ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec: IPSec protection for multi-point tunnel interfaces

Browse Source 
Type: feature

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: Iaba2ab11bfaa1c8db4023434e3043ac39500f938
This commit is contained in:
Neale Ranns
2019-12-16 00:53:11 +00:00
committed by Damjan Marion
parent d057625d49
commit 282872127b
24 changed files with 1017 additions and 227 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/plugins/ikev2/ikev2.c
View File

@ -1550,7 +1550,7 @@ ikev2_add_tunnel_from_main (ikev2_add_ipsec_tunnel_args_t * a)
u32 *sas_in = NULL;
vec_add1 (sas_in, a->remote_sa_id);
rv |= ipsec_tun_protect_update (sw_if_index, a->local_sa_id, sas_in);
rv |= ipsec_tun_protect_update (sw_if_index, NULL, a->local_sa_id, sas_in);
}
static int
@ -1803,7 +1803,7 @@ ikev2_del_tunnel_from_main (ikev2_del_ipsec_tunnel_args_t * a)
}
if (~0 != sw_if_index)
ipsec_tun_protect_del (sw_if_index);
ipsec_tun_protect_del (sw_if_index, NULL);
ipsec_sa_unlock_id (a->remote_sa_id);
ipsec_sa_unlock_id (a->local_sa_id);

2
src/vnet/adj/adj_delegate.h
View File

@ -80,7 +80,7 @@ typedef u8 * (*adj_delegate_format_t)(const adj_delegate_t *aed, u8 *s);
/**
* Notification that an adjacency has been created
*/
typedef u8 * (*adj_delegate_adj_created_t)(adj_index_t ai);
typedef void (*adj_delegate_adj_created_t)(adj_index_t ai);
/**
* An ADJ delegate virtual function table

5
src/vnet/adj/adj_glean.c
View File

@ -149,8 +149,7 @@ adj_glean_interface_state_change (vnet_main_t * vnm,
fib_protocol_t proto;
ip_adjacency_t *adj;
for (proto = FIB_PROTOCOL_IP4; proto <= FIB_PROTOCOL_IP6; proto++)
FOR_EACH_FIB_IP_PROTOCOL(proto)
{
if (sw_if_index >= vec_len(adj_gleans[proto]) ||
ADJ_INDEX_INVALID == adj_gleans[proto][sw_if_index])
@ -242,7 +241,7 @@ adj_glean_interface_delete (vnet_main_t * vnm,
return (NULL);
}
for (proto = FIB_PROTOCOL_IP4; proto <= FIB_PROTOCOL_IP6; proto++)
FOR_EACH_FIB_IP_PROTOCOL(proto)
{
if (sw_if_index >= vec_len(adj_gleans[proto]) ||
ADJ_INDEX_INVALID == adj_gleans[proto][sw_if_index])

49
src/vnet/ip/ip_types.c
View File

@ -94,6 +94,21 @@ ip_address_size (const ip_address_t * a)
return 0;
}
bool
ip_address_is_zero (const ip_address_t * ip)
{
switch (ip_addr_version (ip))
{
case AF_IP4:
return (ip_addr_v4 (ip).as_u32 == 0);
case AF_IP6:
return (ip_addr_v6 (ip).as_u64[0] == 0 &&
ip_addr_v6 (ip).as_u64[1] == 0);
break;
}
return false;
}
int
ip_address_cmp (const ip_address_t * ip1, const ip_address_t * ip2)
{
@ -155,13 +170,14 @@ ip_address_set (ip_address_t * dst, const void *src, u8 version)
ip_addr_version (dst) = version;
}
void
ip_address_to_46 (const ip_address_t * addr,
ip46_address_t * a, fib_protocol_t * proto)
fib_protocol_t
ip_address_to_46 (const ip_address_t * addr, ip46_address_t * a)
{
*proto = (AF_IP4 == ip_addr_version (addr) ?
FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6);
switch (*proto)
fib_protocol_t proto;
proto = (AF_IP4 == ip_addr_version (addr) ?
FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6);
switch (proto)
{
case FIB_PROTOCOL_IP4:
ip46_address_set_ip4 (a, &addr->ip.v4);
@ -173,6 +189,27 @@ ip_address_to_46 (const ip_address_t * addr,
ASSERT (0);
break;
}
return (proto);
}
void
ip_address_from_46 (const ip46_address_t * nh,
fib_protocol_t fproto, ip_address_t * ip)
{
switch (fproto)
{
case FIB_PROTOCOL_IP4:
clib_memset (ip, 0, sizeof (*ip));
ip_address_set (ip, &nh->ip4, AF_IP4);
break;
case FIB_PROTOCOL_IP6:
ip_address_set (ip, &nh->ip6, AF_IP6);
break;
default:
ASSERT (0);
break;
}
}
static void

