36 Commits

Author SHA1 Message Date
Andrew Yourtchenko
bc49679802 tests: split up the long running IPSec tests into separate classes
Type: test
Change-Id: Ieeae7f1653f5f2e8e49f258871b389ef8954c90b
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
(cherry picked from commit fbc388986e3f38aaedff87b843137be81b7d4f91)
2019-09-30 15:29:08 +00:00
Neale Ranns
17b7a067a2 ipsec: Fix NULL encryption algorithm
Type: fix
Ticket: VPP-1756

the block-size was set to 0 resulting in incorrect placement of the ESP
footer.

add tests for NULL encrypt + integ.

Change-Id: I8ab3afda8e68f9ff649540cba3f2cac68f12bbba
Signed-off-by: Neale Ranns <nranns@cisco.com>
(cherry picked from commit 2cdcd0cf4004b2c0d1d3b891e381aac5735c21f1)
2019-09-25 22:09:00 +00:00
Dmitry Vakhrushev
b197fd7b67 ipsec: fix missed IPSEC_INTEG_ALG_MD5_96
This algorithm was missed in last improvements.

Type:fix

Signed-off-by: Dmitry Vakhrushev <dmitry@netgate.com>
Change-Id: Ib818cbdcdd1a6f298e8b0086dac4189cc201baa3
(cherry picked from commit 77cc14a2b29a65073539e6e3f4683a380875b3dc)
2019-09-19 18:18:28 +00:00
Neale Ranns
00625a64f4 tests: Split IPSec ESP into parameterized tests per engine
Type: feature

Change-Id: Icb1bd3fce768aebf8919c63a104f771ca7fa1d6f
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-07-31 12:55:46 +00:00
Neale Ranns
6afaae156a ipsec: GCM, Anti-replay and ESN fixess
Type: fix

Several Fixes:
 1 - Anti-replay did not work with GCM becuase it overwrote the sequence
number in the ESP header. To fix i added the seq num to the per-packet
data so it is preserved
 2 - The high sequence number was not byte swapped during ESP encrypt.
 3 - openssl engine was the only one to return FAIL_DECRYPT for bad GCM
the others return BAD_HMAC. removed the former
 4 - improved tracing to show the low and high seq numbers
 5 - documented the anti-replay window checks
 6 - fixed scapy patch for ESN support for GCM
 7 - tests for anti-reply (w/ and w/o ESN) for each crypto algo

Change-Id: Id65d96b6d1d4dd821b2ab557e87468fff6d70e5b
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-07-24 11:01:47 +00:00
juraj.linkes
1105766b8f tests: Re-enable ipsec tests on ARM
Type: fix

* test_ipsec_tun_if_esp.TestIpsecGreTebIfEsp
* test_ipsec_esp.TestIpsecEspAll
  add keepalive messages before each algo/engine to prevent test timeout

Change-Id: I726f3f9613bab02a65e65542cee494c68176ded7
Signed-off-by: juraj.linkes <juraj.linkes@pantheon.tech>
2019-07-10 08:01:35 +00:00
Neale Ranns
c87b66c862 ipsec: ipsec-tun protect
please consult the new tunnel proposal at:
  https://wiki.fd.io/view/VPP/IPSec

Type: feature

Change-Id: I52857fc92ae068b85f59be08bdbea1bd5932e291
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-06-18 13:54:35 +00:00
Neale Ranns
097fa66b98 fib: fib api updates
Enhance the route add/del APIs to take a set of paths rather than just one.
Most unicast routing protocols calcualte all the available paths in one
run of the algorithm so updating all the paths at once is beneficial for the client.
two knobs control the behaviour:
  is_multipath - if set the the set of paths passed will be added to those
                 that already exist, otherwise the set will replace them.
  is_add - add or remove the set

is_add=0, is_multipath=1 and an empty set, results in deleting the route.

