Skip to content

Commit 59eb5f9

Browse files
atulpatel261194venkyvsp
atulpatel261194
authored and
venkyvsp
committed
feat(evpnipsec): adding evpn ipsec files
Signed-off-by: atulpatel261194 <Atul.Patel@intel.com>
1 parent 9cf56d1 commit 59eb5f9

File tree

6 files changed

+455
-36
lines changed

6 files changed

+455
-36
lines changed

‎cmd/cmd.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"os"
1010

1111
"github.com/opiproject/godpu/cmd/common"
12+
"github.com/opiproject/godpu/cmd/evpnipsec"
1213
"github.com/opiproject/godpu/cmd/inventory"
1314
"github.com/opiproject/godpu/cmd/ipsec"
1415
"github.com/opiproject/godpu/cmd/network"
@@ -37,7 +38,7 @@ func NewCommand() *cobra.Command {
3738
c.AddCommand(ipsec.NewIPSecCommand())
3839
c.AddCommand(storage.NewStorageCommand())
3940
c.AddCommand(network.NewEvpnCommand())
40-
41+
c.AddCommand(evpnipsec.NewEvpnIPSecCommand())
4142
flags := c.PersistentFlags()
4243
flags.String(common.AddrCmdLineArg, "localhost:50151", "address of OPI gRPC server")
4344
flags.String(common.TLSFiles, "", "TLS files in client_cert:client_key:ca_cert format.")

