summaryrefslogtreecommitdiffstats
path: root/src/vnet/devices/af_packet/af_packet.c
blob: f1a7b6ad21ca0dbb0c6db6cf630590d6f157c816 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
/*
 *------------------------------------------------------------------
 * af_packet.c - linux kernel packet interface
 *
 * Copyright (c) 2016 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *------------------------------------------------------------------
 */

#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>

#include <vppinfra/linux/sysfs.h>
#include <vlib/vlib.h>
#include <vlib/unix/unix.h>
#include <vnet/ip/ip.h>
#include <vnet/ethernet/ethernet.h>

#include <vnet/devices/af_packet/af_packet.h>

af_packet_main_t af_packet_main;

#define AF_PACKET_TX_FRAMES_PER_BLOCK	1024
#define AF_PACKET_TX_FRAME_SIZE	 	(2048 * 5)
#define AF_PACKET_TX_BLOCK_NR		1
#define AF_PACKET_TX_FRAME_NR		(AF_PACKET_TX_BLOCK_NR * \
					 AF_PACKET_TX_FRAMES_PER_BLOCK)
#define AF_PACKET_TX_BLOCK_SIZE	 	(AF_PACKET_TX_FRAME_SIZE * \
					 AF_PACKET_TX_FRAMES_PER_BLOCK)

#define AF_PACKET_RX_FRAMES_PER_BLOCK	1024
#define AF_PACKET_RX_FRAME_SIZE	 	(2048 * 5)
#define AF_PACKET_RX_BLOCK_NR		1
#define AF_PACKET_RX_FRAME_NR		(AF_PACKET_RX_BLOCK_NR * \
					 AF_PACKET_RX_FRAMES_PER_BLOCK)
#define AF_PACKET_RX_BLOCK_SIZE		(AF_PACKET_RX_FRAME_SIZE * \
					 AF_PACKET_RX_FRAMES_PER_BLOCK)

/*defined in net/if.h but clashes with dpdk headers */
unsigned int if_nametoindex (const char *ifname);

typedef struct tpacket_req tpacket_req_t;

static u32
af_packet_eth_flag_change (vnet_main_t * vnm, vnet_hw_interface_t * hi,
			   u32 flags)
{
  clib_error_t *error;
  u8 *s;
  af_packet_main_t *apm = &af_packet_main;
  af_packet_if_t *apif =
    pool_elt_at_index (apm->interfaces, hi->dev_instance);

  if (ETHERNET_INTERFACE_FLAG_MTU == (flags & ETHERNET_INTERFACE_FLAG_MTU))
    {
      s = format (0, "/sys/class/net/%s/mtu%c", apif->host_if_name, 0);

      error = clib_sysfs_write ((char *) s, "%d", hi->max_packet_bytes);
      vec_free (s);

      if (error)
	{
	  vlib_log_err (apm->log_class,
			"sysfs write failed to change MTU: %U",
			format_clib_error, error);
	  clib_error_free (error);
	  return VNET_API_ERROR_SYSCALL_ERROR_1;
	}
    }

  return 0;
}

static clib_error_t *
af_packet_fd_read_ready (clib_file_t * uf)
{
  af_packet_main_t *apm = &af_packet_main;
  vnet_main_t *vnm = vnet_get_main ();
  u32 idx = uf->private_data;
  af_packet_if_t *apif = pool_elt_at_index (apm->interfaces, idx);

  apm->pending_input_bitmap =
    clib_bitmap_set (apm->pending_input_bitmap, idx, 1);

  /* Schedule the rx node */
  vnet_device_input_set_interrupt_pending (vnm, apif->hw_if_index, 0);

  return 0;
}

static int
is_bridge (const u8 * host_if_name)
{
  u8 *s;
  DIR *dir = NULL;

  s = format (0, "/sys/class/net/%s/bridge%c", host_if_name, 0);
  dir = opendir ((char *) s);
  vec_free (s);

  if (dir)
    {
      closedir (dir);
      return 0;
    }

  return -1;
}

static int
create_packet_v2_sock (int host_if_index, tpacket_req_t * rx_req,
		       tpacket_req_t * tx_req, int *fd, u8 ** ring)
{
  af_packet_main_t *apm = &af_packet_main;
  int ret, err;
  struct sockaddr_ll sll;
  int ver = TPACKET_V2;
  socklen_t req_sz = sizeof (struct tpacket_req);
  u32 ring_sz = rx_req->tp_block_size * rx_req->tp_block_nr +
    tx_req->tp_block_size * tx_req->tp_block_nr;

  if ((*fd = socket (AF_PACKET, SOCK_RAW, htons (ETH_P_ALL))) < 0)
    {
      vlib_log_debug (apm->log_class, "Failed to create socket");
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  /* bind before rx ring is cfged so we don't receive packets from other interfaces */
  memset (&sll, 0, sizeof (sll));
  sll.sll_family = PF_PACKET;
  sll.sll_protocol = htons (ETH_P_ALL);
  sll.sll_ifindex = host_if_index;
  if ((err = bind (*fd, (struct sockaddr *) &sll, sizeof (sll))) < 0)
    {
      vlib_log_debug (apm->log_class,
		      "Failed to bind rx packet socket (error %d)", err);
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  if ((err =
       setsockopt (*fd, SOL_PACKET, PACKET_VERSION, &ver, sizeof (ver))) < 0)
    {
      vlib_log_debug (apm->log_class,
		      "Failed to set rx packet interface version");
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  int opt = 1;
  if ((err =
       setsockopt (*fd, SOL_PACKET, PACKET_LOSS, &opt, sizeof (opt))) < 0)
    {
      vlib_log_debug (apm->log_class,
		      "Failed to set packet tx ring error handling option");
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  if ((err =
       setsockopt (*fd, SOL_PACKET, PACKET_RX_RING, rx_req, req_sz)) < 0)
    {
      vlib_log_debug (apm->log_class, "Failed to set packet rx ring options");
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  if ((err =
       setsockopt (*fd, SOL_PACKET, PACKET_TX_RING, tx_req, req_sz)) < 0)
    {
      vlib_log_debug (apm->log_class, "Failed to set packet tx ring options");
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  *ring =
    mmap (NULL, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_LOCKED, *fd,
	  0);
  if (*ring == MAP_FAILED)
    {
      vlib_log_debug (apm->log_class, "mmap failure");
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  return 0;
error:
  if (*fd >= 0)
    close (*fd);
  *fd = -1;
  return ret;
}

