diff options
| -rw-r--r-- | src/vnet/ipsec/ipsec_if.c | 45 | ||||
| -rw-r--r-- | test/test_ipsec_tun_if_esp.py | 57 |
2 files changed, 81 insertions, 21 deletions
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c index f7cd95873db..8d0eef21ae0 100644 --- a/src/vnet/ipsec/ipsec_if.c +++ b/src/vnet/ipsec/ipsec_if.c @@ -230,6 +230,21 @@ ipsec_tun_mk_output_sa_id (u32 ti) return (0xc0000000 | ti); } +static void +ipsec_tunnel_feature_set (ipsec_tunnel_if_t * t, u8 enable) +{ + vnet_feature_enable_disable ("ip4-output", + "esp4-encrypt-tun", + t->sw_if_index, enable, + &t->output_sa_index, + sizeof (t->output_sa_index)); + vnet_feature_enable_disable ("ip6-output", + "esp6-encrypt-tun", + t->sw_if_index, enable, + &t->output_sa_index, + sizeof (t->output_sa_index)); +} + int ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, ipsec_add_del_tunnel_args_t * args, @@ -362,16 +377,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, ~0); im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance; - vnet_feature_enable_disable ("ip4-output", - "esp4-encrypt-tun", - t->sw_if_index, 1, - &t->output_sa_index, - sizeof (t->output_sa_index)); - vnet_feature_enable_disable ("ip6-output", - "esp6-encrypt-tun", - t->sw_if_index, 1, - &t->output_sa_index, - sizeof (t->output_sa_index)); + ipsec_tunnel_feature_set (t, 1); /*1st interface, register protocol */ if (pool_elts (im->tunnel_interfaces) == 1) @@ -396,16 +402,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, hi = vnet_get_hw_interface (vnm, t->hw_if_index); vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */ - vnet_feature_enable_disable ("ip4-output", - "esp4-encrypt-tun", - hi->sw_if_index, 0, - &t->output_sa_index, - sizeof (t->output_sa_index)); - vnet_feature_enable_disable ("ip6-output", - "esp6-encrypt-tun", - hi->sw_if_index, 0, - &t->output_sa_index, - sizeof (t->output_sa_index)); + ipsec_tunnel_feature_set (t, 0); vnet_delete_hw_interface (vnm, t->hw_if_index); if (is_ip6) @@ -649,7 +646,13 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, return VNET_API_ERROR_INVALID_VALUE; } + /* + * re-enable the feature to get the new SA in + * the workers are stopped so no packets are sent in the clear + */ + ipsec_tunnel_feature_set (t, 0); t->output_sa_index = sa_index; + ipsec_tunnel_feature_set (t, 1); } /* remove sa_id to sa_index mapping on old SA */ @@ -661,7 +664,7 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, clib_warning ("IPsec backend add/del callback returned error"); return VNET_API_ERROR_SYSCALL_ERROR_1; } - pool_put (im->sad, old_sa); + ipsec_sa_del (old_sa->id); return 0; } diff --git a/test/test_ipsec_tun_if_esp.py b/test/test_ipsec_tun_if_esp.py index 018e00bc25e..8f1bd7cb14f 100644 --- a/test/test_ipsec_tun_if_esp.py +++ b/test/test_ipsec_tun_if_esp.py @@ -243,6 +243,55 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4): def tearDown(self): super(TestIpsec4TunIfEspAll, self).tearDown() + def rekey(self, p): + # + # change the key and the SPI + # + p.crypt_key = 'X' + p.crypt_key[1:] + p.scapy_tun_spi += 1 + p.scapy_tun_sa_id += 1 + p.vpp_tun_spi += 1 + p.vpp_tun_sa_id += 1 + p.tun_if.local_spi = p.vpp_tun_spi + p.tun_if.remote_spi = p.scapy_tun_spi + + config_tun_params(p, self.encryption_type, self.tun_if) + + p.tun_sa_in = VppIpsecSA(self, + p.scapy_tun_sa_id, + p.scapy_tun_spi, + p.auth_algo_vpp_id, + p.auth_key, + p.crypt_algo_vpp_id, + p.crypt_key, + self.vpp_esp_protocol, + self.tun_if.local_addr[p.addr_type], + self.tun_if.remote_addr[p.addr_type], + flags=p.flags, + salt=p.salt) + p.tun_sa_out = VppIpsecSA(self, + p.vpp_tun_sa_id, + p.vpp_tun_spi, + p.auth_algo_vpp_id, + p.auth_key, + p.crypt_algo_vpp_id, + p.crypt_key, + self.vpp_esp_protocol, + self.tun_if.remote_addr[p.addr_type], + self.tun_if.local_addr[p.addr_type], + flags=p.flags, + salt=p.salt) + p.tun_sa_in.add_vpp_config() + p.tun_sa_out.add_vpp_config() + + self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index, + sa_id=p.tun_sa_in.id, + is_outbound=1) + self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index, + sa_id=p.tun_sa_out.id, + is_outbound=0) + self.logger.info(self.vapi.cli("sh ipsec sa")) + def test_tun_44(self): """IPSEC tunnel all algos """ @@ -324,7 +373,15 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4): c = p.tun_if.get_tx_stats() self.assertEqual(c['packets'], 127) + # + # rekey the tunnel + # + self.rekey(p) + self.verify_tun_44(p, count=127) + self.unconfig_network(p) + p.tun_sa_out.remove_vpp_config() + p.tun_sa_in.remove_vpp_config() class TestIpsec6MultiTunIfEsp(TemplateIpsec, IpsecTun6): |