@@ -113,9 +113,7 @@ def decrypt(self, data, key, aad=None, icv=None):
113113 self .mode (nonce , icv , len (icv )),
114114 default_backend ()).decryptor ()
115115 decryptor .authenticate_additional_data (aad )
116- pt = decryptor .update (ct ) + decryptor .finalize ()
117- pad_len = pt [- 1 ] + 1
118- return pt [:- pad_len ]
116+ return decryptor .update (ct ) + decryptor .finalize ()
119117
120118 def pad (self , data ):
121119 pad_len = (len (data ) // self .bs + 1 ) * self .bs - len (data )
@@ -435,14 +433,17 @@ def hmac_and_decrypt(self, ike):
435433 aad_len = len (ikev2 .IKEv2_payload_Encrypted ()) + len (ikev2 .IKEv2 ())
436434 ct = ep .load [:- GCM_ICV_SIZE ]
437435 tag = ep .load [- GCM_ICV_SIZE :]
438- return self .decrypt (ct , raw (ike )[:aad_len ], tag )
436+ plain = self .decrypt (ct , raw (ike )[:aad_len ], tag )
439437 else :
440438 self .verify_hmac (raw (ike ))
441439 integ_trunc = self .ike_integ_alg .trunc_len
442440
443441 # remove ICV and decrypt payload
444442 ct = ep .load [:- integ_trunc ]
445- return self .decrypt (ct )
443+ plain = self .decrypt (ct )
444+ # remove padding
445+ pad_len = plain [- 1 ]
446+ return plain [:- pad_len - 1 ]
446447
447448 def build_ts_addr (self , ts , version ):
448449 return {'starting_address_v' + version : ts ['start_addr' ],
@@ -540,6 +541,19 @@ def setUpClass(cls):
540541 def tearDownClass (cls ):
541542 super (IkePeer , cls ).tearDownClass ()
542543
544+ def tearDown (self ):
545+ super (IkePeer , self ).tearDown ()
546+ if self .del_sa_from_responder :
547+ self .initiate_del_sa_from_responder ()
548+ else :
549+ self .initiate_del_sa_from_initiator ()
550+ r = self .vapi .ikev2_sa_dump ()
551+ self .assertEqual (len (r ), 0 )
552+ sas = self .vapi .ipsec_sa_dump ()
553+ self .assertEqual (len (sas ), 0 )
554+ self .p .remove_vpp_config ()
555+ self .assertIsNone (self .p .query_vpp_config ())
556+
543557 def setUp (self ):
544558 super (IkePeer , self ).setUp ()
545559 self .config_tc ()
@@ -580,6 +594,7 @@ def get_ike_header(self, packet):
580594 esp = packet [ESP ]
581595 ih = self .verify_and_remove_non_esp_marker (esp )
582596 self .assertEqual (ih .version , 0x20 )
597+ self .assertNotIn ('Version' , ih .flags )
583598 return ih
584599
585600 def verify_and_remove_non_esp_marker (self , packet ):
@@ -775,8 +790,49 @@ def verify_ts(self, api_ts, ts, is_initiator):
775790class TemplateInitiator (IkePeer ):
776791 """ initiator test template """
777792
778- def tearDown (self ):
779- super (TemplateInitiator , self ).tearDown ()
793+ def initiate_del_sa_from_initiator (self ):
794+ ispi = int .from_bytes (self .sa .ispi , 'little' )
795+ self .pg0 .enable_capture ()
796+ self .pg_start ()
797+ self .vapi .ikev2_initiate_del_ike_sa (ispi = ispi )
798+ capture = self .pg0 .get_capture (1 )
799+ ih = self .get_ike_header (capture [0 ])
800+ self .assertNotIn ('Response' , ih .flags )
801+ self .assertIn ('Initiator' , ih .flags )
802+ self .assertEqual (ih .init_SPI , self .sa .ispi )
803+ self .assertEqual (ih .resp_SPI , self .sa .rspi )
804+ plain = self .sa .hmac_and_decrypt (ih )
805+ d = ikev2 .IKEv2_payload_Delete (plain )
