28 Commits

Author SHA1 Message Date
Neale Ranns
097fa66b98 fib: fib api updates
Enhance the route add/del APIs to take a set of paths rather than just one.
Most unicast routing protocols calcualte all the available paths in one
run of the algorithm so updating all the paths at once is beneficial for the client.
two knobs control the behaviour:
  is_multipath - if set the the set of paths passed will be added to those
                 that already exist, otherwise the set will replace them.
  is_add - add or remove the set

is_add=0, is_multipath=1 and an empty set, results in deleting the route.

It is also considerably faster to add multiple paths at once, than one at a time:

vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.11
100000 routes in .572240 secs, 174751.80 routes/sec
vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.12
100000 routes in .528383 secs, 189256.54 routes/sec
vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.13
100000 routes in .757131 secs, 132077.52 routes/sec
vat# ip_add_del_route 1.1.1.1/32 count 100000 multipath via 10.10.10.14
100000 routes in .878317 secs, 113854.12 routes/sec

vat# ip_route_add_del 1.1.1.1/32 count 100000 multipath via 10.10.10.11 via 10.10.10.12 via 10.10.10.13 via 10.10.10.14
100000 routes in .900212 secs, 111084.93 routes/sec

Change-Id: I416b93f7684745099c1adb0b33edac58c9339c1a
Signed-off-by: Neale Ranns <neale.ranns@cisco.com>
Signed-off-by: Ole Troan <ot@cisco.com>
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>
2019-06-18 13:31:39 +00:00
Damjan Marion
4cb83811e3 crypto_ipsecmb: use pre-expanded keys
Change-Id: Ie1d34b7e71554516595e0cd228e2cd54a3b8d629
Signed-off-by: Damjan Marion <damarion@cisco.com>
2019-04-25 18:04:02 +00:00
Neale Ranns
21ada3bd7e IPSEC-MB: Use random & non-repeating IV (VPP-1642)
hard code IV and key lengths based on cipher.
Init IV from random data, use AES instruction to rotate.

Change-Id: I13a6507d12267b823c528660a903787baeba47a0
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-11 15:12:58 +00:00
Neale Ranns
92e9384482 crypto: Intel IPSEC-MB engine
A plugin to use Intel IPSec MB library as a VPP crypto engine

This changes uses concepts from:
  https://gerrit.fd.io/r/#/c/17301/
hence that author's work is acknowledge below

Change-Id: I2bf3beeb10f3c9706fa5efbdc9bc023e310f5a92
Signed-off-by: Neale Ranns <nranns@cisco.com>
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2019-04-10 18:35:13 +00:00
Neale Ranns
4f33c80c5d IPSEC: for each engine and algorithm tests
refactor the IPSEC tests a bit so we can parameterise
the setup.

Change-Id: I777e5eb8f29ca1dce3dd273ebd05dae5846790af
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-10 17:00:35 +00:00
Paul Vinciguerra
7f9b7f9f49 Tests Cleanup: Fix missing calls to setUpClass/tearDownClass.
Continuation/Part 2 of https://gerrit.fd.io/r/#/c/17092/

Change-Id: Id0122d84eaf2c05d29e5be63a594d5e528ee7c9a
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>
2019-04-10 14:37:40 +00:00
Neale Ranns
1091c4aa9b IPSEC TEST: various hash alogrithms
Change-Id: I925aa5bf9472e81f98072d63df499b19e6ddf43d
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-04-08 21:52:04 +00:00
Damjan Marion
1e3aa5e213 ipsec: USE_EXTENDED_SEQ_NUM -> USE_ESN
Change-Id: Ib828ea5106f3ae280e4ce233f2462dee363580b7
Signed-off-by: Damjan Marion <damarion@cisco.com>
2019-03-28 22:23:08 +00:00
Neale Ranns
3833ffd6c6 IPSEC tests fnd fix or Extended Sequence Numbers
Change-Id: Iad6c4b867961ec8036110a4e15a829ddb93193ed
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-03-25 20:03:24 +00:00
Neale Ranns
2ac885c665 IPSEC: Mutli-tunnel tests
Change-Id: I46f1db6579835c6613fdbb2b726246cc62b135fe
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-03-21 13:44:31 +00:00
Neale Ranns
53f526b680 TEST: IPSEC NAT-T with UDP header
Change-Id: I5ef8b3f4be40a7a0b0f1cb90dc0e15a4711e8664
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-02-28 07:59:03 +00:00
Neale Ranns
eba31ecebe IPSEC: move SA counters into the stats segment
1) stats are accessed via the stat segment which is more condusive to
   monitoring
2) stats are accurate in the presence of multiple threads. There's no
   guarantee that an SA is access from only one worker.