int
af_packet_create_if (vlib_main_t * vm, u8 * host_if_name, u8 * hw_addr_set,
		     u32 * sw_if_index)
{
  af_packet_main_t *apm = &af_packet_main;
  int ret, fd = -1, fd2 = -1;
  struct tpacket_req *rx_req = 0;
  struct tpacket_req *tx_req = 0;
  struct ifreq ifr;
  u8 *ring = 0;
  af_packet_if_t *apif = 0;
  u8 hw_addr[6];
  clib_error_t *error;
  vnet_sw_interface_t *sw;
  vnet_hw_interface_t *hw;
  vlib_thread_main_t *tm = vlib_get_thread_main ();
  vnet_main_t *vnm = vnet_get_main ();
  uword *p;
  uword if_index;
  u8 *host_if_name_dup = vec_dup (host_if_name);
  int host_if_index = -1;

  p = mhash_get (&apm->if_index_by_host_if_name, host_if_name);
  if (p)
    {
      apif = vec_elt_at_index (apm->interfaces, p[0]);
      *sw_if_index = apif->sw_if_index;
      return VNET_API_ERROR_IF_ALREADY_EXISTS;
    }

  vec_validate (rx_req, 0);
  rx_req->tp_block_size = AF_PACKET_RX_BLOCK_SIZE;
  rx_req->tp_frame_size = AF_PACKET_RX_FRAME_SIZE;
  rx_req->tp_block_nr = AF_PACKET_RX_BLOCK_NR;
  rx_req->tp_frame_nr = AF_PACKET_RX_FRAME_NR;

  vec_validate (tx_req, 0);
  tx_req->tp_block_size = AF_PACKET_TX_BLOCK_SIZE;
  tx_req->tp_frame_size = AF_PACKET_TX_FRAME_SIZE;
  tx_req->tp_block_nr = AF_PACKET_TX_BLOCK_NR;
  tx_req->tp_frame_nr = AF_PACKET_TX_FRAME_NR;

  /*
   * make sure host side of interface is 'UP' before binding AF_PACKET
   * socket on it.
   */
  if ((fd2 = socket (AF_UNIX, SOCK_DGRAM, 0)) < 0)
    {
      vlib_log_debug (apm->log_class, "Failed to create socket");
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  clib_memcpy (ifr.ifr_name, (const char *) host_if_name,
	       vec_len (host_if_name));
  if ((ret = ioctl (fd2, SIOCGIFINDEX, &ifr)) < 0)
    {
      vlib_log_debug (apm->log_class, "af_packet_create error: %d", ret);
      close (fd2);
      return VNET_API_ERROR_INVALID_INTERFACE;
    }

  host_if_index = ifr.ifr_ifindex;
  if ((ret = ioctl (fd2, SIOCGIFFLAGS, &ifr)) < 0)
    {
      vlib_log_warn (apm->log_class, "af_packet_create error: %d", ret);
      goto error;
    }

  if (!(ifr.ifr_flags & IFF_UP))
    {
      ifr.ifr_flags |= IFF_UP;
      if ((ret = ioctl (fd2, SIOCSIFFLAGS, &ifr)) < 0)
	{
	  vlib_log_warn (apm->log_class, "af_packet_create error: %d", ret);
	  goto error;
	}
    }

  if (fd2 > -1)
    close (fd2);

  ret = create_packet_v2_sock (host_if_index, rx_req, tx_req, &fd, &ring);

  if (ret != 0)
    goto error;

  ret = is_bridge (host_if_name);

  if (ret == 0)			/* is a bridge, ignore state */
    host_if_index = -1;

  /* So far everything looks good, let's create interface */
  pool_get (apm->interfaces, apif);
  if_index = apif - apm->interfaces;

  apif->host_if_index = host_if_index;
  apif->fd = fd;
  apif->rx_ring = ring;
  apif->tx_ring = ring + rx_req->tp_block_size * rx_req->tp_block_nr;
  apif->rx_req = rx_req;
  apif->tx_req = tx_req;
  apif->host_if_name = host_if_name_dup;
  apif->per_interface_next_index = ~0;
  apif->next_tx_frame = 0;
  apif->next_rx_frame = 0;

  if (tm->n_vlib_mains > 1)
    clib_spinlock_init (&apif->lockp);

  {
    clib_file_t template = { 0 };
    template.read_function = af_packet_fd_read_ready;
    template.file_descriptor = fd;
    template.private_data = if_index;
    template.flags = UNIX_FILE_EVENT_EDGE_TRIGGERED;
    template.description = format (0, "%U", format_af_packet_device_name,
				   if_index);
    apif->clib_file_index = clib_file_add (&file_main, &template);
  }