‎cmd/evpnipsec/ipsec-evpn.go‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
// SPDX-License-Identifier: Apache-2.0
2+
// Copyright (c) 2022-2023 Dell Inc, or its subsidiaries.
3+
4+
// Package evpnipsec implements the ipsec related CLI commands
5+
package evpnipsec
6+
7+
import (
8+
"context"
9+
"fmt"
10+
"log"
11+
"time"
12+
13+
"github.com/opiproject/godpu/cmd/common"
14+
"github.com/opiproject/godpu/evpnipsec"
15+
pb "github.com/opiproject/opi-evpn-bridge/pkg/ipsec/gen/go"
16+
"github.com/spf13/cobra"
17+
)
18+
19+
// AddSaCommand Add Sa Command
20+
func AddSaCommand() *cobra.Command {
21+
var (
22+
src string
23+
dst string
24+
spi uint32
25+
proto int32
26+
ifID uint32
27+
reqid uint32
28+
mode int32
29+
intrface string
30+
encAlg string
31+
encKey string
32+
intAlg string
33+
intKey string
34+
replayWindow uint32
35+
tfc uint32
36+
encap int32
37+
esn int32
38+
copyDf int32
39+
copyEcn int32
40+
copyDscp int32
41+
initiator int32
42+
inbound int32
43+
update int32
44+
)
45+
// Create the map of string to CryptoAlgorithm
46+
var EncAlgorithms = map[string]pb.CryptoAlgorithm{
47+
"rsvd": pb.CryptoAlgorithm_ENCR_RSVD,
48+
"null": pb.CryptoAlgorithm_ENCR_NULL,
49+
"aes_cbc": pb.CryptoAlgorithm_ENCR_AES_CBC,
50+
"aes_ctr": pb.CryptoAlgorithm_ENCR_AES_CTR,
51+
"aes_ccm_icv_8": pb.CryptoAlgorithm_ENCR_AES_CCM_8,
52+
"aes_ccm_icv_12": pb.CryptoAlgorithm_ENCR_AES_CCM_12,
53+
"aes_ccm_icv_16": pb.CryptoAlgorithm_ENCR_AES_CCM_16,
54+
"aes_gcm_icv_8": pb.CryptoAlgorithm_ENCR_AES_GCM_8,
55+
"aes_gcm_icv_12": pb.CryptoAlgorithm_ENCR_AES_GCM_12,
56+
"aes_gcm_icv_16": pb.CryptoAlgorithm_ENCR_AES_GCM_16,
57+
"aes_gmac": pb.CryptoAlgorithm_ENCR_NULL_AUTH_AES_GMAC,
58+
"chacha_poly": pb.CryptoAlgorithm_ENCR_CHACHA20_POLY1305,
59+
}
60+
var IntAlgorithms = map[string]pb.IntegAlgorithm{
61+
"sha1_96": pb.IntegAlgorithm_AUTH_HMAC_SHA1_96,
62+
"xcbc_96": pb.IntegAlgorithm_AUTH_AES_XCBC_96,
63+
"cmac_96": pb.IntegAlgorithm_AUTH_AES_CMAC_96,
64+
"gmac_128": pb.IntegAlgorithm_AUTH_AES_128_GMAC,
65+
"gmac_192": pb.IntegAlgorithm_AUTH_AES_192_GMAC,
66+
"gmac_256": pb.IntegAlgorithm_AUTH_AES_256_GMAC,
67+
"sha2_128": pb.IntegAlgorithm_AUTH_HMAC_SHA2_256_128,
68+
"sha2_192": pb.IntegAlgorithm_AUTH_HMAC_SHA2_384_192,
69+
"sha2_256": pb.IntegAlgorithm_AUTH_HMAC_SHA2_512_256,
70+
"none": pb.IntegAlgorithm_NONE,
71+
}
72+
73+
var cmd = &cobra.Command{
74+
Use: "add-sa",
75+
Aliases: []string{"c"},
76+
Short: "add-sa functionality",
77+
Args: cobra.NoArgs,
78+
Run: func(c *cobra.Command, _ []string) {
79+
tlsFiles, err := c.Flags().GetString(common.TLSFiles)
80+
cobra.CheckErr(err)
81+
82+
addr, err := c.Flags().GetString(common.AddrCmdLineArg)
83+
cobra.CheckErr(err)
84+
85+
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
86+
defer cancel()
87+
88+
IPSecEvpnClient, err := evpnipsec.NewIPSecClient(addr, tlsFiles)
89+
if err != nil {
90+
log.Printf("error Adding SA: %s\n", err)
91+
log.Println("ONE")
92+
}
93+
94+
data, err := IPSecEvpnClient.AddSA(ctx,
95+
src, dst, spi, proto, ifID, reqid, mode, intrface, int32(EncAlgorithms[encAlg]), encKey, int32(IntAlgorithms[intAlg]), intKey,
96+
replayWindow, tfc, encap, esn, copyDf, copyEcn, copyDscp, initiator, inbound, update,
97+
)
98+
if err != nil {
99+
log.Printf("error error Adding SA: %s\n", err)
100+
log.Println("TWO")
101+
}
102+
fmt.Println("Add SA Req marshaled successfully:", data)
103+
},
104+
}
105+
106+
cmd.Flags().StringVar(&src, "src", "", "Source address or hostname")
107+
cmd.Flags().StringVar(&dst, "dst", "", "Destination address or hostname")
108+
cmd.Flags().Uint32Var(&spi, "spi", 0, "SPI")
109+
cmd.Flags().Int32Var(&proto, "proto", 0, "Protocol (ESP/AH)")
110+
cmd.Flags().Uint32Var(&ifID, "if_id", 0, "Interface ID")
111+
cmd.Flags().Uint32Var(&reqid, "reqid", 0, "Reqid")
112+
cmd.Flags().Int32Var(&mode, "mode", 0, "Mode (tunnel, transport...)")
113+
cmd.Flags().StringVar(&intrface, "interface", "", "Network interface restricting policy")
114+
cmd.Flags().StringVar(&encAlg, "enc_alg", "aes_cbc", "rsvd, null, aes_cbc, aes_ctr, aes_ccm_icv_8, aes_ccm_icv_12, aes_ccm_icv_16, aes_gcm_icv_8, aes_gcm_icv_12, aes_gcm_icv_16, aes_gmac, chacha_poly")
115+