806+ self .assertEqual (d .proto , 1 ) # proto=IKEv2
807+ header = ikev2 .IKEv2 (init_SPI = self .sa .ispi , resp_SPI = self .sa .rspi ,
808+ flags = 'Response' , exch_type = 'INFORMATIONAL' ,
809+ id = ih .id , next_payload = 'Encrypted' )
810+ resp = self .encrypt_ike_msg (header , b'' , None )
811+ self .send_and_assert_no_replies (self .pg0 , resp )
812+
813+ def verify_del_sa (self , packet ):
814+ ih = self .get_ike_header (packet )
815+ self .assertEqual (ih .id , self .sa .msg_id )
816+ self .assertEqual (ih .exch_type , 37 ) # exchange informational
817+ self .assertIn ('Response' , ih .flags )
818+ self .assertIn ('Initiator' , ih .flags )
819+ plain = self .sa .hmac_and_decrypt (ih )
820+ self .assertEqual (plain , b'' )
821+
822+ def initiate_del_sa_from_responder (self ):
823+ header = ikev2 .IKEv2 (init_SPI = self .sa .ispi , resp_SPI = self .sa .rspi ,
824+ exch_type = 'INFORMATIONAL' ,
825+ id = self .sa .new_msg_id ())
826+ del_sa = ikev2 .IKEv2_payload_Delete (proto = 'IKEv2' )
827+ ike_msg = self .encrypt_ike_msg (header , del_sa , 'Delete' )
828+ packet = self .create_packet (self .pg0 , ike_msg ,
829+ self .sa .sport , self .sa .dport ,
830+ self .sa .natt , self .ip6 )
831+ self .pg0 .add_stream (packet )
832+ self .pg0 .enable_capture ()
833+ self .pg_start ()
834+ capture = self .pg0 .get_capture (1 )
835+ self .verify_del_sa (capture [0 ])
780836
781837 @staticmethod
782838 def find_notify_payload (packet , notify_type ):
@@ -946,22 +1002,41 @@ def test_initiator(self):
9461002class TemplateResponder (IkePeer ):
9471003 """ responder test template """
9481004
949- def tearDown (self ):
950- super (TemplateResponder , self ).tearDown ()
951- if self .sa .is_initiator :
952- self .initiate_del_sa ()
953- r = self .vapi .ikev2_sa_dump ()
954- self .assertEqual (len (r ), 0 )
955-
956- self .p .remove_vpp_config ()
957- self .assertIsNone (self .p .query_vpp_config ())
1005+ def initiate_del_sa_from_responder (self ):
1006+ self .pg0 .enable_capture ()
1007+ self .pg_start ()
1008+ self .vapi .ikev2_initiate_del_ike_sa (
1009+ ispi = int .from_bytes (self .sa .ispi , 'little' ))
1010+ capture = self .pg0 .get_capture (1 )
1011+ ih = self .get_ike_header (capture [0 ])
1012+ self .assertNotIn ('Response' , ih .flags )
1013+ self .assertNotIn ('Initiator' , ih .flags )
1014+ self .assertEqual (ih .exch_type , 37 ) # INFORMATIONAL
1015+ plain = self .sa .hmac_and_decrypt (ih )
1016+ d = ikev2 .IKEv2_payload_Delete (plain )
1017+ self .assertEqual (d .proto , 1 ) # proto=IKEv2
1018+ self .assertEqual (ih .init_SPI , self .sa .ispi )
1019+ self .assertEqual (ih .resp_SPI , self .sa .rspi )
1020+ header = ikev2 .IKEv2 (init_SPI = self .sa .ispi , resp_SPI = self .sa .rspi ,
1021+ flags = 'Initiator+Response' ,
1022+ exch_type = 'INFORMATIONAL' ,
1023+ id = ih .id , next_payload = 'Encrypted' )
1024+ resp = self .encrypt_ike_msg (header , b'' , None )
1025+ self .send_and_assert_no_replies (self .pg0 , resp )
9581026
9591027 def verify_del_sa (self , packet ):
9601028 ih = self .get_ike_header (packet )
9611029 self .assertEqual (ih .id , self .sa .msg_id )
9621030 self .assertEqual (ih .exch_type , 37 ) # exchange informational