10
src/vnet/ip/ip_types.h
View File

@ -46,11 +46,15 @@ typedef struct ip_address
} __clib_packed ip_address_t;
/* *INDENT-ON* */
#define IP_ADDRESS_V4_ALL_0S {.ip.v4.as_u32 = 0, .version = AF_IP4}
#define IP_ADDRESS_V6_ALL_0S {.ip.v4.as_u32 = 0, .version = AF_IP6}
#define ip_addr_addr(_a) (_a)->ip
#define ip_addr_v4(_a) (_a)->ip.v4
#define ip_addr_v6(_a) (_a)->ip.v6
#define ip_addr_version(_a) (_a)->version
extern bool ip_address_is_zero (const ip_address_t * ip);
extern int ip_address_cmp (const ip_address_t * ip1,
const ip_address_t * ip2);
extern void ip_address_copy (ip_address_t * dst, const ip_address_t * src);
@ -60,8 +64,10 @@ extern u16 ip_address_size (const ip_address_t * a);
extern u16 ip_version_to_size (u8 ver);
extern u8 *format_ip_address (u8 * s, va_list * args);
extern uword unformat_ip_address (unformat_input_t * input, va_list * args);
extern void ip_address_to_46 (const ip_address_t * addr,
ip46_address_t * a, fib_protocol_t * proto);
extern fib_protocol_t ip_address_to_46 (const ip_address_t * addr,
ip46_address_t * a);
extern void ip_address_from_46 (const ip46_address_t * a,
fib_protocol_t fproto, ip_address_t * addr);
/* *INDENT-OFF* */
typedef struct ip_prefix

36
src/vnet/ip/ip_types_api.c
View File

@ -163,6 +163,26 @@ ip_address_decode (const vl_api_address_t * in, ip46_address_t * out)
return (ip_address_union_decode (&in->un, in->af, out));
}
void
ip_address_decode2 (const vl_api_address_t * in, ip_address_t * out)
{
switch (clib_net_to_host_u32 (in->af))
{
case ADDRESS_IP4:
clib_memset (out, 0, sizeof (*out));
clib_memcpy (&ip_addr_v4 (out), &in->un.ip4, sizeof (ip_addr_v4 (out)));
out->version = AF_IP4;
break;
case ADDRESS_IP6:
clib_memcpy (&ip_addr_v6 (out), &in->un.ip6, sizeof (ip_addr_v6 (out)));
out->version = AF_IP6;
break;
default:
ASSERT (!"Unknown address family in API address type");
break;
}
}
static void
ip_address_union_encode (const ip46_address_t * in,
vl_api_address_family_t af,
@ -196,6 +216,22 @@ ip_address_encode (const ip46_address_t * in,
ip_address_union_encode (in, out->af, &out->un);
}
void
ip_address_encode2 (const ip_address_t * in, vl_api_address_t * out)
{
switch (in->version)
{
case AF_IP4:
out->af = clib_net_to_host_u32 (ADDRESS_IP4);
ip4_address_encode (&in->ip.v4, out->un.ip4);
break;
case AF_IP6:
out->af = clib_net_to_host_u32 (ADDRESS_IP6);
ip6_address_encode (&in->ip.v6, out->un.ip6);
break;
}
}
void
ip_prefix_decode (const vl_api_prefix_t * in, fib_prefix_t * out)
{

18
src/vnet/ip/ip_types_api.h
View File

@ -40,10 +40,14 @@ extern u8 ip_dscp_encode (ip_dscp_t dscp);
/**
* Decode/Encode for struct/union types
*/
extern ip46_type_t ip_address_decode (const struct _vl_api_address *in,
extern ip46_type_t ip_address_decode (const vl_api_address_t * in,
ip46_address_t * out);
extern void ip_address_encode (const ip46_address_t * in,
ip46_type_t type, struct _vl_api_address *out);
ip46_type_t type, vl_api_address_t * out);
extern void ip_address_decode2 (const vl_api_address_t * in,
ip_address_t * out);
extern void ip_address_encode2 (const ip_address_t * in,
vl_api_address_t * out);
extern void ip6_address_encode (const ip6_address_t * in,
vl_api_ip6_address_t out);
extern void ip6_address_decode (const vl_api_ip6_address_t in,
@ -53,15 +57,13 @@ extern void ip4_address_encode (const ip4_address_t * in,
extern void ip4_address_decode (const vl_api_ip4_address_t in,
ip4_address_t * out);
extern void ip_prefix_decode (const struct _vl_api_prefix *in,
fib_prefix_t * out);
extern void ip_prefix_encode (const fib_prefix_t * in,
struct _vl_api_prefix *out);
extern void ip_prefix_decode (const vl_api_prefix_t * in, fib_prefix_t * out);
extern void ip_prefix_encode (const fib_prefix_t * in, vl_api_prefix_t * out);
extern void ip_mprefix_decode (const struct _vl_api_mprefix *in,
extern void ip_mprefix_decode (const vl_api_mprefix_t * in,
mfib_prefix_t * out);
extern void ip_mprefix_encode (const mfib_prefix_t * in,
struct _vl_api_mprefix *out);
vl_api_mprefix_t * out);
#endif