  /*use configured or generate random MAC address */
  if (hw_addr_set)
    clib_memcpy (hw_addr, hw_addr_set, 6);
  else
    {
      f64 now = vlib_time_now (vm);
      u32 rnd;
      rnd = (u32) (now * 1e6);
      rnd = random_u32 (&rnd);

      clib_memcpy (hw_addr + 2, &rnd, sizeof (rnd));
      hw_addr[0] = 2;
      hw_addr[1] = 0xfe;
    }

  error = ethernet_register_interface (vnm, af_packet_device_class.index,
				       if_index, hw_addr, &apif->hw_if_index,
				       af_packet_eth_flag_change);

  if (error)
    {
      memset (apif, 0, sizeof (*apif));
      pool_put (apm->interfaces, apif);
      vlib_log_err (apm->log_class, "Unable to register interface: %U",
		    format_clib_error, error);
      clib_error_free (error);
      ret = VNET_API_ERROR_SYSCALL_ERROR_1;
      goto error;
    }

  sw = vnet_get_hw_sw_interface (vnm, apif->hw_if_index);
  hw = vnet_get_hw_interface (vnm, apif->hw_if_index);
  apif->sw_if_index = sw->sw_if_index;
  vnet_hw_interface_set_input_node (vnm, apif->hw_if_index,
				    af_packet_input_node.index);

  vnet_hw_interface_assign_rx_thread (vnm, apif->hw_if_index, 0,	/* queue */
				      ~0 /* any cpu */ );

  hw->flags |= VNET_HW_INTERFACE_FLAG_SUPPORTS_INT_MODE;
  vnet_hw_interface_set_flags (vnm, apif->hw_if_index,
			       VNET_HW_INTERFACE_FLAG_LINK_UP);

  vnet_hw_interface_set_rx_mode (vnm, apif->hw_if_index, 0,
				 VNET_HW_INTERFACE_RX_MODE_INTERRUPT);

  mhash_set_mem (&apm->if_index_by_host_if_name, host_if_name_dup, &if_index,
		 0);
  if (sw_if_index)
    *sw_if_index = apif->sw_if_index;

  return 0;

error:
  if (fd2 > -1)
    close (fd2);
  vec_free (host_if_name_dup);
  vec_free (rx_req);
  vec_free (tx_req);
  return ret;
}

int
af_packet_delete_if (vlib_main_t * vm, u8 * host_if_name)
{
  vnet_main_t *vnm = vnet_get_main ();
  af_packet_main_t *apm = &af_packet_main;
  af_packet_if_t *apif;
  uword *p;
  uword if_index;
  u32 ring_sz;

  p = mhash_get (&apm->if_index_by_host_if_name, host_if_name);
  if (p == NULL)
    {
      vlib_log_warn (apm->log_class, "Host interface %s does not exist",
		     host_if_name);
      return VNET_API_ERROR_SYSCALL_ERROR_1;
    }
  apif = pool_elt_at_index (apm->interfaces, p[0]);
  if_index = apif - apm->interfaces;

  /* bring down the interface */
  vnet_hw_interface_set_flags (vnm, apif->hw_if_index, 0);
  vnet_hw_interface_unassign_rx_thread (vnm, apif->hw_if_index, 0);

  /* clean up */
  if (apif->clib_file_index != ~0)
    {
      clib_file_del (&file_main, file_main.file_pool + apif->clib_file_index);
      apif->clib_file_index = ~0;
    }
  else
    close (apif->fd);

  ring_sz = apif->rx_req->tp_block_size * apif->rx_req->tp_block_nr +
    apif->tx_req->tp_block_size * apif->tx_req->tp_block_nr;
  if (munmap (apif->rx_ring, ring_sz))
    vlib_log_warn (apm->log_class,
		   "Host interface %s could not free rx/tx ring",
		   host_if_name);
  apif->rx_ring = NULL;
  apif->tx_ring = NULL;
  apif->fd = -1;

  vec_free (apif->rx_req);
  apif->rx_req = NULL;
  vec_free (apif->tx_req);
  apif->tx_req = NULL;

  vec_free (apif->host_if_name);
  apif->host_if_name = NULL;
  apif->host_if_index = -1;

  mhash_unset (&apm->if_index_by_host_if_name, host_if_name, &if_index);

  ethernet_delete_interface (vnm, apif->hw_if_index);

  pool_put (apm->interfaces, apif);

  return 0;
}

int
af_packet_set_l4_cksum_offload (vlib_main_t * vm, u32 sw_if_index, u8 set)
{
  vnet_main_t *vnm = vnet_get_main ();
  vnet_hw_interface_t *hw;

  hw = vnet_get_sup_hw_interface (vnm, sw_if_index);

  if (hw->dev_class_index != af_packet_device_class.index)
    return VNET_API_ERROR_INVALID_INTERFACE;

  if (set)
    hw->flags &= ~VNET_HW_INTERFACE_FLAG_SUPPORTS_TX_L4_CKSUM_OFFLOAD;
  else
    hw->flags |= VNET_HW_INTERFACE_FLAG_SUPPORTS_TX_L4_CKSUM_OFFLOAD;

  return 0;
}

int
af_packet_dump_ifs (af_packet_if_detail_t ** out_af_packet_ifs)
{
  af_packet_main_t *apm = &af_packet_main;
  af_packet_if_t *apif;
  af_packet_if_detail_t *r_af_packet_ifs = NULL;
  af_packet_if_detail_t *af_packet_if = NULL;

  vec_foreach (apif, apm->interfaces)
  {
    vec_add2 (r_af_packet_ifs, af_packet_if, 1);
    af_packet_if->sw_if_index = apif->sw_if_index;
    if (apif->host_if_name)
      {
	clib_memcpy (af_packet_if->host_if_name, apif->host_if_name,
		     MIN (ARRAY_LEN (af_packet_if->host_if_name) - 1,
			  strlen ((const char *) apif->host_if_name)));
      }
  }

  *out_af_packet_ifs = r_af_packet_ifs;

  return 0;
}

static clib_error_t *
af_packet_init (vlib_main_t * vm)
{
  af_packet_main_t *apm = &af_packet_main;
  vlib_thread_main_t *tm = vlib_get_thread_main ();

  memset (apm, 0, sizeof (af_packet_main_t));

  mhash_init_vec_string (&apm->if_index_by_host_if_name, sizeof (uword));

  vec_validate_aligned (apm->rx_buffers, tm->n_vlib_mains - 1,
			CLIB_CACHE_LINE_BYTES);

  apm->log_class = vlib_log_register_class ("af_packet", 0);
  vlib_log_debug (apm->log_class, "initialized");

  return 0;
}

VLIB_INIT_FUNCTION (af_packet_init);