1031+ self .assertIn ('Response' , ih .flags )
1032+ self .assertNotIn ('Initiator' , ih .flags )
1033+ self .assertEqual (ih .next_payload , 46 ) # Encrypted
1034+ self .assertEqual (ih .init_SPI , self .sa .ispi )
1035+ self .assertEqual (ih .resp_SPI , self .sa .rspi )
1036+ plain = self .sa .hmac_and_decrypt (ih )
1037+ self .assertEqual (plain , b'' )
9631038
964- def initiate_del_sa (self ):
1039+ def initiate_del_sa_from_initiator (self ):
9651040 header = ikev2 .IKEv2 (init_SPI = self .sa .ispi , resp_SPI = self .sa .rspi ,
9661041 flags = 'Initiator' , exch_type = 'INFORMATIONAL' ,
9671042 id = self .sa .new_msg_id ())
@@ -1081,7 +1156,7 @@ def verify_sa_init(self, packet):
10811156
10821157 self .assertEqual (ih .id , self .sa .msg_id )
10831158 self .assertEqual (ih .exch_type , 34 )
1084- self .assertTrue ('Response' in ih .flags )
1159+ self .assertIn ('Response' , ih .flags )
10851160 self .assertEqual (ih .init_SPI , self .sa .ispi )
10861161 self .assertNotEqual (ih .resp_SPI , 0 )
10871162 self .sa .rspi = ih .resp_SPI
@@ -1129,6 +1204,8 @@ def config_params(self, params={}):
11291204 'SHA2-384-192' : ei .IPSEC_API_INTEG_ALG_SHA_384_192 ,
11301205 'SHA2-512-256' : ei .IPSEC_API_INTEG_ALG_SHA_512_256 }
11311206
1207+ self .del_sa_from_responder = False if 'del_sa_from_responder' \
1208+ not in params else params ['del_sa_from_responder' ]
11321209 is_natt = 'natt' in params and params ['natt' ] or False
11331210 self .p = Profile (self , 'pr1' )
11341211 self .ip6 = False if 'ip6' not in params else params ['ip6' ]
@@ -1392,8 +1469,34 @@ def verify_profile(self, ap, cp):
13921469
13931470class TestInitiatorPsk (TemplateInitiator , Ikev2Params ):
13941471 """ test ikev2 initiator - pre shared key auth """
1472+
1473+ def config_tc (self ):
1474+ self .config_params ({
1475+ 'is_initiator' : False , # seen from test case perspective
1476+ # thus vpp is initiator
1477+ 'responder' : {'sw_if_index' : self .pg0 .sw_if_index ,
1478+ 'addr' : self .pg0 .remote_ip4 },
1479+ 'ike-crypto' : ('AES-GCM-16ICV' , 32 ),
1480+ 'ike-integ' : 'NULL' ,
1481+ 'ike-dh' : '3072MODPgr' ,
1482+ 'ike_transforms' : {
1483+ 'crypto_alg' : 20 , # "aes-gcm-16"
1484+ 'crypto_key_size' : 256 ,
1485+ 'dh_group' : 15 , # "modp-3072"
1486+ },
1487+ 'esp_transforms' : {
1488+ 'crypto_alg' : 12 , # "aes-cbc"
1489+ 'crypto_key_size' : 256 ,
1490+ # "hmac-sha2-256-128"
1491+ 'integ_alg' : 12 }})
1492+
1493+
1494+ class TestInitiatorDelSAFromResponder (TemplateInitiator , Ikev2Params ):
1495+ """ test ikev2 initiator - delete IKE SA from responder """
1496+
13951497 def config_tc (self ):
13961498 self .config_params ({
1499+ 'del_sa_from_responder' : True ,
13971500 'is_initiator' : False , # seen from test case perspective
13981501 # thus vpp is initiator
13991502 'responder' : {'sw_if_index' : self .pg0 .sw_if_index ,
@@ -1471,6 +1574,7 @@ class Test_IKE_AES_GCM_16_256(TemplateResponder, Ikev2Params):
14711574 """
14721575 def config_tc (self ):
14731576 self .config_params ({
1577+ 'del_sa_from_responder' : True ,
14741578 'ip6' : True ,
14751579 'natt' : True ,
14761580 'ike-crypto' : ('AES-GCM-16ICV' , 32 ),
0 commit comments