11
src/vnet/ipsec/esp_encrypt.c
View File

@ -23,6 +23,7 @@
#include <vnet/crypto/crypto.h>
#include <vnet/ipsec/ipsec.h>
#include <vnet/ipsec/ipsec_tun.h>
#include <vnet/ipsec/esp.h>
#define foreach_esp_encrypt_next \
@ -319,13 +320,13 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
if (is_tun)
{
/* we are on a ipsec tunnel's feature arc */
u32 next0;
u32 next0 = 0;
config_index = b[0]->current_config_index;
sa_index0 = *(u32 *) vnet_feature_next_with_data (&next0, b[0],
sizeof
(sa_index0));
vnet_buffer (b[0])->ipsec.sad_index = sa_index0;
vnet_feature_next (&next0, b[0]);
next[0] = next0;
vnet_buffer (b[0])->ipsec.sad_index =
sa_index0 = ipsec_tun_protect_get_sa_out
(vnet_buffer (b[0])->ip.adj_index[VLIB_TX]);
}
else
sa_index0 = vnet_buffer (b[0])->ipsec.sad_index;

5
src/vnet/ipsec/ipsec.api
View File

@ -234,12 +234,16 @@ define ipsec_sad_entry_add_del_reply
@param client_index - opaque cookie to identify the sender
@param context - sender context, to match reply w/ request
@param sw_id_index - Tunnel interface to protect
@param nh - The peer/next-hop on the tunnel to which the traffic
should be protected. For a P2P interface set this to the
all 0s address.
@param sa_in - The ID [set] of inbound SAs
@param sa_out - The ID of outbound SA
*/
typedef ipsec_tunnel_protect
{
vl_api_interface_index_t sw_if_index;
vl_api_address_t nh;
u32 sa_out;
u8 n_sa_in;
u32 sa_in[n_sa_in];
@ -259,6 +263,7 @@ autoreply define ipsec_tunnel_protect_del
u32 context;
vl_api_interface_index_t sw_if_index;
vl_api_address_t nh;
};
/**

29
src/vnet/ipsec/ipsec_api.c
View File

@ -116,6 +116,7 @@ static void vl_api_ipsec_tunnel_protect_update_t_handler
vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
vl_api_ipsec_tunnel_protect_update_reply_t *rmp;
u32 sw_if_index, ii, *sa_ins = NULL;
ip_address_t nh;
int rv;
sw_if_index = ntohl (mp->tunnel.sw_if_index);
@ -127,7 +128,9 @@ static void vl_api_ipsec_tunnel_protect_update_t_handler
for (ii = 0; ii < mp->tunnel.n_sa_in; ii++)
vec_add1 (sa_ins, ntohl (mp->tunnel.sa_in[ii]));
rv = ipsec_tun_protect_update (sw_if_index,
ip_address_decode2 (&mp->tunnel.nh, &nh);
rv = ipsec_tun_protect_update (sw_if_index, &nh,
ntohl (mp->tunnel.sa_out), sa_ins);
#else
rv = VNET_API_ERROR_UNIMPLEMENTED;
@ -143,15 +146,17 @@ static void vl_api_ipsec_tunnel_protect_del_t_handler
{
vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
vl_api_ipsec_tunnel_protect_del_reply_t *rmp;
int rv;
ip_address_t nh;
u32 sw_if_index;
int rv;
sw_if_index = ntohl (mp->sw_if_index);
VALIDATE_SW_IF_INDEX (mp);
#if WITH_LIBSSL > 0
rv = ipsec_tun_protect_del (sw_if_index);
ip_address_decode2 (&mp->nh, &nh);
rv = ipsec_tun_protect_del (sw_if_index, &nh);
#else
rv = VNET_API_ERROR_UNIMPLEMENTED;
#endif
@ -177,13 +182,13 @@ send_ipsec_tunnel_protect_details (index_t itpi, void *arg)
itp = ipsec_tun_protect_get (itpi);
mp = vl_msg_api_alloc (sizeof (*mp) + (sizeof (u32) * itp->itp_n_sa_in));
clib_memset (mp, 0, sizeof (*mp));
mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS);
mp->context = ctx->context;
mp->tun.sw_if_index = htonl (itp->itp_sw_if_index);
ip_address_encode2 (itp->itp_key, &mp->tun.nh);
mp->tun.sa_out = htonl (itp->itp_out_sa);
mp->tun.n_sa_in = itp->itp_n_sa_in;
@ -224,12 +229,8 @@ vl_api_ipsec_tunnel_protect_dump_t_handler (vl_api_ipsec_tunnel_protect_dump_t
}
else
{
index_t itpi;
itpi = ipsec_tun_protect_find (sw_if_index);
if (INDEX_INVALID != itpi)
send_ipsec_tunnel_protect_details (itpi, &ctx);
ipsec_tun_protect_walk_itf (sw_if_index,
send_ipsec_tunnel_protect_details, &ctx);
}
#else
clib_warning ("unimplemented");
@ -680,7 +681,7 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
if (rv)
goto done;
rv = ipsec_tun_protect_update_one (sw_if_index,
rv = ipsec_tun_protect_update_one (sw_if_index, NULL,
ipsec_tun_mk_output_sa_id
(sw_if_index),
ipsec_tun_mk_input_sa_id
@ -711,7 +712,7 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
if (NULL != t)
{
rv = ipsec_tun_protect_del (t->sw_if_index);
rv = ipsec_tun_protect_del (t->sw_if_index, NULL);
ipip_del_tunnel (t->sw_if_index);
}
else
@ -859,10 +860,10 @@ vl_api_ipsec_tunnel_if_set_sa_t_handler (vl_api_ipsec_tunnel_if_set_sa_t * mp)
VALIDATE_SW_IF_INDEX(mp);
if (mp->is_outbound)
rv = ipsec_tun_protect_update_out (ntohl (mp->sw_if_index),
rv = ipsec_tun_protect_update_out (ntohl (mp->sw_if_index), NULL,
ntohl (mp->sa_id));
else
rv = ipsec_tun_protect_update_in (ntohl (mp->sw_if_index),
rv = ipsec_tun_protect_update_in (ntohl (mp->sw_if_index), NULL,
ntohl (mp->sa_id));
#else

