia32_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): - """ia32 ESN AES-CTR-256/SHA1-96 IPSec test""" +class Test_native_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): + """native ESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() @@ -1104,5 +1129,43 @@ class Test_openssl_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): self.run_test() -if __name__ == '__main__': - unittest.main(testRunner=VppTestRunner) +class Test_async_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): + """async noESN AES-GCM-128/NONE IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_async_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll): + """async noESN AES-GCM-192/NONE IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_async_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll): + """async noESN AES-GCM-256/NONE IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_async_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): + """async noESN AES-CBC-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_async_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): + """async noESN AES-CBC-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_async_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): + """async ESN AES-CBC-192/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() + + +class Test_async_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): + """async ESN AES-CBC-256/SHA1-96 IPSec test""" + def test_ipsec(self): + self.run_test() diff --git a/test/test_ipsec_tun_if_esp.py b/test/test_ipsec_tun_if_esp.py index 6f7752915d0..158e911e0c7 100644 --- a/test/test_ipsec_tun_if_esp.py +++ b/test/test_ipsec_tun_if_esp.py @@ -90,7 +90,7 @@ class TemplateIpsec4TunProtect(object): encryption_type = ESP tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] tun4_input_node = "ipsec4-tun-input" def config_sa_tra(self, p): @@ -207,7 +207,7 @@ class TemplateIpsec4TunIfEspUdp(TemplateIpsec4TunProtect, """ IPsec UDP tunnel interface tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP @classmethod @@ -284,7 +284,7 @@ class TemplateIpsec4TunIfEspUdp(TemplateIpsec4TunProtect, class TestIpsec4TunIfEsp1(TemplateIpsec4TunIfEsp, IpsecTun4Tests): """ Ipsec ESP - TUN tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] def test_tun_basic64(self): """ ipsec 6o4 tunnel basic test """ @@ -451,7 +451,7 @@ class TestIpsec6TunIfEsp1(TemplateIpsec6TunIfEsp, IpsecTun6Tests): """ Ipsec ESP - TUN tests """ tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] def test_tun_basic46(self): """ ipsec 4o6 tunnel basic test """ @@ -468,7 +468,7 @@ class TestIpsec6TunIfEspHandoff(TemplateIpsec6TunIfEsp, IpsecTun6HandoffTests): """ Ipsec ESP 6 Handoff tests """ tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] def test_tun_handoff_66_police(self): """ ESP 6o6 tunnel with policer worker hand-off test """ @@ -540,7 +540,7 @@ class TestIpsec4TunIfEspHandoff(TemplateIpsec4TunIfEsp, IpsecTun4HandoffTests): """ Ipsec ESP 4 Handoff tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] def test_tun_handoff_44_police(self): """ ESP 4o4 tunnel with policer worker hand-off test """ @@ -616,7 +616,7 @@ class TestIpsec4MultiTunIfEsp(TemplateIpsec4TunProtect, encryption_type = ESP tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] def setUp(self): super(TestIpsec4MultiTunIfEsp, self).setUp() @@ -688,7 +688,7 @@ class TestIpsec4TunIfEspAll(TemplateIpsec4TunProtect, encryption_type = ESP tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] def setUp(self): super(TestIpsec4TunIfEspAll, self).setUp() @@ -846,7 +846,7 @@ class TestIpsec4TunIfEspNoAlgo(TemplateIpsec4TunProtect, encryption_type = ESP tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] def setUp(self): super(TestIpsec4TunIfEspNoAlgo, self).setUp() @@ -891,7 +891,7 @@ class TestIpsec6MultiTunIfEsp(TemplateIpsec6TunProtect, encryption_type = ESP tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] def setUp(self): super(TestIpsec6MultiTunIfEsp, self).setUp() @@ -939,7 +939,7 @@ class TestIpsecGreTebIfEsp(TemplateIpsec, IpsecTun4Tests): """ Ipsec GRE TEB ESP - TUN tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP omac = "00:11:22:33:44:55" @@ -1050,7 +1050,7 @@ class TestIpsecGreTebVlanIfEsp(TemplateIpsec, IpsecTun4Tests): """ Ipsec GRE TEB ESP - TUN tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP omac = "00:11:22:33:44:55" @@ -1170,7 +1170,7 @@ class TestIpsecGreTebIfEspTra(TemplateIpsec, IpsecTun4Tests): """ Ipsec GRE TEB ESP - Tra tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP omac = "00:11:22:33:44:55" @@ -1275,7 +1275,7 @@ class TestIpsecGreTebUdpIfEspTra(TemplateIpsec, IpsecTun4Tests): """ Ipsec GRE TEB UDP ESP - Tra tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP omac = "00:11:22:33:44:55" @@ -1396,7 +1396,7 @@ class TestIpsecGreIfEsp(TemplateIpsec, IpsecTun4Tests): """ Ipsec GRE ESP - TUN tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1, @@ -1499,7 +1499,7 @@ class TestIpsecGreIfEspTra(TemplateIpsec, IpsecTun4Tests): """ Ipsec GRE ESP - TRA tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1, @@ -1605,7 +1605,7 @@ class TestIpsecGreIfEspTra(TemplateIpsec, dst=self.pg1.remote_ip6) self.send_and_assert_no_replies(self.tun_if, tx) node_name = ('/err/%s/unsupported payload' % - self.tun4_decrypt_node_name) + self.tun4_decrypt_node_name[0]) self.assertEqual(1, self.statistics.get_err_counter(node_name)) @@ -1613,7 +1613,7 @@ class TestIpsecGre6IfEspTra(TemplateIpsec, IpsecTun6Tests): """ Ipsec GRE ESP - TRA tests """ tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] encryption_type = ESP def gen_encrypt_pkts6(self, p, sa, sw_intf, src, dst, count=1, @@ -1711,7 +1711,7 @@ class TestIpsecGre6IfEspTra(TemplateIpsec, class TestIpsecMGreIfEspTra4(TemplateIpsec, IpsecTun4): """ Ipsec mGRE ESP v4 TRA tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1, @@ -1843,7 +1843,7 @@ class TestIpsecMGreIfEspTra4(TemplateIpsec, IpsecTun4): class TestIpsecMGreIfEspTra6(TemplateIpsec, IpsecTun6): """ Ipsec mGRE ESP v6 TRA tests """ tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] encryption_type = ESP def gen_encrypt_pkts6(self, p, sa, sw_intf, src, dst, count=1, @@ -2092,7 +2092,7 @@ class TestIpsec4TunProtectTun(TemplateIpsec, encryption_type = ESP tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] def setUp(self): super(TestIpsec4TunProtectTun, self).setUp() @@ -2206,7 +2206,7 @@ class TestIpsec4TunProtectTunDrop(TemplateIpsec, encryption_type = ESP tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] def setUp(self): super(TestIpsec4TunProtectTunDrop, self).setUp() @@ -2255,7 +2255,7 @@ class TestIpsec6TunProtect(TemplateIpsec, encryption_type = ESP tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] def setUp(self): super(TestIpsec6TunProtect, self).setUp() @@ -2382,7 +2382,7 @@ class TestIpsec6TunProtectTun(TemplateIpsec, encryption_type = ESP tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] def setUp(self): super(TestIpsec6TunProtectTun, self).setUp() @@ -2485,7 +2485,7 @@ class TestIpsec6TunProtectTunDrop(TemplateIpsec, encryption_type = ESP tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] def setUp(self): super(TestIpsec6TunProtectTunDrop, self).setUp() @@ -2532,7 +2532,7 @@ class TemplateIpsecItf4(object): encryption_type = ESP tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] tun4_input_node = "ipsec4-tun-input" def config_sa_tun(self, p, src, dst): @@ -2843,7 +2843,7 @@ class TemplateIpsecItf6(object): encryption_type = ESP tun6_encrypt_node_name = "esp6-encrypt-tun" - tun6_decrypt_node_name = "esp6-decrypt-tun" + tun6_decrypt_node_name = ["esp6-decrypt-tun", "esp6-decrypt-tun-post"] tun6_input_node = "ipsec6-tun-input" def config_sa_tun(self, p, src, dst): @@ -3062,7 +3062,7 @@ class TestIpsecItf6(TemplateIpsec, class TestIpsecMIfEsp4(TemplateIpsec, IpsecTun4): """ Ipsec P2MP ESP v4 tests """ tun4_encrypt_node_name = "esp4-encrypt-tun" - tun4_decrypt_node_name = "esp4-decrypt-tun" + tun4_decrypt_node_name = ["esp4-decrypt-tun", "esp4-decrypt-tun-post"] encryption_type = ESP def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1, |