It is also considerably faster to add multiple paths at once, than one at a time:

vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.11
100000 routes in .572240 secs, 174751.80 routes/sec
vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.12
100000 routes in .528383 secs, 189256.54 routes/sec
vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.13
100000 routes in .757131 secs, 132077.52 routes/sec
vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.14
100000 routes in .878317 secs, 113854.12 routes/sec

vat# ip_route_add_del 1.1.1.1/32 count 100000 multipath via 10.10.10.11 via 10.10.10.12 via 10.10.10.13 via 10.10.10.14
100000 routes in .900212 secs, 111084.93 routes/sec

Change-Id: I416b93f7684745099c1adb0b33edac58c9339c1a
Signed-off-by: Neale Ranns <neale.ranns@cisco.com>
Signed-off-by: Ole Troan <ot@cisco.com>
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>
2019-06-18 13:31:39 +00:00
Vladimir Ratnikov
f48050785f openssl plugin 3des routine iv_len fix
Since 3DES has 8 bytes of initialization vector and
code contains hardcode for 16 bytes, check added to
determine if crypto algorythm is 3DES_CBC and set
corresponding iv_len param

Change-Id: Iac50c8a8241e321e3b4d576c88f2496852bd905c
Signed-off-by: Vladimir Ratnikov <vratnikov@netgate.com>
2019-05-20 16:59:53 +00:00
Neale Ranns
80f6fd53fe IPSEC: Pass the algorithm salt (used in GCM) over the API
Change-Id: Ia8cea13f7b937294e6a080a55fb2ceff30063acf
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-17 13:05:07 +00:00
Neale Ranns
d8cfbebce7 crypto-ipsecmb: enable GCM
Change-Id: I670d7899bcc63a419daf481167dc445a6386cce8
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-17 13:03:45 +00:00
Neale Ranns
47feb1146e IPSEC: support GCM in ESP
Change-Id: Id2ddb77b4ec3dd543d6e638bc882923f2bac011d
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-16 15:54:31 +00:00
Neale Ranns
49e7ef60cb IPSEC: ESP with ESN tests and fixes
Change-Id: Ie42b26e6d5cdb7b23f370ea2933c65079e8d1089
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-11 19:42:34 +00:00
Neale Ranns
21ada3bd7e IPSEC-MB: Use random & non-repeating IV (VPP-1642)
hard code IV and key lengths based on cipher.
Init IV from random data, use AES instruction to rotate.

Change-Id: I13a6507d12267b823c528660a903787baeba47a0
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-11 15:12:58 +00:00
Paul Vinciguerra
90cf21b5d8 Tests: Refactor tearDown show command logging, add lifecycle markers.
This change adds a consistent interface for adding test-specific show commands to
log.txt.

It also adds log markers for the execution of setUp[Class], tearDown[Class]
in the logs.

Change-Id: I7d42e396e594a59e866a7d55dac0af25548e657a
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>
2019-04-11 07:23:11 +00:00
Neale Ranns
92e9384482 crypto: Intel IPSEC-MB engine
A plugin to use Intel IPSec MB library as a VPP crypto engine

This changes uses concepts from:
  https://gerrit.fd.io/r/#/c/17301/
hence that author's work is acknowledge below

Change-Id: I2bf3beeb10f3c9706fa5efbdc9bc023e310f5a92
Signed-off-by: Neale Ranns <nranns@cisco.com>
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2019-04-10 18:35:13 +00:00
Neale Ranns
4f33c80c5d IPSEC: for each engine and algorithm tests
refactor the IPSEC tests a bit so we can parameterise
the setup.

Change-Id: I777e5eb8f29ca1dce3dd273ebd05dae5846790af
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-10 17:00:35 +00:00
Paul Vinciguerra
7f9b7f9f49 Tests Cleanup: Fix missing calls to setUpClass/tearDownClass.
Continuation/Part 2 of https://gerrit.fd.io/r/#/c/17092/

Change-Id: Id0122d84eaf2c05d29e5be63a594d5e528ee7c9a
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>
2019-04-10 14:37:40 +00:00
Paul Vinciguerra
8feeaff56f Typos. A bunch of typos I've been collecting.
Change-Id: I53ab8d17914e6563110354e4052109ac02bf8f3b
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>
2019-03-28 06:36:04 +00:00
Neale Ranns
2ac885c665 IPSEC: Mutli-tunnel tests
Change-Id: I46f1db6579835c6613fdbb2b726246cc62b135fe
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-03-21 13:44:31 +00:00
Neale Ranns
53f526b680 TEST: IPSEC NAT-T with UDP header
Change-Id: I5ef8b3f4be40a7a0b0f1cb90dc0e15a4711e8664
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-02-28 07:59:03 +00:00
Neale Ranns
eba31ecebe IPSEC: move SA counters into the stats segment
1) stats are accessed via the stat segment which is more condusive to
   monitoring
2) stats are accurate in the presence of multiple threads. There's no
   guarantee that an SA is access from only one worker.