12
src/vnet/ipsec/ipsec_cli.c
View File

@ -391,7 +391,7 @@ ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im)
static walk_rc_t
ipsec_tun_protect_show_one (index_t itpi, void *ctx)
{
vlib_cli_output (ctx, "%U", format_ipsec_tun_protect, itpi);
vlib_cli_output (ctx, "%U", format_ipsec_tun_protect_index, itpi);
return (WALK_CONTINUE);
}
@ -728,6 +728,7 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
unformat_input_t _line_input, *line_input = &_line_input;
ip46_address_t local_ip = ip46_address_initializer;
ip46_address_t remote_ip = ip46_address_initializer;
ip_address_t nh = IP_ADDRESS_V4_ALL_0S;
ipsec_crypto_alg_t crypto_alg;
ipsec_integ_alg_t integ_alg;
ipsec_sa_flags_t flags;
@ -808,6 +809,8 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
;
else if (unformat (line_input, "del"))
is_add = 0;
else if (unformat (line_input, "nh &U", unformat_ip_address, &nh))
;
else
{
error = clib_error_return (0, "unknown input `%U'",
@ -858,7 +861,7 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
clib_host_to_net_u32 (salt), &remote_ip,
&local_ip, NULL);
rv |=
ipsec_tun_protect_update_one (sw_if_index,
ipsec_tun_protect_update_one (sw_if_index, &nh,
ipsec_tun_mk_local_sa_id (sw_if_index),
ipsec_tun_mk_remote_sa_id
(sw_if_index));
@ -902,6 +905,7 @@ ipsec_tun_protect_cmd (vlib_main_t * vm,
{
unformat_input_t _line_input, *line_input = &_line_input;
u32 sw_if_index, is_del, sa_in, sa_out, *sa_ins = NULL;
ip_address_t peer = { };
vnet_main_t *vnm;
is_del = 0;
@ -924,13 +928,15 @@ ipsec_tun_protect_cmd (vlib_main_t * vm,
else if (unformat (line_input, "%U",
unformat_vnet_sw_interface, vnm, &sw_if_index))
;
else if (unformat (line_input, "%U", unformat_ip_address, &peer))
;
else
return (clib_error_return (0, "unknown input '%U'",
format_unformat_error, line_input));
}
if (!is_del)
ipsec_tun_protect_update (sw_if_index, sa_out, sa_ins);
ipsec_tun_protect_update (sw_if_index, &peer, sa_out, sa_ins);
unformat_free (line_input);
return NULL;

34
src/vnet/ipsec/ipsec_format.c
View File

@ -336,27 +336,34 @@ done:
return (s);
}
u8 *
format_ipsec_tun_protect_index (u8 * s, va_list * args)
{
u32 itpi = va_arg (*args, index_t);
ipsec_tun_protect_t *itp;
if (pool_is_free_index (ipsec_tun_protect_pool, itpi))
return (format (s, "No such tunnel index: %d", itpi));
itp = pool_elt_at_index (ipsec_tun_protect_pool, itpi);
return (format (s, "%U", format_ipsec_tun_protect, itp));
}
u8 *
format_ipsec_tun_protect (u8 * s, va_list * args)
{
u32 itpi = va_arg (*args, u32);
ipsec_tun_protect_t *itp;
ipsec_tun_protect_t *itp = va_arg (*args, ipsec_tun_protect_t *);
u32 sai;
if (pool_is_free_index (ipsec_protect_pool, itpi))
{
s = format (s, "No such tunnel index: %d", itpi);
goto done;
}
itp = pool_elt_at_index (ipsec_protect_pool, itpi);
s = format (s, "%U", format_vnet_sw_if_index_name,
vnet_get_main (), itp->itp_sw_if_index);
if (!ip_address_is_zero (itp->itp_key))
s = format (s, ": %U", format_ip_address, itp->itp_key);
s = format (s, "\n output-sa:");
s =
format (s, "\n %U", format_ipsec_sa, itp->itp_out_sa,
IPSEC_FORMAT_BRIEF);
s = format (s, "\n %U", format_ipsec_sa, itp->itp_out_sa,
IPSEC_FORMAT_BRIEF);
s = format (s, "\n input-sa:");
/* *INDENT-OFF* */
@ -366,7 +373,6 @@ format_ipsec_tun_protect (u8 * s, va_list * args)
}));
/* *INDENT-ON* */
done:
return (s);
}