/*
 * fd.io coding-style-patch-verification: ON
 *
 * Local Variables:
 * eval: (c-set-style "gnu")
 * End:
 */
flags=flags, salt=salt) objs.append(params.tra_sa_in) objs.append(params.tra_sa_out) objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id, addr_any, addr_bcast, addr_any, addr_bcast, socket.IPPROTO_ESP)) objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id, addr_any, addr_bcast, addr_any, addr_bcast, socket.IPPROTO_ESP, is_outbound=0)) objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id, self.tra_if.local_addr[addr_type], self.tra_if.local_addr[addr_type], self.tra_if.remote_addr[addr_type], self.tra_if.remote_addr[addr_type], 0, priority=10, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=0)) objs.append(VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id, self.tra_if.local_addr[addr_type], self.tra_if.local_addr[addr_type], self.tra_if.remote_addr[addr_type], self.tra_if.remote_addr[addr_type], 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT, priority=10)) for o in objs: o.add_vpp_config() self.net_objs = self.net_objs + objs class TemplateIpsecEsp(ConfigIpsecESP): """ Basic test for ipsec esp sanity - tunnel and transport modes. Below 4 cases are covered as part of this test 1) ipsec esp v4 transport basic test - IPv4 Transport mode scenario using HMAC-SHA1-96 integrity algo 2) ipsec esp v4 transport burst test Above test for 257 pkts 3) ipsec esp 4o4 tunnel basic test - IPv4 Tunnel mode scenario using HMAC-SHA1-96 integrity algo 4) ipsec esp 4o4 tunnel burst test Above test for 257 pkts TRANSPORT MODE: --- encrypt --- |pg2| <-------> |VPP| --- decrypt --- TUNNEL MODE: --- encrypt --- plain --- |pg0| <------- |VPP| <------ |pg1| --- --- --- --- decrypt --- plain --- |pg0| -------> |VPP| ------> |pg1| --- --- --- """ @classmethod def setUpClass(cls): super(TemplateIpsecEsp, cls).setUpClass() @classmethod def tearDownClass(cls): super(TemplateIpsecEsp, cls).tearDownClass() def setUp(self): super(TemplateIpsecEsp, self).setUp() self.config_network(self.params.values()) def tearDown(self): self.unconfig_network() super(TemplateIpsecEsp, self).tearDown() class TestIpsecEsp1(TemplateIpsecEsp, IpsecTra46Tests, IpsecTun46Tests, IpsecTra6ExtTests): """ Ipsec ESP - TUN & TRA tests """ @classmethod def setUpClass(cls): super(TestIpsecEsp1, cls).setUpClass() @classmethod def tearDownClass(cls): super(TestIpsecEsp1, cls).tearDownClass() def setUp(self): super(TestIpsecEsp1, self).setUp() def tearDown(self): super(TestIpsecEsp1, self).tearDown() def test_tun_46(self): """ ipsec 4o6 tunnel """ # add an SPD entry to direct 2.2.2.2 to the v6 tunnel SA p6 = self.ipv6_params p4 = self.ipv4_params p6.remote_tun_if_host4 = "2.2.2.2" e = VppEnum.vl_api_ipsec_spd_action_t VppIpsecSpdEntry(self, self.tun_spd, p6.scapy_tun_sa_id, self.pg1.remote_addr[p4.addr_type], self.pg1.remote_addr[p4.addr_type], p6.remote_tun_if_host4, p6.remote_tun_if_host4, 0, priority=10, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=1).add_vpp_config() VppIpRoute(self, p6.remote_tun_if_host4, p4.addr_len, [VppRoutePath(self.tun_if.remote_addr[p4.addr_type], 0xffffffff)]).add_vpp_config() old_name = self.tun6_encrypt_node_name self.tun6_encrypt_node_name = "esp4-encrypt" self.verify_tun_46(p6, count=63) self.tun6_encrypt_node_name = old_name def test_tun_64(self): """ ipsec 6o4 tunnel """ # add an SPD entry to direct 4444::4 to the v4 tunnel SA p6 = self.ipv6_params p4 = self.ipv4_params p4.remote_tun_if_host6 = "4444::4" e = VppEnum.vl_api_ipsec_spd_action_t VppIpsecSpdEntry(self, self.tun_spd, p4.scapy_tun_sa_id, self.pg1.remote_addr[p6.addr_type], self.pg1.remote_addr[p6.addr_type], p4.remote_tun_if_host6, p4.remote_tun_if_host6, 0, priority=10, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=1).add_vpp_config() d = DpoProto.DPO_PROTO_IP6 VppIpRoute(self, p4.remote_tun_if_host6, p6.addr_len, [VppRoutePath(self.tun_if.remote_addr[p6.addr_type], 0xffffffff, proto=d)]).add_vpp_config() old_name = self.tun4_encrypt_node_name self.tun4_encrypt_node_name = "esp6-encrypt" self.verify_tun_64(p4, count=63) self.tun4_encrypt_node_name = old_name class TestIpsecEspTun(TemplateIpsecEsp, IpsecTun46Tests): """ Ipsec ESP - TUN encap tests """ def setUp(self): self.ipv4_params = IPsecIPv4Params() self.ipv6_params = IPsecIPv6Params() c = (VppEnum.vl_api_tunnel_encap_decap_flags_t. TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP) c1 = c | (VppEnum.vl_api_tunnel_encap_decap_flags_t. TUNNEL_API_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN) self.ipv4_params.tun_flags = c self.ipv6_params.tun_flags = c1 super(TestIpsecEspTun, self).setUp() def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): # set the DSCP + ECN - flags are set to copy only DSCP return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / IP(src=src, dst=dst, tos=5) / UDP(sport=4444, dport=4444) / Raw(b'X' * payload_size) for i in range(count)] def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54): # set the DSCP + ECN - flags are set to copy both return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / IPv6(src=src, dst=dst, tc=5) / UDP(sport=4444, dport=4444) / Raw(b'X' * payload_size) for i in range(count)] def verify_encrypted(self, p, sa, rxs): # just check that only the DSCP is copied for rx in rxs: self.assertEqual(rx[IP].tos, 4) def verify_encrypted6(self, p, sa, rxs): # just check that the DSCP & ECN are copied for rx in rxs: self.assertEqual(rx[IPv6].tc, 5) class TestIpsecEspTun2(TemplateIpsecEsp, IpsecTun46Tests): """ Ipsec ESP - TUN DSCP tests """ def setUp(self): self.ipv4_params = IPsecIPv4Params() self.ipv6_params = IPsecIPv6Params() self.ipv4_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF self.ipv6_params.dscp = VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11 super(TestIpsecEspTun2, self).setUp() def gen_pkts(self, sw_intf, src, dst, count=1, payload_size=54): return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / IP(src=src, dst=dst) / UDP(sport=4444, dport=4444) / Raw(b'X' * payload_size) for i in range(count)] def gen_pkts6(self, p, sw_intf, src, dst, count=1, payload_size=54): return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) / IPv6(src=src, dst=dst) / UDP(sport=4444, dport=4444) / Raw(b'X' * payload_size) for i in range(count)] def verify_encrypted(self, p, sa, rxs): # just check that only the DSCP is set for rx in rxs: self.assertEqual(rx[IP].tos, VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_EF << 2) def verify_encrypted6(self, p, sa, rxs): # just check that the DSCP is set for rx in rxs: self.assertEqual(rx[IPv6].tc, VppEnum.vl_api_ip_dscp_t.IP_API_DSCP_AF11 << 2) class TestIpsecEsp2(TemplateIpsecEsp, IpsecTcpTests): """ Ipsec ESP - TCP tests """ pass class TestIpsecEspAsync(TemplateIpsecEsp): """ Ipsec ESP - Aysnc tests """ vpp_worker_count = 2 def setUp(self): super(TestIpsecEspAsync, self).setUp() self.p_sync = IPsecIPv4Params() self.p_sync.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CBC_256) self.p_sync.crypt_algo = 'AES-CBC' # scapy name self.p_sync.crypt_key = b'JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h' self.p_sync.scapy_tun_sa_id += 0xf0000 self.p_sync.scapy_tun_spi += 0xf0000 self.p_sync.vpp_tun_sa_id += 0xf0000 self.p_sync.vpp_tun_spi += 0xf0000 self.p_sync.remote_tun_if_host = "2.2.2.2" e = VppEnum.vl_api_ipsec_spd_action_t self.p_sync.sa = VppIpsecSA( self, self.p_sync.vpp_tun_sa_id, self.p_sync.vpp_tun_spi, self.p_sync.auth_algo_vpp_id, self.p_sync.auth_key, self.p_sync.crypt_algo_vpp_id, self.p_sync.crypt_key, self.vpp_esp_protocol, self.tun_if.local_addr[self.p_sync.addr_type], self.tun_if.remote_addr[self.p_sync.addr_type]).add_vpp_config() self.p_sync.spd = VppIpsecSpdEntry( self, self.tun_spd, self.p_sync.vpp_tun_sa_id, self.pg1.remote_addr[self.p_sync.addr_type], self.pg1.remote_addr[self.p_sync.addr_type], self.p_sync.remote_tun_if_host, self.p_sync.remote_tun_if_host, 0, priority=1, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=1).add_vpp_config() VppIpRoute(self, self.p_sync.remote_tun_if_host, self.p_sync.addr_len, [VppRoutePath( self.tun_if.remote_addr[self.p_sync.addr_type], 0xffffffff)]).add_vpp_config() config_tun_params(self.p_sync, self.encryption_type, self.tun_if) self.p_async = IPsecIPv4Params() self.p_async.crypt_algo_vpp_id = (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_GCM_256) self.p_async.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_NONE) self.p_async.crypt_algo = 'AES-GCM' # scapy name self.p_async.crypt_key = b'JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h' self.p_async.auth_algo = 'NULL' self.p_async.scapy_tun_sa_id += 0xe0000 self.p_async.scapy_tun_spi += 0xe0000 self.p_async.vpp_tun_sa_id += 0xe0000 self.p_async.vpp_tun_spi += 0xe0000 self.p_async.remote_tun_if_host = "2.2.2.3" iflags = VppEnum.vl_api_ipsec_sad_flags_t self.p_async.flags = (iflags.IPSEC_API_SAD_FLAG_USE_ESN | iflags.IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY | iflags.IPSEC_API_SAD_FLAG_ASYNC) self.p_async.sa = VppIpsecSA( self, self.p_async.vpp_tun_sa_id, self.p_async.vpp_tun_spi, self.p_async.auth_algo_vpp_id, self.p_async.auth_key, self.p_async.crypt_algo_vpp_id, self.p_async.crypt_key, self.vpp_esp_protocol, self.tun_if.local_addr[self.p_async.addr_type], self.tun_if.remote_addr[self.p_async.addr_type], flags=self.p_async.flags).add_vpp_config() self.p_async.spd = VppIpsecSpdEntry( self, self.tun_spd, self.p_async.vpp_tun_sa_id, self.pg1.remote_addr[self.p_async.addr_type], self.pg1.remote_addr[self.p_async.addr_type], self.p_async.remote_tun_if_host, self.p_async.remote_tun_if_host, 0, priority=2, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=1).add_vpp_config() VppIpRoute(self, self.p_async.remote_tun_if_host, self.p_async.addr_len, [VppRoutePath( self.tun_if.remote_addr[self.p_async.addr_type], 0xffffffff)]).add_vpp_config() config_tun_params(self.p_async, self.encryption_type, self.tun_if) def test_dual_stream(self): """ Alternating SAs """ p = self.params[self.p_sync.addr_type] self.vapi.ipsec_set_async_mode(async_enable=True) pkts = [(Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / IP(src=self.pg1.remote_ip4, dst=self.p_sync.remote_tun_if_host) / UDP(sport=4444, dport=4444) / Raw(b'0x0' * 200)), (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / IP(src=self.pg1.remote_ip4, dst=p.remote_tun_if_host) / UDP(sport=4444, dport=4444) / Raw(b'0x0' * 200))] pkts *= 1023 rxs = self.send_and_expect(self.pg1, pkts, self.pg0) self.assertEqual(len(rxs), len(pkts)) for rx in rxs: if rx[ESP].spi == p.scapy_tun_spi: decrypted = p.vpp_tun_sa.decrypt(rx[IP]) elif rx[ESP].spi == self.p_sync.vpp_tun_spi: decrypted = self.p_sync.scapy_tun_sa.decrypt(rx[IP]) else: rx.show() self.assertTrue(False) self.p_sync.spd.remove_vpp_config() self.p_sync.sa.remove_vpp_config() self.p_async.spd.remove_vpp_config() self.p_async.sa.remove_vpp_config() self.vapi.ipsec_set_async_mode(async_enable=False) def test_sync_async_noop_stream(self): """ Alternating SAs sync/async/noop """ p = self.params[self.p_sync.addr_type] # first pin