diff options
Diffstat (limited to 'test/test_ipsec_ah.py')
| -rw-r--r-- | test/test_ipsec_ah.py | 342 |
1 files changed, 108 insertions, 234 deletions
diff --git a/test/test_ipsec_ah.py b/test/test_ipsec_ah.py index 9a1c32d9260..3a562e139bb 100644 --- a/test/test_ipsec_ah.py +++ b/test/test_ipsec_ah.py @@ -6,6 +6,9 @@ from scapy.layers.ipsec import AH from framework import VppTestRunner from template_ipsec import TemplateIpsec, IpsecTraTests, IpsecTunTests from template_ipsec import IpsecTcpTests +from vpp_ipsec import * +from vpp_ip_route import VppIpRoute, VppRoutePath +from vpp_ip import DpoProto class TemplateIpsecAh(TemplateIpsec): @@ -36,12 +39,16 @@ class TemplateIpsecAh(TemplateIpsec): self.tun_if = self.pg0 self.tra_if = self.pg2 self.logger.info(self.vapi.ppcli("show int addr")) - self.vapi.ipsec_spd_add_del(self.tun_spd_id) - self.vapi.ipsec_interface_add_del_spd(self.tun_spd_id, - self.tun_if.sw_if_index) - self.vapi.ipsec_spd_add_del(self.tra_spd_id) - self.vapi.ipsec_interface_add_del_spd(self.tra_spd_id, - self.tra_if.sw_if_index) + + self.tra_spd = VppIpsecSpd(self, self.tra_spd_id) + self.tra_spd.add_vpp_config() + VppIpsecSpdItfBinding(self, self.tra_spd, + self.tra_if).add_vpp_config() + self.tun_spd = VppIpsecSpd(self, self.tun_spd_id) + self.tun_spd.add_vpp_config() + VppIpsecSpdItfBinding(self, self.tun_spd, + self.tun_if).add_vpp_config() + for _, p in self.params.items(): self.config_ah_tra(p) self.configure_sa_tra(p) @@ -50,74 +57,20 @@ class TemplateIpsecAh(TemplateIpsec): self.config_ah_tun(p) self.logger.info(self.vapi.ppcli("show ipsec")) for _, p in self.params.items(): - src = socket.inet_pton(p.addr_type, p.remote_tun_if_host) - self.vapi.ip_add_del_route(src, p.addr_len, - self.tun_if.remote_addr_n[p.addr_type], - is_ipv6=p.is_ipv6) + d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4 + VppIpRoute(self, p.remote_tun_if_host, p.addr_len, + [VppRoutePath(self.tun_if.remote_addr[p.addr_type], + 0xffffffff, + proto=d)], + is_ip6=p.is_ipv6).add_vpp_config() - def config_ah_tun(self, params): - addr_type = params.addr_type - is_ipv6 = params.is_ipv6 - scapy_tun_sa_id = params.scapy_tun_sa_id - scapy_tun_spi = params.scapy_tun_spi - vpp_tun_sa_id = params.vpp_tun_sa_id - vpp_tun_spi = params.vpp_tun_spi - auth_algo_vpp_id = params.auth_algo_vpp_id - auth_key = params.auth_key - crypt_algo_vpp_id = params.crypt_algo_vpp_id - crypt_key = params.crypt_key - remote_tun_if_host = params.remote_tun_if_host - addr_any = params.addr_any - addr_bcast = params.addr_bcast - self.vapi.ipsec_sad_add_del_entry(scapy_tun_sa_id, scapy_tun_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, - self.tun_if.local_addr_n[addr_type], - self.tun_if.remote_addr_n[addr_type], - is_tunnel=1, is_tunnel_ipv6=is_ipv6) - self.vapi.ipsec_sad_add_del_entry(vpp_tun_sa_id, vpp_tun_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, - self.tun_if.remote_addr_n[addr_type], - self.tun_if.local_addr_n[addr_type], - is_tunnel=1, is_tunnel_ipv6=is_ipv6) - l_startaddr = r_startaddr = socket.inet_pton(addr_type, addr_any) - l_stopaddr = r_stopaddr = socket.inet_pton(addr_type, addr_bcast) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_outbound=0, - is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH) - l_startaddr = l_stopaddr = socket.inet_pton(addr_type, - remote_tun_if_host) - r_startaddr = r_stopaddr = self.pg1.remote_addr_n[addr_type] - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=10, policy=3, - is_outbound=0, is_ipv6=is_ipv6) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id, - r_startaddr, r_stopaddr, l_startaddr, - l_stopaddr, priority=10, policy=3, - is_ipv6=is_ipv6) - r_startaddr = r_stopaddr = self.pg0.local_addr_n[addr_type] - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=20, policy=3, - is_outbound=0, is_ipv6=is_ipv6) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id, - r_startaddr, r_stopaddr, l_startaddr, - l_stopaddr, priority=20, policy=3, - is_ipv6=is_ipv6) + def tearDown(self): + super(TemplateIpsecAh, self).tearDown() + if not self.vpp_dead: + self.vapi.cli("show hardware") - def unconfig_ah_tun(self, params): + def config_ah_tun(self, params): addr_type = params.addr_type - is_ipv6 = params.is_ipv6 scapy_tun_sa_id = params.scapy_tun_sa_id scapy_tun_spi = params.scapy_tun_spi vpp_tun_sa_id = params.vpp_tun_sa_id @@ -129,62 +82,59 @@ class TemplateIpsecAh(TemplateIpsec): remote_tun_if_host = params.remote_tun_if_host addr_any = params.addr_any addr_bcast = params.addr_bcast - l_startaddr = l_stopaddr = socket.inet_pton(addr_type, - remote_tun_if_host) - r_startaddr = r_stopaddr = self.pg0.local_addr_n[addr_type] - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=20, policy=3, - is_outbound=0, is_ipv6=is_ipv6, - is_add=0) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id, - r_startaddr, r_stopaddr, l_startaddr, - l_stopaddr, priority=20, policy=3, - is_ipv6=is_ipv6, - is_add=0) - r_startaddr = r_stopaddr = self.pg1.remote_addr_n[addr_type] - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=10, policy=3, - is_outbound=0, is_ipv6=is_ipv6, - is_add=0) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, scapy_tun_sa_id, - r_startaddr, r_stopaddr, l_startaddr, - l_stopaddr, priority=10, policy=3, - is_ipv6=is_ipv6, is_add=0) - l_startaddr = r_startaddr = socket.inet_pton(addr_type, addr_any) - l_stopaddr = r_stopaddr = socket.inet_pton(addr_type, addr_bcast) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH, - is_add=0) - self.vapi.ipsec_spd_add_del_entry(self.tun_spd_id, vpp_tun_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_outbound=0, - is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH, - is_add=0) - self.vapi.ipsec_sad_add_del_entry(scapy_tun_sa_id, scapy_tun_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, - self.tun_if.local_addr_n[addr_type], - self.tun_if.remote_addr_n[addr_type], - is_tunnel=1, is_tunnel_ipv6=is_ipv6, - is_add=0) - self.vapi.ipsec_sad_add_del_entry(vpp_tun_sa_id, vpp_tun_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, - self.tun_if.remote_addr_n[addr_type], - self.tun_if.local_addr_n[addr_type], - is_tunnel=1, is_tunnel_ipv6=is_ipv6, - is_add=0) + VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi, + auth_algo_vpp_id, auth_key, + crypt_algo_vpp_id, crypt_key, + self.vpp_ah_protocol, + self.tun_if.local_addr[addr_type], + self.tun_if.remote_addr[addr_type]).add_vpp_config() + VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi, + auth_algo_vpp_id, auth_key, + crypt_algo_vpp_id, crypt_key, + self.vpp_ah_protocol, + self.tun_if.remote_addr[addr_type], + self.tun_if.local_addr[addr_type]).add_vpp_config() + + VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, + addr_any, addr_bcast, + addr_any, addr_bcast, + socket.IPPROTO_AH).add_vpp_config() + VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, + addr_any, addr_bcast, + addr_any, addr_bcast, + socket.IPPROTO_AH, + is_outbound=0).add_vpp_config() + + VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, + remote_tun_if_host, + remote_tun_if_host, + self.pg1.remote_addr[addr_type], + self.pg1.remote_addr[addr_type], + 0, priority=10, policy=3, + is_outbound=0).add_vpp_config() + VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id, + self.pg1.remote_addr[addr_type], + self.pg1.remote_addr[addr_type], + remote_tun_if_host, + remote_tun_if_host, + 0, priority=10, policy=3).add_vpp_config() + + VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, + remote_tun_if_host, + remote_tun_if_host, + self.pg0.local_addr[addr_type], + self.pg0.local_addr[addr_type], + 0, priority=20, policy=3, + is_outbound=0).add_vpp_config() + VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id, + self.pg0.local_addr[addr_type], + self.pg0.local_addr[addr_type], + remote_tun_if_host, + remote_tun_if_host, + 0, priority=20, policy=3).add_vpp_config() def config_ah_tra(self, params): addr_type = params.addr_type - is_ipv6 = params.is_ipv6 scapy_tra_sa_id = params.scapy_tra_sa_id scapy_tra_spi = params.scapy_tra_spi vpp_tra_sa_id = params.vpp_tra_sa_id @@ -195,117 +145,41 @@ class TemplateIpsecAh(TemplateIpsec): crypt_key = params.crypt_key addr_any = params.addr_any addr_bcast = params.addr_bcast - self.vapi.ipsec_sad_add_del_entry(scapy_tra_sa_id, scapy_tra_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, is_tunnel=0, - is_tunnel_ipv6=0, - use_anti_replay=1) - self.vapi.ipsec_sad_add_del_entry(vpp_tra_sa_id, vpp_tra_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, is_tunnel=0, - is_tunnel_ipv6=0, - use_anti_replay=1) - l_startaddr = r_startaddr = socket.inet_pton(addr_type, addr_any) - l_stopaddr = r_stopaddr = socket.inet_pton(addr_type, addr_bcast) - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, vpp_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH) - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, scapy_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_outbound=0, - is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH) - l_startaddr = l_stopaddr = self.tra_if.local_addr_n[addr_type] - r_startaddr = r_stopaddr = self.tra_if.remote_addr_n[addr_type] - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, vpp_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=10, policy=3, - is_outbound=0, is_ipv6=is_ipv6) - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, scapy_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=10, - policy=3, is_ipv6=is_ipv6) - def unconfig_ah_tra(self, params): - addr_type = params.addr_type - is_ipv6 = params.is_ipv6 - scapy_tra_sa_id = params.scapy_tra_sa_id - scapy_tra_spi = params.scapy_tra_spi - vpp_tra_sa_id = params.vpp_tra_sa_id - vpp_tra_spi = params.vpp_tra_spi - auth_algo_vpp_id = params.auth_algo_vpp_id - auth_key = params.auth_key - crypt_algo_vpp_id = params.crypt_algo_vpp_id - crypt_key = params.crypt_key - addr_any = params.addr_any - addr_bcast = params.addr_bcast - l_startaddr = r_startaddr = socket.inet_pton(addr_type, addr_any) - l_stopaddr = r_stopaddr = socket.inet_pton(addr_type, addr_bcast) - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, vpp_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH, - is_add=0) - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, scapy_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, is_outbound=0, - is_ipv6=is_ipv6, - protocol=socket.IPPROTO_AH, - is_add=0) - l_startaddr = l_stopaddr = self.tra_if.local_addr_n[addr_type] - r_startaddr = r_stopaddr = self.tra_if.remote_addr_n[addr_type] - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, vpp_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=10, policy=3, - is_outbound=0, is_ipv6=is_ipv6, - is_add=0) - self.vapi.ipsec_spd_add_del_entry(self.tra_spd_id, scapy_tra_sa_id, - l_startaddr, l_stopaddr, r_startaddr, - r_stopaddr, priority=10, - policy=3, is_ipv6=is_ipv6, - is_add=0) - self.vapi.ipsec_sad_add_del_entry(scapy_tra_sa_id, scapy_tra_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, is_tunnel=0, - is_tunnel_ipv6=0, - use_anti_replay=1, - is_add=0) - self.vapi.ipsec_sad_add_del_entry(vpp_tra_sa_id, vpp_tra_spi, - auth_algo_vpp_id, auth_key, - crypt_algo_vpp_id, crypt_key, - self.vpp_ah_protocol, is_tunnel=0, - is_tunnel_ipv6=0, - use_anti_replay=1, - is_add=0) - - def tearDown(self): - for _, p in self.params.items(): - self.unconfig_ah_tun(p) - for _, p in self.params.items(): - self.unconfig_ah_tra(p) - - self.vapi.ipsec_interface_add_del_spd(self.tun_spd_id, - self.tun_if.sw_if_index, - is_add=0) - self.vapi.ipsec_spd_add_del(self.tun_spd_id, is_add=0) - self.vapi.ipsec_interface_add_del_spd(self.tra_spd_id, - self.tra_if.sw_if_index, - is_add=0) - self.vapi.ipsec_spd_add_del(self.tra_spd_id, - is_add=0) - for _, p in self.params.items(): - src = socket.inet_pton(p.addr_type, p.remote_tun_if_host) - self.vapi.ip_add_del_route( - src, p.addr_len, self.tun_if.remote_addr_n[p.addr_type], - is_ipv6=p.is_ipv6, is_add=0) - - super(TemplateIpsecAh, self).tearDown() - if not self.vpp_dead: - self.vapi.cli("show hardware") + VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi, + auth_algo_vpp_id, auth_key, + crypt_algo_vpp_id, crypt_key, + self.vpp_ah_protocol, + use_anti_replay=1).add_vpp_config() + VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi, + auth_algo_vpp_id, auth_key, + crypt_algo_vpp_id, crypt_key, + self.vpp_ah_protocol, + use_anti_replay=1).add_vpp_config() + + VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id, + addr_any, addr_bcast, + addr_any, addr_bcast, + socket.IPPROTO_AH).add_vpp_config() + VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id, + addr_any, addr_bcast, + addr_any, addr_bcast, + socket.IPPROTO_AH, + is_outbound=0).add_vpp_config() + + VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id, + self.tra_if.local_addr[addr_type], + self.tra_if.local_addr[addr_type], + self.tra_if.remote_addr[addr_type], + self.tra_if.remote_addr[addr_type], + 0, priority=10, policy=3, + is_outbound=0).add_vpp_config() + VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id, + self.tra_if.local_addr[addr_type], + self.tra_if.local_addr[addr_type], + self.tra_if.remote_addr[addr_type], + self.tra_if.remote_addr[addr_type], + 0, priority=10, policy=3).add_vpp_config() class TestIpsecAh1(TemplateIpsecAh, IpsecTraTests, IpsecTunTests): |