573
src/vnet/ipsec/ipsec_tun.c
View File

File diff suppressed because it is too large Load Diff

39
src/vnet/ipsec/ipsec_tun.h
View File

@ -77,6 +77,8 @@ typedef struct ipsec_tun_protect_t_
ipsec_ep_t itp_tun;
ip_address_t *itp_key;
} ipsec_tun_protect_t;
#define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body) \
@ -96,21 +98,28 @@ typedef struct ipsec_tun_protect_t_
} \
}
extern int ipsec_tun_protect_update_one (u32 sw_if_index, u32 sa_out,
u32 sa_in);
extern int ipsec_tun_protect_update (u32 sw_if_index, u32 sa_out,
u32 * sa_ins);
extern int ipsec_tun_protect_update_in (u32 sw_if_index, u32 sa_in);
extern int ipsec_tun_protect_update_out (u32 sw_if_index, u32 sa_out);
extern int ipsec_tun_protect_update_one (u32 sw_if_index,
const ip_address_t * nh,
u32 sa_out, u32 sa_in);
extern int ipsec_tun_protect_update (u32 sw_if_index,
const ip_address_t * nh,
u32 sa_out, u32 * sa_ins);
extern int ipsec_tun_protect_update_in (u32 sw_if_index,
const ip_address_t * nh, u32 sa_in);
extern int ipsec_tun_protect_update_out (u32 sw_if_index,
const ip_address_t * nh, u32 sa_out);
extern int ipsec_tun_protect_del (u32 sw_if_index);
extern int ipsec_tun_protect_del (u32 sw_if_index, const ip_address_t * nh);
typedef walk_rc_t (*ipsec_tun_protect_walk_cb_t) (index_t itpi, void *arg);
extern void ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn,
void *cttx);
extern index_t ipsec_tun_protect_find (u32 sw_if_index);
extern void ipsec_tun_protect_walk_itf (u32 sw_if_index,
ipsec_tun_protect_walk_cb_t fn,
void *cttx);
extern u8 *format_ipsec_tun_protect (u8 * s, va_list * args);
extern u8 *format_ipsec_tun_protect_index (u8 * s, va_list * args);
// FIXME
extern vlib_node_registration_t ipsec4_tun_input_node;
@ -119,7 +128,7 @@ extern vlib_node_registration_t ipsec6_tun_input_node;
/*
* DP API
*/
extern ipsec_tun_protect_t *ipsec_protect_pool;
extern ipsec_tun_protect_t *ipsec_tun_protect_pool;
typedef struct ipsec_tun_lkup_result_t_
{
@ -137,7 +146,17 @@ typedef struct ipsec_tun_lkup_result_t_
always_inline ipsec_tun_protect_t *
ipsec_tun_protect_get (u32 index)
{
return (pool_elt_at_index (ipsec_protect_pool, index));
return (pool_elt_at_index (ipsec_tun_protect_pool, index));
}
extern index_t *ipsec_tun_protect_sa_by_adj_index;
always_inline index_t
ipsec_tun_protect_get_sa_out (adj_index_t ai)
{
ASSERT (vec_len (ipsec_tun_protect_sa_by_adj_index) > ai);
ASSERT (INDEX_INVALID != ipsec_tun_protect_sa_by_adj_index[ai]);
return (ipsec_tun_protect_sa_by_adj_index[ai]);
}
/*

2
src/vnet/ipsec/ipsec_tun_in.c
View File

@ -273,7 +273,7 @@ ipsec_tun_protect_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
}
}
itp0 = pool_elt_at_index (ipsec_protect_pool, itr0.tun_index);
itp0 = pool_elt_at_index (ipsec_tun_protect_pool, itr0.tun_index);
vnet_buffer (b[0])->ipsec.sad_index = itr0.sa_index;
vnet_buffer (b[0])->ipsec.protect_index = itr0.tun_index;

2
src/vnet/lisp-gpe/lisp_gpe_adjacency.c
View File

@ -159,7 +159,7 @@ lisp_gpe_adj_stack (lisp_gpe_adjacency_t * ladj)
fib_protocol_t nh_proto;
ip46_address_t nh;
ip_address_to_46 (&ladj->remote_rloc, &nh, &nh_proto);
nh_proto = ip_address_to_46 (&ladj->remote_rloc, &nh);
/*
* walk all the adjacencies on th lisp interface and restack them