the default/noop SA to worker 0 pkts = [(Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / IP(src=self.pg1.remote_ip4, dst=p.remote_tun_if_host) / UDP(sport=4444, dport=4444) / Raw(b'0x0' * 200))] rxs = self.send_and_expect(self.pg1, pkts, self.pg0, worker=0) self.logger.info(self.vapi.cli("sh ipsec sa")) self.logger.info(self.vapi.cli("sh crypto async status")) # then use all the other SAs on worker 1. # some will handoff, other take the sync and async paths pkts = [(Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / IP(src=self.pg1.remote_ip4, dst=self.p_sync.remote_tun_if_host) / UDP(sport=4444, dport=4444) / Raw(b'0x0' * 200)), (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / IP(src=self.pg1.remote_ip4, dst=p.remote_tun_if_host) / UDP(sport=4444, dport=4444) / Raw(b'0x0' * 200)), (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / IP(src=self.pg1.remote_ip4, dst=self.p_async.remote_tun_if_host) / UDP(sport=4444, dport=4444) / Raw(b'0x0' * 200))] pkts *= 1023 rxs = self.send_and_expect(self.pg1, pkts, self.pg0, worker=1) self.assertEqual(len(rxs), len(pkts)) for rx in rxs: if rx[ESP].spi == p.scapy_tun_spi: decrypted = p.vpp_tun_sa.decrypt(rx[IP]) elif rx[ESP].spi == self.p_sync.vpp_tun_spi: decrypted = self.p_sync.scapy_tun_sa.decrypt(rx[IP]) elif rx[ESP].spi == self.p_async.vpp_tun_spi: decrypted = self.p_async.scapy_tun_sa.decrypt(rx[IP]) else: rx.show() self.assertTrue(False) self.p_sync.spd.remove_vpp_config() self.p_sync.sa.remove_vpp_config() self.p_async.spd.remove_vpp_config() self.p_async.sa.remove_vpp_config() # async mode should have been disabled now that there are # no async SAs. there's no API for this, so a reluctant # screen scrape. self.assertTrue("DISABLED" in self.vapi.cli("sh crypto async status")) class TestIpsecEspHandoff(TemplateIpsecEsp, IpsecTun6HandoffTests, IpsecTun4HandoffTests): """ Ipsec ESP - handoff tests """ pass class TemplateIpsecEspUdp(ConfigIpsecESP): """ UDP encapped ESP """ @classmethod def setUpClass(cls): super(TemplateIpsecEspUdp, cls).setUpClass() @classmethod def tearDownClass(cls): super(TemplateIpsecEspUdp, cls).tearDownClass() def setUp(self): super(TemplateIpsecEspUdp, self).setUp() self.net_objs = [] self.tun_if = self.pg0 self.tra_if = self.pg2 self.logger.info(self.vapi.ppcli("show int addr")) p = self.ipv4_params p.flags = (VppEnum.vl_api_ipsec_sad_flags_t. IPSEC_API_SAD_FLAG_UDP_ENCAP) p.nat_header = UDP(sport=5454, dport=4500) self.tra_spd = VppIpsecSpd(self, self.tra_spd_id) self.tra_spd.add_vpp_config() VppIpsecSpdItfBinding(self, self.tra_spd, self.tra_if).add_vpp_config() self.config_esp_tra(p) config_tra_params(p, self.encryption_type) self.tun_spd = VppIpsecSpd(self, self.tun_spd_id) self.tun_spd.add_vpp_config() VppIpsecSpdItfBinding(self, self.tun_spd, self.tun_if).add_vpp_config() self.config_esp_tun(p) self.logger.info(self.vapi.ppcli("show ipsec all")) d = DpoProto.DPO_PROTO_IP4 VppIpRoute(self, p.remote_tun_if_host, p.addr_len, [VppRoutePath(self.tun_if.remote_addr[p.addr_type], 0xffffffff, proto=d)]).add_vpp_config() def tearDown(self): super(TemplateIpsecEspUdp, self).tearDown() def show_commands_at_teardown(self): self.logger.info(self.vapi.cli("show hardware")) class TestIpsecEspUdp(TemplateIpsecEspUdp, IpsecTra4Tests): """ Ipsec NAT-T ESP UDP tests """ pass class MyParameters(): def __init__(self): flag_esn = VppEnum.vl_api_ipsec_sad_flags_t.IPSEC_API_SAD_FLAG_USE_ESN self.flags = [0, flag_esn] # foreach crypto algorithm self.algos = { 'AES-GCM-128/NONE': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_GCM_128), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_NONE), 'scapy-crypto': "AES-GCM", 'scapy-integ': "NULL", 'key': b"JPjyOWBeVEQiMe7h", 'salt': 0}, 'AES-GCM-192/NONE': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_GCM_192), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_NONE), 'scapy-crypto': "AES-GCM", 'scapy-integ': "NULL", 'key': b"JPjyOWBeVEQiMe7h01234567", 'salt': 1010}, 'AES-GCM-256/NONE': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_GCM_256), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_NONE), 'scapy-crypto': "AES-GCM", 'scapy-integ': "NULL", 'key': b"JPjyOWBeVEQiMe7h0123456787654321", 'salt': 2020}, 'AES-CBC-128/MD5-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CBC_128), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_MD5_96), 'scapy-crypto': "AES-CBC", 'scapy-integ': "HMAC-MD5-96", 'salt': 0, 'key': b"JPjyOWBeVEQiMe7h"}, 'AES-CBC-192/SHA1-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CBC_192), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96), 'scapy-crypto': "AES-CBC", 'scapy-integ': "HMAC-SHA1-96", 'salt': 0, 'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"}, 'AES-CBC-256/SHA1-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CBC_256), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96), 'scapy-crypto': "AES-CBC", 'scapy-integ': "HMAC-SHA1-96", 'salt': 0, 'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"}, '3DES-CBC/SHA1-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_3DES_CBC), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96), 'scapy-crypto': "3DES", 'scapy-integ': "HMAC-SHA1-96", 'salt': 0, 'key': b"JPjyOWBeVEQiMe7h00112233"}, 'NONE/SHA1-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_NONE), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96), 'scapy-crypto': "NULL", 'scapy-integ': "HMAC-SHA1-96", 'salt': 0, 'key': b"JPjyOWBeVEQiMe7h00112233"}, 'AES-CTR-128/SHA1-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CTR_128), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96), 