import unittest import socket import struct from scapy.layers.inet import IP, ICMP, TCP, UDP from scapy.layers.ipsec import SecurityAssociation, ESP from scapy.layers.l2 import Ether from scapy.packet import Raw from scapy.layers.inet6 import IPv6, ICMPv6EchoRequest, IPv6ExtHdrHopByHop, \ IPv6ExtHdrFragment, IPv6ExtHdrDestOpt from framework import VppTestCase, VppTestRunner from util import ppp, reassemble4, fragment_rfc791, fragment_rfc8200 from vpp_papi import VppEnum class IPsecIPv4Params(object): addr_type = socket.AF_INET addr_any = "0.0.0.0" addr_bcast = "255.255.255.255" addr_len = 32 is_ipv6 = 0 def __init__(self): self.remote_tun_if_host = '1.1.1.1' self.remote_tun_if_host6 = '1111::1' self.scapy_tun_sa_id = 10 self.scapy_tun_spi = 1001 self.vpp_tun_sa_id = 20 self.vpp_tun_spi = 1000 self.scapy_tra_sa_id = 30 self.scapy_tra_spi = 2001 self.vpp_tra_sa_id = 40 self.vpp_tra_spi = 2000 self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96) self.auth_algo = 'HMAC-SHA1-96' # scapy name self.auth_key = b'C91KUR9GYMm5GfkEvNjX' self.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CBC_128) self.crypt_algo = 'AES-CBC' # scapy name self.crypt_key = b'JPjyOWBeVEQiMe7h' self.salt = 0 self.flags = 0 self.nat_header = None class IPsecIPv6Params(object): addr_type = socket.AF_INET6 addr_any = "0::0" addr_bcast = "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" addr_len = 128 is_ipv6 = 1 def __init__(self): self.remote_tun_if_host = '1111:1111:1111:1111:1111:1111:1111:1111' self.remote_tun_if_host4 = '1.1.1.1' self.scapy_tun_sa_id = 50 self.scapy_tun_spi = 3001 self.vpp_tun_sa_id = 60 self.vpp_tun_spi = 3000 self.scapy_tra_sa_id = 70 self.scapy_tra_spi = 4001 self.vpp_tra_sa_id = 80 self.vpp_tra_spi = 4000 self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96) self.auth_algo = 'HMAC-SHA1-96' # scapy name self.auth_key = b'C91KUR9GYMm5GfkEvNjX' self.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CBC_128) self.crypt_algo = 'AES-CBC' # scapy name self.crypt_key = b'JPjyOWBeVEQiMe7h' self.salt = 0 self.flags = 0 self.nat_header = None def mk_scapy_crypt_key(p): if p.crypt_algo == "AES-GCM": return p.crypt_key + struct.pack("!I", p.salt) else: return p.crypt_key def config_tun_params(p, encryption_type, tun_if): ip_class_by_addr_type = {socket.AF_INET: IP, socket.AF_INET6: IPv6} esn_en = bool(p.flags & (VppEnum.vl_api_ipsec_sad_flags_t. IPSEC_API_SAD_FLAG_USE_ESN)) p.tun_dst = tun_if.remote_addr[p.addr_type] p.tun_src = tun_if.local_addr[p.addr_type] crypt_key = mk_scapy_crypt_key(p) p.scapy_tun_sa = SecurityAssociation( encryption_type, spi=p.vpp_tun_spi, crypt_algo=p.crypt_algo, crypt_key=crypt_key, auth_algo=p.auth_algo, auth_key=p.auth_key, tunnel_header=ip_class_by_addr_type[p.addr_type]( src=p.tun_dst, dst=p.tun_src), nat_t_header=p.nat_header, esn_en=esn_en) p.vpp_tun_sa = SecurityAssociation( encryption_type, spi=p.scapy_tun_spi, crypt_algo=p.crypt_algo, crypt_key=crypt_key, auth_algo=p.auth_algo, auth_key=p.auth_key, tunnel_header=ip_class_by_addr_type[p.addr_type]( dst=p.tun_dst, src=p.tun_src), nat_t_header=p.nat_header, esn_en=esn_en) def config_tra_params(p, encryption_type): esn_en = bool(p.flags & (VppEnum.vl_api_ipsec_sad_flags_t. IPSEC_API_SAD_FLAG_USE_ESN)) crypt_key = mk_scapy_crypt_key(p) p.scapy_tra_sa = SecurityAssociation( encryption_type, spi=p.vpp_tra_spi, crypt_algo=p.crypt_algo, crypt_key=crypt_key, auth_algo=p.auth_algo, auth_key=p.auth_key, nat_t_header=p.nat_header, esn_en=esn_en) p.vpp_tra_sa = SecurityAssociation( encryption_type, spi=p.scapy_tra_spi, crypt_algo=p.crypt_algo, crypt_key=crypt_key, auth_algo=p.auth_algo, auth_key=p.auth_key, nat_t_header=p.nat_header, esn_en=esn_en) class