2
src/vnet/lisp-gpe/lisp_gpe_fwd_entry.c
View File

@ -247,7 +247,7 @@ lisp_gpe_mk_fib_paths (const lisp_fwd_path_t * paths)
ladj = lisp_gpe_adjacency_get (paths[ii].lisp_adj);
ip_address_to_46 (&ladj->remote_rloc, &rpaths[ii].frp_addr, &fp);
fp = ip_address_to_46 (&ladj->remote_rloc, &rpaths[ii].frp_addr);
rpaths[ii].frp_proto = fib_proto_to_dpo (fp);
rpaths[ii].frp_sw_if_index = ladj->sw_if_index;

3
src/vnet/teib/teib_api.c
View File

@ -72,8 +72,7 @@ vl_api_teib_send_one (index_t nei, void *arg)
const teib_entry_t *ne;
const fib_prefix_t *pfx;
mp = vl_msg_api_alloc (sizeof (*mp));
clib_memset (mp, 0, sizeof (*mp));
mp = vl_msg_api_alloc_zero (sizeof (*mp));
mp->_vl_msg_id = ntohs (VL_API_TEIB_DETAILS + REPLY_MSG_ID_BASE);
mp->context = ctx->context;

65
test/template_ipsec.py
View File

@ -27,14 +27,14 @@ class IPsecIPv4Params(object):
self.remote_tun_if_host = '1.1.1.1'
self.remote_tun_if_host6 = '1111::1'
self.scapy_tun_sa_id = 10
self.scapy_tun_sa_id = 100
self.scapy_tun_spi = 1001
self.vpp_tun_sa_id = 20
self.vpp_tun_sa_id = 200
self.vpp_tun_spi = 1000
self.scapy_tra_sa_id = 30
self.scapy_tra_sa_id = 300
self.scapy_tra_spi = 2001
self.vpp_tra_sa_id = 40
self.vpp_tra_sa_id = 400
self.vpp_tra_spi = 2000
self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
@ -63,14 +63,14 @@ class IPsecIPv6Params(object):
self.remote_tun_if_host = '1111:1111:1111:1111:1111:1111:1111:1111'
self.remote_tun_if_host4 = '1.1.1.1'
self.scapy_tun_sa_id = 50
self.scapy_tun_sa_id = 500
self.scapy_tun_spi = 3001
self.vpp_tun_sa_id = 60
self.vpp_tun_sa_id = 600
self.vpp_tun_spi = 3000
self.scapy_tra_sa_id = 70
self.scapy_tra_sa_id = 700
self.scapy_tra_spi = 4001
self.vpp_tra_sa_id = 80
self.vpp_tra_sa_id = 800
self.vpp_tra_spi = 4000
self.auth_algo_vpp_id = (VppEnum.vl_api_ipsec_integ_alg_t.
@ -224,14 +224,14 @@ class TemplateIpsec(VppTestCase):
def show_commands_at_teardown(self):
self.logger.info(self.vapi.cli("show hardware"))
def gen_encrypt_pkts(self, sa, sw_intf, src, dst, count=1,
def gen_encrypt_pkts(self, p, sa, sw_intf, src, dst, count=1,
payload_size=54):
return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
sa.encrypt(IP(src=src, dst=dst) /
ICMP() / Raw(b'X' * payload_size))
for i in range(count)]
def gen_encrypt_pkts6(self, sa, sw_intf, src, dst, count=1,
def gen_encrypt_pkts6(self, p, sa, sw_intf, src, dst, count=1,
payload_size=54):
return [Ether(src=sw_intf.remote_mac, dst=sw_intf.local_mac) /
sa.encrypt(IPv6(src=src, dst=dst) /
@ -562,7 +562,7 @@ class IpsecTra4(object):
self.vapi.cli("clear ipsec sa")
try:
p = self.params[socket.AF_INET]
send_pkts = self.gen_encrypt_pkts(p.scapy_tra_sa, self.tra_if,
send_pkts = self.gen_encrypt_pkts(p, p.scapy_tra_sa, self.tra_if,
src=self.tra_if.remote_ip4,
dst=self.tra_if.local_ip4,
count=count,
@ -617,7 +617,7 @@ class IpsecTra6(object):
self.vapi.cli("clear ipsec sa")
try:
p = self.params[socket.AF_INET6]
send_pkts = self.gen_encrypt_pkts6(p.scapy_tra_sa, self.tra_if,
send_pkts = self.gen_encrypt_pkts6(p, p.scapy_tra_sa, self.tra_if,
src=self.tra_if.remote_ip6,
dst=self.tra_if.local_ip6,
count=count,
@ -831,10 +831,11 @@ class IpsecTun4(object):
def verify_tun_44(self, p, count=1, payload_size=64, n_rx=None):
self.vapi.cli("clear errors")
self.vapi.cli("clear ipsec counters")
self.vapi.cli("clear ipsec sa")
if not n_rx:
n_rx = count
try:
send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host,
dst=self.pg1.remote_ip4,
count=count,
@ -861,13 +862,33 @@ class IpsecTun4(object):
self.logger.info(self.vapi.ppcli("show ipsec sa 4"))
self.verify_counters4(p, count, n_rx)
def verify_tun_dropped_44(self, p, count=1, payload_size=64, n_rx=None):
self.vapi.cli("clear errors")
if not n_rx:
n_rx = count
try:
send_pkts = self.gen_encrypt_pkts(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host,
dst=self.pg1.remote_ip4,
count=count)
self.send_and_assert_no_replies(self.tun_if, send_pkts)
send_pkts = self.gen_pkts(self.pg1, src=self.pg1.remote_ip4,
dst=p.remote_tun_if_host, count=count,
payload_size=payload_size)