'scapy-crypto': "AES-CTR", 'scapy-integ': "HMAC-SHA1-96", 'salt': 0, 'key': b"JPjyOWBeVEQiMe7h"}, 'AES-CTR-192/SHA1-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CTR_192), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96), 'scapy-crypto': "AES-CTR", 'scapy-integ': "HMAC-SHA1-96", 'salt': 1010, 'key': b"JPjyOWBeVEQiMe7hJPjyOWBe"}, 'AES-CTR-256/SHA1-96': { 'vpp-crypto': (VppEnum.vl_api_ipsec_crypto_alg_t. IPSEC_API_CRYPTO_ALG_AES_CTR_256), 'vpp-integ': (VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96), 'scapy-crypto': "AES-CTR", 'scapy-integ': "HMAC-SHA1-96", 'salt': 2020, 'key': b"JPjyOWBeVEQiMe7hJPjyOWBeVEQiMe7h"}} class RunTestIpsecEspAll(ConfigIpsecESP, IpsecTra4, IpsecTra6, IpsecTun4, IpsecTun6): """ Ipsec ESP all Algos """ @classmethod def setUpConstants(cls): test_args = str.split(cls.__doc__, " ") engine = test_args[0] if engine == "async": cls.vpp_worker_count = 2 super(RunTestIpsecEspAll, cls).setUpConstants() def setUp(self): super(RunTestIpsecEspAll, self).setUp() test_args = str.split(self.__doc__, " ") params = MyParameters() self.engine = test_args[0] self.flag = params.flags[0] if test_args[1] == 'ESN': self.flag = params.flags[1] self.algo = params.algos[test_args[2]] self.async_mode = False if self.engine == "async": self.async_mode = True def tearDown(self): super(RunTestIpsecEspAll, self).tearDown() def run_test(self): self.run_a_test(self.engine, self.flag, self.algo) def run_a_test(self, engine, flag, algo, payload_size=None): if self.async_mode: self.vapi.cli("set ipsec async mode on") else: self.vapi.cli("set crypto handler all %s" % engine) self.logger.info(self.vapi.cli("show crypto async status")) self.ipv4_params = IPsecIPv4Params() self.ipv6_params = IPsecIPv6Params() self.params = {self.ipv4_params.addr_type: self.ipv4_params, self.ipv6_params.addr_type: self.ipv6_params} for _, p in self.params.items(): p.auth_algo_vpp_id = algo['vpp-integ'] p.crypt_algo_vpp_id = algo['vpp-crypto'] p.crypt_algo = algo['scapy-crypto'] p.auth_algo = algo['scapy-integ'] p.crypt_key = algo['key'] p.salt = algo['salt'] p.flags = p.flags | flag p.outer_flow_label = 243224 p.async_mode = self.async_mode self.reporter.send_keep_alive(self) # # configure the SPDs. SAs, etc # self.config_network(self.params.values()) # # run some traffic. # An exhautsive 4o6, 6o4 is not necessary # for each algo # self.verify_tra_basic6(count=NUM_PKTS) self.verify_tra_basic4(count=NUM_PKTS) self.verify_tun_66(self.params[socket.AF_INET6], count=NUM_PKTS) # # Use an odd-byte payload size to check for correct padding. # # 49 + 2 == 51 which should pad +1 to 52 for 4 byte alignment, +5 # to 56 for 8 byte alignment, and +13 to 64 for 64 byte alignment. # This should catch bugs where the code is incorrectly over-padding # for algorithms that don't require it psz = 49 - len(IP()/ICMP()) if payload_size is None else payload_size self.verify_tun_44(self.params[socket.AF_INET], count=NUM_PKTS, payload_size=psz) LARGE_PKT_SZ = [ 1970, # results in 2 chained buffers entering decrypt node # but leaving as simple buffer due to ICV removal (tra4) 2004, # footer+ICV will be added to 2nd buffer (tun4) 4010, # ICV ends up splitted accross 2 buffers in esp_decrypt # for transport4; transport6 takes normal path 4020, # same as above but tra4 and tra6 are switched ] if self.engine in engines_supporting_chain_bufs: for sz in LARGE_PKT_SZ: self.verify_tra_basic4(count=NUM_PKTS, payload_size=sz) self.verify_tra_basic6(count=NUM_PKTS, payload_size=sz) self.verify_tun_66(self.params[socket.AF_INET6], count=NUM_PKTS, payload_size=sz) self.verify_tun_44(self.params[socket.AF_INET], count=NUM_PKTS, payload_size=sz) # # swap the handlers while SAs are up # for e in engines: if e != engine: self.vapi.cli("set crypto handler all %s" % e) self.verify_tra_basic4(count=NUM_PKTS) # # remove the SPDs, SAs, etc # self.unconfig_network() # # reconfigure the network and SA to run the # anti replay tests # self.config_network(self.params.values()) self.verify_tra_anti_replay() self.unconfig_network() # # To generate test classes, do: # grep '# GEN' test_ipsec_esp.py | sed -e 's/# GEN //g' | bash # # GEN for ENG in native ipsecmb openssl; do \ # GEN for FLG in noESN ESN; do for ALG in AES-GCM-128/NONE \ # GEN AES-GCM-192/NONE AES-GCM-256/NONE AES-CBC-128/MD5-96 \ # GEN AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96 \ # GEN 3DES-CBC/SHA1-96 NONE/SHA1-96 \ # GEN AES-CTR-128/SHA1-96 AES-CTR-192/SHA1-96 AES-CTR-256/SHA1-96; do \ # GEN [[ ${FLG} == "ESN" && ${ALG} == *"NONE" ]] && continue # GEN echo -e "\n\nclass Test_${ENG}_${FLG}_${ALG}(RunTestIpsecEspAll):" | # GEN sed -e 's/-/_/g' -e 's#/#_#g' ; \ # GEN echo ' """'$ENG $FLG $ALG IPSec test'"""' ; # GEN echo " def test_ipsec(self):"; # GEN echo " self.run_test()"; # GEN done; done; done # # GEN for FLG in noESN ESN; do for ALG in \ # GEN AES-GCM-128/NONE AES-GCM-192/NONE AES-GCM-256/NONE \ # GEN AES-CBC-192/SHA1-96 AES-CBC-256/SHA1-96; do \ # GEN [[ ${FLG} == "ESN" && ${ALG} == *"NONE" ]] && continue # GEN echo -e "\n\nclass Test_async_${FLG}_${ALG}(RunTestIpsecEspAll):" | # GEN sed -e 's/-/_/g' -e 's#/#_#g' ; \ # GEN echo ' """'async $FLG $ALG IPSec test'"""' ; # GEN echo " def test_ipsec(self):"; # GEN echo " self.run_test()"; # GEN done; done; class Test_native_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): """native noESN AES-GCM-128/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll): """native noESN