cmd.Flags().StringVar(&encKey, "enc_key", "", "Encryption key")
116+
cmd.Flags().StringVar(&intAlg, "int_alg", "none", "Integrity protection algorithm: sha1_96, xcbc_96, cmac_96, gmac_128, gmac_192, gmac_256, sha2_128, sha2_192, sha2_256, none")
117+
cmd.Flags().StringVar(&intKey, "int_key", "", "Integrity protection key")
118+
cmd.Flags().Uint32Var(&replayWindow, "replay_window", 0, "Anti-replay window size")
119+
cmd.Flags().Uint32Var(&tfc, "tfc", 0, "Traffic Flow Confidentiality padding")
120+
cmd.Flags().Int32Var(&encap, "encap", 0, "Enable UDP encapsulation for NAT traversal")
121+
cmd.Flags().Int32Var(&esn, "esn", 0, "Mark the SA should apply to packets after processing")
122+
cmd.Flags().Int32Var(&copyDf, "copy_df", 0, "Copy the DF bit to the outer IPv4 header in tunnel mode")
123+
cmd.Flags().Int32Var(&copyEcn, "copy_ecn", 0, "Copy the ECN header field to/from the outer header")
124+
cmd.Flags().Int32Var(&copyDscp, "copy_dscp", 0, "Copy the DSCP header field to/from the outer header")
125+
cmd.Flags().Int32Var(&initiator, "initiator", 0, "TRUE if initiator of the exchange creating the SA")
126+
cmd.Flags().Int32Var(&inbound, "inbound", 0, "TRUE if this is an inbound SA")
127+
cmd.Flags().Int32Var(&update, "update", 0, "TRUE if an SPI has already been allocated for this SA")
128+
129+
if err := cmd.MarkFlagRequired("src"); err != nil {
130+
log.Fatalf("Error marking flag as required: %v", err)
131+
}
132+
if err := cmd.MarkFlagRequired("dst"); err != nil {
133+
log.Fatalf("Error marking flag as required: %v", err)
134+
}
135+
if err := cmd.MarkFlagRequired("spi"); err != nil {
136+
log.Fatalf("Error marking flag as required: %v", err)
137+
}
138+
if err := cmd.MarkFlagRequired("if_id"); err != nil {
139+
log.Fatalf("Error marking flag as required: %v", err)
140+
}
141+
142+
return cmd
143+
}
144+
145+
// DelSaCommand tests the del SA
146+
func DelSaCommand() *cobra.Command {
147+
var (
148+
src string
149+
dst string
150+
spi uint32
151+
proto int32
152+
ifID uint32
153+
)
154+
155+
var cmd = &cobra.Command{
156+
Use: "Del-sa",
157+
Aliases: []string{"c"},
158+
Short: "add-sa functionality",
159+
Args: cobra.NoArgs,
160+
Run: func(c *cobra.Command, _ []string) {
161+
tlsFiles, err := c.Flags().GetString(common.TLSFiles)
162+
cobra.CheckErr(err)
163+
164+
addr, err := c.Flags().GetString(common.AddrCmdLineArg)
165+
cobra.CheckErr(err)
166+
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
167+
defer cancel()
168+
IPSecEvpnClient, err := evpnipsec.NewIPSecClient(addr, tlsFiles)
169+
if err != nil {
170+
log.Printf("error Deleting SA %s\n", err)
171+
}
172+
data, err := IPSecEvpnClient.DelSA(ctx, src, dst, spi, proto, ifID)
173+
if err != nil {
174+
log.Printf("error Deleting SA %s\n", err)
175+
}
176+
fmt.Println("Deleting SA successfully:", data)
177+
},
178+
}
179+
180+
cmd.Flags().StringVar(&src, "src", "", "Source address or hostname")
181+
cmd.Flags().StringVar(&dst, "dst", "", "Destination address or hostname")
182+
cmd.Flags().Uint32Var(&spi, "spi", 0, "SPI")
183+
cmd.Flags().Int32Var(&proto, "proto", 0, "Protocol (ESP/AH)")
184+
cmd.Flags().Uint32Var(&ifID, "if_id", 0, "Interface ID")
185+
if err := cmd.MarkFlagRequired("src"); err != nil {
186+
log.Fatalf("Error marking flag as required: %v", err)
187+
}
188+
if err := cmd.MarkFlagRequired("dst"); err != nil {
189+
log.Fatalf("Error marking flag as required: %v", err)
190+
}
191+
if err := cmd.MarkFlagRequired("spi"); err != nil {
192+
log.Fatalf("Error marking flag as required: %v", err)
193+
}
194+
if err := cmd.MarkFlagRequired("if_id"); err != nil {
195+
log.Fatalf("Error marking flag as required: %v", err)
196+
}
197+
return cmd
198+
}
199+
200+
// NewEvpnIPSecCommand tests the inventory
201+
func NewEvpnIPSecCommand() *cobra.Command {
202+
cmd := &cobra.Command{
203+
Use: "evpnipsec",
204+
Aliases: []string{"g"},
205+
Short: "Tests ipsec functionality",
206+
Args: cobra.NoArgs,
207+
Run: func(cmd *cobra.Command, _ []string) {
208+
err := cmd.Help()
209+
if err != nil {
210+
log.Fatalf("[ERROR] %s", err.Error())
211+
}
212+
},
213+
}
214+
215+
cmd.AddCommand(AddSaCommand())
216+
cmd.AddCommand(DelSaCommand())
217+
return cmd
218+
}