self.send_and_assert_no_replies(self.pg1, send_pkts)
finally:
self.logger.info(self.vapi.ppcli("show error"))
self.logger.info(self.vapi.ppcli("show ipsec all"))
def verify_tun_reass_44(self, p):
self.vapi.cli("clear errors")
self.vapi.ip_reassembly_enable_disable(
sw_if_index=self.tun_if.sw_if_index, enable_ip4=True)
try:
send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host,
dst=self.pg1.remote_ip4,
payload_size=1900,
@ -894,7 +915,7 @@ class IpsecTun4(object):
def verify_tun_64(self, p, count=1):
self.vapi.cli("clear errors")
try:
send_pkts = self.gen_encrypt_pkts6(p.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts6(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host6,
dst=self.pg1.remote_ip6,
count=count)
@ -1011,7 +1032,8 @@ class IpsecTun6(object):
self.vapi.cli("clear errors")
self.vapi.cli("clear ipsec sa")
send_pkts = self.gen_encrypt_pkts6(p_in.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts6(p_in, p_in.scapy_tun_sa,
self.tun_if,
src=p_in.remote_tun_if_host,
dst=self.pg1.remote_ip6,
count=count)
@ -1024,7 +1046,8 @@ class IpsecTun6(object):
if not p_out:
p_out = p_in
try:
send_pkts = self.gen_encrypt_pkts6(p_in.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts6(p_in, p_in.scapy_tun_sa,
self.tun_if,
src=p_in.remote_tun_if_host,
dst=self.pg1.remote_ip6,
count=count,
@ -1054,7 +1077,7 @@ class IpsecTun6(object):
sw_if_index=self.tun_if.sw_if_index, enable_ip6=True)
try:
send_pkts = self.gen_encrypt_pkts6(p.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts6(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host,
dst=self.pg1.remote_ip6,
count=1,
@ -1082,7 +1105,7 @@ class IpsecTun6(object):
""" ipsec 4o6 tunnel basic test """
self.vapi.cli("clear errors")
try:
send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host4,
dst=self.pg1.remote_ip4,
count=count)
@ -1145,7 +1168,7 @@ class IpsecTun6HandoffTests(IpsecTun6):
# inject alternately on worker 0 and 1. all counts on the SA
# should be against worker 0
for worker in [0, 1, 0, 1]:
send_pkts = self.gen_encrypt_pkts6(p.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts6(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host,
dst=self.pg1.remote_ip6,
count=N_PKTS)
@ -1176,7 +1199,7 @@ class IpsecTun4HandoffTests(IpsecTun4):
# inject alternately on worker 0 and 1. all counts on the SA
# should be against worker 0
for worker in [0, 1, 0, 1]:
send_pkts = self.gen_encrypt_pkts(p.scapy_tun_sa, self.tun_if,
send_pkts = self.gen_encrypt_pkts(p, p.scapy_tun_sa, self.tun_if,
src=p.remote_tun_if_host,
dst=self.pg1.remote_ip4,
count=N_PKTS)

14
test/test_gre.py
View File

@ -12,7 +12,7 @@ from scapy.volatile import RandMAC, RandIP
from framework import VppTestCase, VppTestRunner
from vpp_sub_interface import L2_VTR_OP, VppDot1QSubint
from vpp_gre_interface import VppGreInterface
from vpp_teib import VppNhrp
from vpp_teib import VppTeib
from vpp_ip import DpoProto
from vpp_ip_route import VppIpRoute, VppRoutePath, VppIpTable, FibPathProto
from util import ppp, ppc
@ -1067,9 +1067,9 @@ class TestGRE(VppTestCase):
route_via_tun.add_vpp_config()
#
# Add a NHRP entry resolves the peer
# Add a TEIB entry resolves the peer
#
teib = VppNhrp(self, gre_if,
teib = VppTeib(self, gre_if,
gre_if._remote_hosts[ii].ip4,
itf._remote_hosts[ii].ip4)
teib.add_vpp_config()
@ -1093,7 +1093,7 @@ class TestGRE(VppTestCase):
self.verify_decapped_4o4(self.pg0, rx, tx_i)
#
# delete and re-add the NHRP
# delete and re-add the TEIB
#
teib.remove_vpp_config()
self.send_and_assert_no_replies(self.pg0, tx_e)
@ -1152,9 +1152,9 @@ class TestGRE(VppTestCase):
route_addr = "4::%d" % ii
#
# Add a NHRP entry resolves the peer
# Add a TEIB entry resolves the peer
#
teib = VppNhrp(self, gre_if,
teib = VppTeib(self, gre_if,
gre_if._remote_hosts[ii].ip6,
itf._remote_hosts[ii].ip6)
teib.add_vpp_config()
@ -1188,7 +1188,7 @@ class TestGRE(VppTestCase):
self.verify_decapped_6o6(self.pg0, rx, tx_i)
#
# delete and re-add the NHRP
# delete and re-add the TEIB
#
teib.remove_vpp_config()
self.send_and_assert_no_replies(self.pg0, tx_e)