AES-GCM-192/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll): """native noESN AES-GCM-256/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """native noESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """native noESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """native noESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): """native noESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_NONE_SHA1_96(RunTestIpsecEspAll): """native noESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): """native noESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): """native noESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): """native noESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """native ESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """native ESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """native ESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): """native ESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_NONE_SHA1_96(RunTestIpsecEspAll): """native ESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): """native ESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): """native ESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_native_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): """native ESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): """ipsecmb noESN AES-GCM-128/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll): """ipsecmb noESN AES-GCM-192/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll): """ipsecmb noESN AES-GCM-256/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """ipsecmb noESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """ipsecmb noESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """ipsecmb noESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): """ipsecmb noESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_NONE_SHA1_96(RunTestIpsecEspAll): """ipsecmb noESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): """ipsecmb noESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): """ipsecmb noESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): """ipsecmb noESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """ipsecmb ESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """ipsecmb ESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """ipsecmb ESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): """ipsecmb ESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_NONE_SHA1_96(RunTestIpsecEspAll): """ipsecmb ESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): """ipsecmb ESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): """ipsecmb ESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_ipsecmb_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): """ipsecmb ESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): """openssl noESN AES-GCM-128/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll): """openssl noESN AES-GCM-192/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll): """openssl noESN AES-GCM-256/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """openssl noESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """openssl noESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """openssl noESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): """openssl noESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_NONE_SHA1_96(RunTestIpsecEspAll): """openssl noESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): """openssl noESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): """openssl noESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_noESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): """openssl noESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_AES_CBC_128_MD5_96(RunTestIpsecEspAll): """openssl ESN AES-CBC-128/MD5-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """openssl ESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """openssl ESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_3DES_CBC_SHA1_96(RunTestIpsecEspAll): """openssl ESN 3DES-CBC/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_NONE_SHA1_96(RunTestIpsecEspAll): """openssl ESN NONE/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_AES_CTR_128_SHA1_96(RunTestIpsecEspAll): """openssl ESN AES-CTR-128/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_AES_CTR_192_SHA1_96(RunTestIpsecEspAll): """openssl ESN AES-CTR-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_openssl_ESN_AES_CTR_256_SHA1_96(RunTestIpsecEspAll): """openssl ESN AES-CTR-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_async_noESN_AES_GCM_128_NONE(RunTestIpsecEspAll): """async noESN AES-GCM-128/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_async_noESN_AES_GCM_192_NONE(RunTestIpsecEspAll): """async noESN AES-GCM-192/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_async_noESN_AES_GCM_256_NONE(RunTestIpsecEspAll): """async noESN AES-GCM-256/NONE IPSec test""" def test_ipsec(self): self.run_test() class Test_async_noESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """async noESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_async_noESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """async noESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_async_ESN_AES_CBC_192_SHA1_96(RunTestIpsecEspAll): """async ESN AES-CBC-192/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test() class Test_async_ESN_AES_CBC_256_SHA1_96(RunTestIpsecEspAll): """async ESN AES-CBC-256/SHA1-96 IPSec test""" def test_ipsec(self): self.run_test()