Change-Id: Id5e217ea253ddfc9480aaedb0d008dea031b1148
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-02-18 13:05:17 +00:00
Neale Ranns
a09c1ff5b6 IPSEC: SPD counters in the stats sgement
- return the stats_index of each SPD in the create API call
- no ip_any in the API as this creates 2 SPD entries. client must add both v4 and v6 explicitly
- only one pool of SPD entries (rhter than one per-SPD) to support this
- no packets/bytes in the dump API. Polling the stats segment is much more efficient
  (if the SA lifetime is based on packet/bytes)
- emit the policy index in the packet trace and CLI commands.

Change-Id: I7eaf52c9d0495fa24450facf55229941279b8569
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-02-05 14:59:44 +00:00
Neale Ranns
17dcec0b94 IPSEC: API modernisation
- use enums to enumerate the algoritms and protocols that are supported
- use address_t types to simplify encode/deocde
- use typedefs of entry objects to get consistency between add/del API and dump

Change-Id: I7e7c58c06a150e2439633ba9dca58bc1049677ee
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-01-31 20:44:22 +00:00
Klement Sekera
bf613955ca make test: remove generic imports
Change-Id: I55b89f0d9fb082c7763b64b09ab14573468c6704
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2019-01-29 11:39:57 +01:00
Neale Ranns
311124e21b IPSEC: tests use opbject registry
this means we test the dumps - to some extent

Change-Id: I8d90745701012012b41a7b3aaf9be97b4dd2bdf8
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-01-25 19:54:49 +00:00
Neale Ranns
8e4a89bf42 IPSEC Tests: to per-test setup and tearDown
don't do the setup and teardown in class methods so that with
each test the config is added and deleted. that way we test that
delete actually removes state.
more helpful error codes from VPP for existing IPSEC state.

Change-Id: I5de1578f73b935b420d4cdd85aa98d5fdcc682f6
Signed-off-by: Neale Ranns <nranns@cisco.com>
2019-01-24 19:51:37 +00:00
Neale Ranns
de847277c9 IPSEC-AH: anti-replay testing
Change-Id: Ia5d45db73e4bdb32214ed4f365d5eec8e28115f3
Signed-off-by: Neale Ranns <nranns@cisco.com>
2018-12-02 20:43:32 +00:00
Klement Sekera
b4d3053445 ipsec: infra for selecting backends
Change-Id: Ifa6d8391b1b2413a88b7720fc434e0bc849a149a
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2018-11-15 12:57:18 +00:00
Klement Sekera
611864f4bd ipsec: add missing ipv6 ah code & ipv6 tests
Change-Id: I89e90193ded1beb6cb0950c15737f9467efac1c3
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-10-03 17:38:41 +00:00
Klement Sekera
31da2e3031 Revert "Revert "ipsec: VPP-1316 calculate IP/TCP/UDP inner checksums""
This reverts commit e0d2bd6bd7fc59c0c6ac48195d7f825dc99bfd91.

Change-Id: If491e16f9ea66b2493a6a7c7f3c684ed585f8f51
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-06-24 22:53:37 +02:00
Ole Troan
e0d2bd6bd7 Revert "ipsec: VPP-1316 calculate IP/TCP/UDP inner checksums"
This reverts commit a98346f664aae148d26a8e158008b773d73db96f.

Change-Id: Iee5b3a5ddff0e8fd3a30fe5973cee24de434fe12
Signed-off-by: Ole Troan <ot@cisco.com>
2018-06-22 22:37:55 +02:00
Klement Sekera
a98346f664 ipsec: VPP-1316 calculate IP/TCP/UDP inner checksums
Calculate IP/TCP/UDP checksums in software before adding authentication.

Change-Id: I3e121cb00aeba667764f39ade8d62170f18f8b6b
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-06-21 14:50:10 +00:00
Klement Sekera
84c6204969 make test: reorganize ipsec_ah test code
Change-Id: Ie0eb0127affd3d771d19bb7c60e79c31858d82cd
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-05-11 20:08:23 +00:00
Klement Sekera
4b089f27b3 ipsec: support UDP encap/decap for NAT traversal
Change-Id: I65c12617ad49e4d5ef242e53988782f0cefa5684
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-05-09 21:54:10 +00:00
Klement Sekera
28fb03fc39 make test: ipsec test cleanup
Change-Id: If813346b665468b25aaf5d95629bcad87212aa3e
Signed-off-by: Klement Sekera <ksekera@cisco.com>
2018-04-17 17:09:28 +00:00
Neale Ranns
2bc940272e Scapy upgrade to 2.4.0.rc5
- many of the patches fd.io applies in test/patches/2.3.3 are now upstreamed in 2.4
- 2.4 adds support for IGMPv3 which is my main motivation for the upgrade

Change-Id: If2c0a524e3cba320b4a5d8cd07817c6ea2bf0c5a
Signed-off-by: Neale Ranns <nranns@cisco.com>
2018-03-19 13:09:45 +00:00
“mystarrocks”
23f0c4515f ESP_AH_test_automation_scripts rev1
Change-Id: I941abdc4a02e4c52c66b9d299e380b27caca7c1d
Signed-off-by: “mystarrocks” <mystarrocks@yahoo.com>
2017-12-15 09:50:21 +00:00