TemplateIpsec(VppTestCase): """ TRANSPORT MODE: ------ encrypt --- |tra_if| <-------> |VPP| ------ decrypt --- TUNNEL MODE: ------ encrypt --- plain --- |tun_if| <------- |VPP| <------ |pg1| ------ --- --- ------ decrypt --- plain --- |tun_if| -------> |VPP| ------> |pg1| ------ --- --- """ tun_spd_id = 1 tra_spd_id = 2 def ipsec_select_backend(self): """ empty method to be overloaded when necessary """ pass @classmethod def setUpClass(cls): super(TemplateIpsec, cls).setUpClass() @classmethod def tearDownClass(cls): super(TemplateIpsec, cls).tearDownClass() def setup_params(self): self.ipv4_params = IPsecIPv4Params() self.ipv6_params = IPsecIPv6Params() self.params = {self.ipv4_params.addr_type: self.ipv4_params, self.ipv6_params.addr_type: self.ipv6_params} def config_interfaces(self): self.create_pg_interfaces(range(3)) self.interfaces = list(self.pg_interfaces) for i in self.interfaces: i.admin_up() i.config_ip4() i.resolve_arp() i.config_ip6() i.resolve_ndp() def setUp(self): super(TemplateIpsec, self).setUp() self.setup_params() self.vpp_esp_protocol = (VppEnum.vl_api_ipsec_proto_t. IPSEC_API_PROTO_ESP) self.vpp_ah_protocol = (VppEnum.vl_api_ipsec_proto_t. IPSEC_API_PROTO_AH) self.config_interfaces() self.ipsec_select_backend() def unconfig_interfaces(self): for i in self.interfaces: i.admin_down() i.unconfig_ip4() i.unconfig_ip6() def tearDown(self): super(TemplateIpsec, self).tearDown() self.unconfig_interfaces() def show_commands_at_teardown(self): self.logger.info(self.vapi.cli("show hardware")) def gen_encrypt_pkts(self, sa, sw_intf, src, dst, count=1, payload_size=54): return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / sa.encrypt(IP(src=src, dst=dst) / ICMP() / Raw(b'X' * payload_size)) for i in range(count)] def gen_encrypt_pkts6(self, sa, sw_intf, src, dst, count=1, payload_size=54): return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / sa.encrypt(IPv6(src=src, dst=dst) / ICMPv6EchoRequest(id=0, seq=1, data='X' * payload_size)) for i in range(count)] def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / IP(src=src, dst=dst) / ICMP() / Raw(b'X' * payload_size) for i in range(count)] def gen_pkts6(self, sw_intf, src, dst, count=1, payload_size=54): return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / IPv6(src=src, dst=dst) / ICMPv6EchoRequest(id=0, seq=1, data='X' * payload_size) for i in range(count)] class IpsecTcp(object): def verify_tcp_checksum(self): self.vapi.cli("test http server") p = self.params[socket.AF_INET] send = (Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac) / p.scapy_tun_sa.encrypt(IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4) / TCP(flags='S', dport=80))) self.logger.debug(ppp("Sending packet:", send)) recv = self.send_and_expect(self.tun_if, [send], self.tun_if) recv = recv[0] decrypted = p.vpp_tun_sa.decrypt(recv[IP]) self.assert_packet_checksums_valid(decrypted) class IpsecTcpTests(IpsecTcp): def test_tcp_checksum(self): """ verify checksum correctness for vpp generated packets """ self.verify_tcp_checksum() class IpsecTra4(object): """ verify methods for Transport v4 """ def verify_tra_anti_replay(self): p = self.params[socket.AF_INET] esn_en = p.vpp_tra_sa.esn_en seq_cycle_node_name = ('/err/%s/sequence number cycled' % self.tra4_encrypt_node_name) replay_node_name = ('/err/%s/SA replayed packet' % self.tra4_decrypt_node_name) if ESP == self.encryption_type and p.crypt_algo == "AES-GCM": hash_failed_node_name = ('/err/%s/ESP decryption failed' % self.tra4_d
/*
*------------------------------------------------------------------
* vat_helper_macros.h - collect api client helper macros in one place
*