‎evpnipsec/ipsec-evpn-test.go‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
// SPDX-License-Identifier: Apache-2.0
2+
// Copyright (c) 2022-2023 Intel Corporation, or its subsidiaries.
3+
// Copyright (c) 2022-2023 Dell Inc, or its subsidiaries.
4+
5+
// Package evpnipsec implements the go library for OPI to be used to establish networking
6+
package evpnipsec
7+
8+
import (
9+
"context"
10+
"log"
11+
12+
//pb "github.com/opiproject/godpu/evpnipsec/gen/go"
13+
pb "github.com/opiproject/opi-evpn-bridge/pkg/ipsec/gen/go"
14+
)
15+
16+
// AddSA adds a new SA
17+
func (c IPSecEvpnClientImpl) AddSA(ctx context.Context, src string, dst string, spi uint32, proto int32, ifID uint32, reqid uint32, mode int32, intrface string, encAlg int32, encKey string,
18+
intAlg int32, intKey string, replayWindow uint32, tfc uint32, encap int32, esn int32, copyDf int32, copyEcn int32, copyDscp int32, initiator int32, inbound int32,
19+
update int32) (*pb.AddSAResp, error) {
20+
conn, closer, err := c.NewConn()
21+
if err != nil {
22+
log.Printf("error creating connection: %s\n", err)
23+
log.Println("THREE")
24+
return nil, err
25+
}
26+
defer closer()
27+
28+
client := c.getIPSecClient(conn)
29+
data, err := client.AddSA(ctx, &pb.AddSAReq{
30+
SaId: &pb.SAIdentifier{
31+
Src: src,
32+
Dst: dst,
33+
Spi: spi,
34+
Proto: pb.IPSecProtocol(proto),
35+
IfId: ifID,
36+
},
37+
38+
SaData: &pb.AddSAReqData{
39+
Reqid: reqid,
40+
Mode: pb.IPSecMode(mode),
41+
Interface: intrface,
42+
EncAlg: pb.CryptoAlgorithm(encAlg),
43+
EncKey: []byte(encKey),
44+
IntAlg: pb.IntegAlgorithm(intAlg),
45+
IntKey: []byte(intKey),
46+
ReplayWindow: replayWindow,
47+
Tfc: tfc,
48+
Encap: pb.Bool(encap),
49+
Esn: pb.Bool(esn),
50+
CopyDf: pb.Bool(copyDf),
51+
CopyEcn: pb.Bool(copyEcn),
52+
CopyDscp: pb.DSCPCopy(copyDscp),
53+
Initiator: pb.Bool(initiator),
54+
Inbound: pb.Bool(inbound),
55+
Update: pb.Bool(update),
56+
}})
57+
if err != nil {
58+
log.Printf("error creating logical bridge: %s\n", err)
59+
log.Println("FOUR")
60+
return nil, err
61+
}
62+
63+
return data, nil
64+
}
65+
66+
// CreateLogicalBridge creates an Logical Bridge an OPI server
67+
/*func (c IPSecEvpnClientImpl) AddSA(ctx context.Context, sareq *pb.AddSAReq) (*pb.AddSAResp, error) {
68+
69+
conn, closer, err := c.NewConn()
70+
if err != nil {
71+
log.Printf("error creating connection: %s\n", err)
72+
return nil, err
73+
}
74+
defer closer()
75+
76+
client := c.getIPSecClient(conn)
77+
data, err := client.AddSA(ctx, sareq)
78+
if err != nil {
79+
log.Printf("error creating logical bridge: %s\n", err)
80+
return nil, err
81+
}
82+
83+
return data, nil
84+
}*/
85+
86+
// DelSA deletes an SA an OPI server
87+
func (c IPSecEvpnClientImpl) DelSA(ctx context.Context, src string, dst string, spi uint32, proto int32, ifID uint32) (*pb.DeleteSAResp, error) {
88+
conn, closer, err := c.NewConn()
89+
if err != nil {
90+
log.Printf("error creating connection: %s\n", err)
91+
return nil, err
92+
}
93+
defer closer()
94+
95+
client := c.getIPSecClient(conn)
96+
data, err := client.DeleteSA(ctx, &pb.DeleteSAReq{
97+
SaId: &pb.SAIdentifier{
98+
Src: src,
99+
Dst: dst,
100+
Spi: spi,
101+
Proto: pb.IPSecProtocol(proto),
102+
IfId: ifID,
103+
}})
104+
105+
if err != nil {
106+
log.Printf("error creating logical bridge: %s\n", err)
107+
return nil, err
108+
}
109+
110+
return data, nil
111+
}
112+
113+
// CreateLogicalBridge creates an Logical Bridge an OPI server
114+
/*func (c IPSecEvpnClientImpl) DelSA(ctx context.Context, sareq *pb.DeleteSAReq) (*pb.DeleteSAResp, error) {
115+
116+
conn, closer, err := c.NewConn()
117+
if err != nil {
118+
log.Printf("error creating connection: %s\n", err)
119+
return nil, err
120+
}
121+
defer closer()
122+
123+
client := c.getIPSecClient(conn)
124+
data, err := client.DeleteSA(ctx, sareq)
125+
if err != nil {
126+
log.Printf("error creating logical bridge: %s\n", err)
127+
return nil, err
128+
}
129+
130+
return data, nil
131+
}*/

0 commit comments

Comments
 (0)