8
test/test_ipip.py
View File

@ -8,7 +8,7 @@ from framework import VppTestCase, VppTestRunner
from vpp_ip import DpoProto
from vpp_ip_route import VppIpRoute, VppRoutePath, VppIpTable, FibPathProto
from vpp_ipip_tun_interface import VppIpIpTunInterface
from vpp_teib import VppNhrp
from vpp_teib import VppTeib
from vpp_papi import VppEnum
from socket import AF_INET, AF_INET6, inet_pton
from util import reassemble4
@ -528,9 +528,9 @@ class TestIPIP(VppTestCase):
route_via_tun.add_vpp_config()
#
# Add a NHRP entry resolves the peer
# Add a TEIB entry resolves the peer
#
teib = VppNhrp(self, ipip_if,
teib = VppTeib(self, ipip_if,
ipip_if._remote_hosts[ii].ip4,
itf._remote_hosts[ii].ip4)
teib.add_vpp_config()
@ -566,7 +566,7 @@ class TestIPIP(VppTestCase):
rx = self.send_and_expect(self.pg0, tx_i, self.pg0)
#
# delete and re-add the NHRP
# delete and re-add the TEIB
#
teib.remove_vpp_config()
self.send_and_assert_no_replies(self.pg0, tx_e)

297
test/test_ipsec_tun_if_esp.py
View File

File diff suppressed because it is too large Load Diff

19
test/vpp_ipsec.py
View File

@ -272,13 +272,16 @@ class VppIpsecTunProtect(VppObject):
VPP IPSEC tunnel protection
"""
def __init__(self, test, itf, sa_out, sas_in):
def __init__(self, test, itf, sa_out, sas_in, nh=None):
self.test = test
self.itf = itf
self.sas_in = []
for sa in sas_in:
self.sas_in.append(sa.id)
self.sa_out = sa_out.id
self.nh = nh
if not self.nh:
self.nh = "0.0.0.0"
def update_vpp_config(self, sa_out, sas_in):
self.sas_in = []
@ -290,10 +293,11 @@ class VppIpsecTunProtect(VppObject):
'sw_if_index': self.itf._sw_if_index,
'n_sa_in': len(self.sas_in),
'sa_out': self.sa_out,
'sa_in': self.sas_in})
'sa_in': self.sas_in,
'nh': self.nh})
def object_id(self):
return "ipsec-tun-protect-%s" % self.itf
return "ipsec-tun-protect-%s-%s" % (self.itf, self.nh)
def add_vpp_config(self):
self.test.vapi.ipsec_tunnel_protect_update(
@ -301,17 +305,20 @@ class VppIpsecTunProtect(VppObject):
'sw_if_index': self.itf._sw_if_index,
'n_sa_in': len(self.sas_in),
'sa_out': self.sa_out,
'sa_in': self.sas_in})
'sa_in': self.sas_in,
'nh': self.nh})
self.test.registry.register(self, self.test.logger)
def remove_vpp_config(self):
self.test.vapi.ipsec_tunnel_protect_del(
sw_if_index=self.itf.sw_if_index)
sw_if_index=self.itf.sw_if_index,
nh=self.nh)
def query_vpp_config(self):
bs = self.test.vapi.ipsec_tunnel_protect_dump(
sw_if_index=self.itf.sw_if_index)
for b in bs:
if b.tun.sw_if_index == self.itf.sw_if_index:
if b.tun.sw_if_index == self.itf.sw_if_index and \
self.nh == str(b.tun.nh):
return True
return False

5
test/vpp_teib.py
View File

@ -1,6 +1,6 @@
#!/usr/bin/env python
"""
NHRP objects
TEIB objects
"""
from vpp_object import VppObject
@ -15,7 +15,7 @@ def find_teib(test, ne):
return False
class VppNhrp(VppObject):
class VppTeib(VppObject):
def __init__(self, test, itf, peer, nh, table_id=0):
self._test = test
@ -34,6 +34,7 @@ class VppNhrp(VppObject):
'nh': self.nh,
})
self._test.registry.register(self, self._test.logger)
return self
def remove_vpp_config(self):
r = self._test.vapi.teib_entry_add_del(