* Copyright (c) 2016 Cisco and/or its affiliates.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*------------------------------------------------------------------
*/
#ifndef __vat_helper_macros_h__
#define __vat_helper_macros_h__
/* M: construct, but don't yet send a message */
#define M(T, mp) \
do { \
socket_client_main_t *scm = vam->socket_client_main; \
vam->result_ready = 0; \
if (scm && scm->socket_enable) \
mp = vl_socket_client_msg_alloc (sizeof(*mp)); \
else \
mp = vl_msg_api_alloc_as_if_client(sizeof(*mp)); \
clib_memset (mp, 0, sizeof (*mp)); \
mp->_vl_msg_id = ntohs (VL_API_##T+__plugin_msg_base); \
mp->client_index = vam->my_client_index; \
} while(0);
/* MPING: construct a control-ping message, don't send it yet */
#define MPING(T, mp) \
do { \
socket_client_main_t *scm = vam->socket_client_main; \
vam->result_ready = 0; \
if (scm && scm->socket_enable) \
mp = vl_socket_client_msg_alloc (sizeof(*mp)); \
else \
mp = vl_msg_api_alloc_as_if_client(sizeof(*mp)); \
clib_memset (mp, 0, sizeof (*mp)); \
mp->_vl_msg_id = ntohs (VL_API_##T+__plugin_msg_base); \
mp->client_index = vam->my_client_index; \
if (scm) \
scm->control_pings_outstanding++; \
} while(0);
#define M2(T, mp, n) \
do { \
socket_client_main_t *scm = vam->socket_client_main; \
vam->result_ready = 0; \
if (scm && scm->socket_enable) \
mp = vl_socket_client_msg_alloc (sizeof(*mp) + n); \
else \
mp = vl_msg_api_alloc_as_if_client(sizeof(*mp) + n); \
clib_memset (mp, 0, sizeof (*mp)); \
mp->_vl_msg_id = ntohs (VL_API_##T+__plugin_msg_base); \
mp->client_index = vam->my_client_index; \
} while(0);
#define PING(_tm, mp_ping) \
do \
{ \
socket_client_main_t *scm = vam->socket_client_main; \
if (scm && scm->socket_enable) \
mp_ping = vl_socket_client_msg_alloc (sizeof (*mp_ping)); \
else \
mp_ping = vl_msg_api_alloc_as_if_client (sizeof (*mp_ping)); \
mp_ping->_vl_msg_id = htons (VL_API_CONTROL_PING + 1); \
mp_ping->client_index = vam->my_client_index; \
vam->result_ready = 0; \
if (scm) \
scm->control_pings_outstanding++; \
} \
while (0);
/* S: send a message */
#define S(mp) \
do { \
socket_client_main_t *scm = vam->socket_client_main; \
if (scm && scm->socket_enable) \
vl_socket_client_write (); \
else \
vl_msg_api_send_shmem (vam->vl_input_queue, (u8 *)&mp); \
} while (0);
/* W: wait for results, with timeout */
#define W(ret) \
do { \
f64 timeout = vat_time_now (vam) + 1.0; \
socket_client_main_t *scm = vam->socket_client_main; \
ret = -99; \
\
if (scm && scm->socket_enable) \
vl_socket_client_read (5); \
while (vat_time_now (vam) < timeout) { \
if (vam->result_ready == 1) { \
ret = vam->retval; \
break; \
} \
vat_suspend (vam->vlib_main, 1e-5); \
} \
} while(0);
/* W2: wait for results, with timeout */ \
#define W2(ret, body) \
do { \
f64 timeout = vat_time_now (vam) + 1.0; \
socket_client_main_t *scm = vam->socket_client_main; \
ret = -99; \
\
if (scm && scm->socket_enable) \
vl_socket_client_read (5); \
while (vat_time_now (vam) < timeout) { \
if (vam->result_ready == 1) { \
(body); \
ret = vam->retval; \
break; \
} \
vat_suspend (vam->vlib_main, 1e-5); \
} \
} while(0);
#define VAT_PLUGIN_REGISTER(plug) \
clib_error_t * vat_plugin_register (vat_main_t *vam) \
{ \
plug##_test_main_t * mp = &plug##_test_main; \
u8 * name; \
\
mp->vat_main = vam; \
\
/* Ask the vpp engine for the first assigned message-id */ \
name = format (0, #plug "_%08x%c", api_version, 0); \
mp->msg_id_base = \
vl_client_get_first_plugin_msg_id ((char *) name); \
vec_free(name); \
\
if (mp->msg_id_base != (u16) ~0) \
plug##_api_hookup (vam); \
else \
return clib_error_return (0, #plug " plugin not loaded...");\
return 0; \
}
#endif /* __vat_helper_macros_h__ */