Change-Id: Id5e217ea253ddfc9480aaedb0d008dea031b1148
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-02-18 13:05:17 +00:00
Neale Ranns
a09c1ff5b6 IPSEC: SPD counters in the stats sgement
- return the stats_index of each SPD in the create API call
- no ip_any in the API as this creates 2 SPD entries. client must add both v4 and v6 explicitly
- only one pool of SPD entries (rhter than one per-SPD) to support this
- no packets/bytes in the dump API. Polling the stats segment is much more efficient
  (if the SA lifetime is based on packet/bytes)
- emit the policy index in the packet trace and CLI commands.

Change-Id: I7eaf52c9d0495fa24450facf55229941279b8569
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-02-05 14:59:44 +00:00
Neale Ranns
17dcec0b94 IPSEC: API modernisation
- use enums to enumerate the algoritms and protocols that are supported
- use address_t types to simplify encode/deocde
- use typedefs of entry objects to get consistency between add/del API and dump

Change-Id: I7e7c58c06a150e2439633ba9dca58bc1049677ee
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-01-31 20:44:22 +00:00
Klement Sekera
bf613955ca make test: remove generic imports
Change-Id: I55b89f0d9fb082c7763b64b09ab14573468c6704
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2019-01-29 11:39:57 +01:00
Neale Ranns
311124e21b IPSEC: tests use opbject registry
this means we test the dumps - to some extent

Change-Id: I8d90745701012012b41a7b3aaf9be97b4dd2bdf8
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-01-25 19:54:49 +00:00
Neale Ranns
8e4a89bf42 IPSEC Tests: to per-test setup and tearDown
don't do the setup and teardown in class methods so that with
each test the config is added and deleted. that way we test that
delete actually removes state.
more helpful error codes from VPP for existing IPSEC state.

Change-Id: I5de1578f73b935b420d4cdd85aa98d5fdcc682f6
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-01-24 19:51:37 +00:00
Neale Ranns
de847277c9 IPSEC-AH: anti-replay testing
Change-Id: Ia5d45db73e4bdb32214ed4f365d5eec8e28115f3
Signed-off-by: Neale Ranns <nranns@cisco.com>
2018-12-02 20:43:32 +00:00
Klement Sekera
b4d3053445 ipsec: infra for selecting backends
Change-Id: Ifa6d8391b1b2413a88b7720fc434e0bc849a149a
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2018-11-15 12:57:18 +00:00
Klement Sekera
611864f4bd ipsec: add missing ipv6 ah code & ipv6 tests
Change-Id: I89e90193ded1beb6cb0950c15737f9467efac1c3
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-10-03 17:38:41 +00:00
Klement Sekera
31da2e3031 Revert "Revert "ipsec: VPP-1316 calculate IP/TCP/UDP inner checksums""
This reverts commit e0d2bd6bd7fc59c0c6ac48195d7f825dc99bfd91.

Change-Id: If491e16f9ea66b2493a6a7c7f3c684ed585f8f51
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-06-24 22:53:37 +02:00
Ole Troan
e0d2bd6bd7 Revert "ipsec: VPP-1316 calculate IP/TCP/UDP inner checksums"
This reverts commit a98346f664aae148d26a8e158008b773d73db96f.

Change-Id: Iee5b3a5ddff0e8fd3a30fe5973cee24de434fe12
Signed-off-by: Ole Troan <ot@cisco.com>
2018-06-22 22:37:55 +02:00
Klement Sekera
a98346f664 ipsec: VPP-1316 calculate IP/TCP/UDP inner checksums
Calculate IP/TCP/UDP checksums in software before adding authentication.

Change-Id: I3e121cb00aeba667764f39ade8d62170f18f8b6b
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-06-21 14:50:10 +00:00
Klement Sekera
4b089f27b3 ipsec: support UDP encap/decap for NAT traversal
Change-Id: I65c12617ad49e4d5ef242e53988782f0cefa5684
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-05-09 21:54:10 +00:00
Klement Sekera
28fb03fc39 make test: ipsec test cleanup
Change-Id: If813346b665468b25aaf5d95629bcad87212aa3e
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-04-17 17:09:28 +00:00
“mystarrocks”
23f0c4515f ESP_AH_test_automation_scripts rev1
Change-Id: I941abdc4a02e4c52c66b9d299e380b27caca7c1d
Signed-off-by: “mystarrocks” <mystarrocks@yahoo.com>
2017-12-15 09:50:21 +00:00