ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IPSEC: tunnel rekey fix and test (VPP-1652)

Browse Source 
Change-Id: I1c2b3e40c689bedcdcea7887792b6b6b6aeb48d5
Signed-off-by: Neale Ranns <nranns@cisco.com>
This commit is contained in:
Neale Ranns
2019-04-17 16:29:00 -07:00
committed by Damjan Marion
parent a11bf45b1a
commit d6c9e82fa3
2 changed files with 81 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
src/vnet/ipsec/ipsec_if.c
View File

@ -230,6 +230,21 @@ ipsec_tun_mk_output_sa_id (u32 ti)
return (0xc0000000 | ti);
}
static void
ipsec_tunnel_feature_set (ipsec_tunnel_if_t * t, u8 enable)
{
vnet_feature_enable_disable ("ip4-output",
"esp4-encrypt-tun",
t->sw_if_index, enable,
&t->output_sa_index,
sizeof (t->output_sa_index));
vnet_feature_enable_disable ("ip6-output",
"esp6-encrypt-tun",
t->sw_if_index, enable,
&t->output_sa_index,
sizeof (t->output_sa_index));
}
int
ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
ipsec_add_del_tunnel_args_t * args,
@ -362,16 +377,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
~0);
im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance;
vnet_feature_enable_disable ("ip4-output",
"esp4-encrypt-tun",
t->sw_if_index, 1,
&t->output_sa_index,
sizeof (t->output_sa_index));
vnet_feature_enable_disable ("ip6-output",
"esp6-encrypt-tun",
t->sw_if_index, 1,
&t->output_sa_index,
sizeof (t->output_sa_index));
ipsec_tunnel_feature_set (t, 1);
/*1st interface, register protocol */
if (pool_elts (im->tunnel_interfaces) == 1)
@ -396,16 +402,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
hi = vnet_get_hw_interface (vnm, t->hw_if_index);
vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
vnet_feature_enable_disable ("ip4-output",
"esp4-encrypt-tun",
hi->sw_if_index, 0,
&t->output_sa_index,
sizeof (t->output_sa_index));
vnet_feature_enable_disable ("ip6-output",
"esp6-encrypt-tun",
hi->sw_if_index, 0,
&t->output_sa_index,
sizeof (t->output_sa_index));
ipsec_tunnel_feature_set (t, 0);
vnet_delete_hw_interface (vnm, t->hw_if_index);
if (is_ip6)
@ -649,7 +646,13 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
return VNET_API_ERROR_INVALID_VALUE;
}
/*
* re-enable the feature to get the new SA in
* the workers are stopped so no packets are sent in the clear
*/
ipsec_tunnel_feature_set (t, 0);
t->output_sa_index = sa_index;
ipsec_tunnel_feature_set (t, 1);
}
/* remove sa_id to sa_index mapping on old SA */
@ -661,7 +664,7 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
clib_warning ("IPsec backend add/del callback returned error");
return VNET_API_ERROR_SYSCALL_ERROR_1;
}
pool_put (im->sad, old_sa);
ipsec_sa_del (old_sa->id);
return 0;
}

57
test/test_ipsec_tun_if_esp.py
View File

@ -243,6 +243,55 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4):
def tearDown(self):
super(TestIpsec4TunIfEspAll, self).tearDown()
def rekey(self, p):
#
# change the key and the SPI
#
p.crypt_key = 'X' + p.crypt_key[1:]
p.scapy_tun_spi += 1
p.scapy_tun_sa_id += 1
p.vpp_tun_spi += 1
p.vpp_tun_sa_id += 1
p.tun_if.local_spi = p.vpp_tun_spi
p.tun_if.remote_spi = p.scapy_tun_spi
config_tun_params(p, self.encryption_type, self.tun_if)
p.tun_sa_in = VppIpsecSA(self,
p.scapy_tun_sa_id,
p.scapy_tun_spi,
p.auth_algo_vpp_id,
p.auth_key,
p.crypt_algo_vpp_id,
p.crypt_key,
self.vpp_esp_protocol,
self.tun_if.local_addr[p.addr_type],
self.tun_if.remote_addr[p.addr_type],
flags=p.flags,
salt=p.salt)
p.tun_sa_out = VppIpsecSA(self,
p.vpp_tun_sa_id,
p.vpp_tun_spi,
p.auth_algo_vpp_id,
p.auth_key,
p.crypt_algo_vpp_id,
p.crypt_key,
self.vpp_esp_protocol,
self.tun_if.remote_addr[p.addr_type],
self.tun_if.local_addr[p.addr_type],
flags=p.flags,
salt=p.salt)
p.tun_sa_in.add_vpp_config()
p.tun_sa_out.add_vpp_config()
self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index,
sa_id=p.tun_sa_in.id,
is_outbound=1)
self.vapi.ipsec_tunnel_if_set_sa(sw_if_index=p.tun_if.sw_if_index,
sa_id=p.tun_sa_out.id,
is_outbound=0)
self.logger.info(self.vapi.cli("sh ipsec sa"))
def test_tun_44(self):
"""IPSEC tunnel all algos """
@ -324,7 +373,15 @@ class TestIpsec4TunIfEspAll(TemplateIpsec, IpsecTun4):
c = p.tun_if.get_tx_stats()
self.assertEqual(c['packets'], 127)
#
# rekey the tunnel
#
self.rekey(p)
self.verify_tun_44(p, count=127)
self.unconfig_network(p)
p.tun_sa_out.remove_vpp_config()
p.tun_sa_in.remove_vpp_config()
class TestIpsec6MultiTunIfEsp(TemplateIpsec, IpsecTun6):