diff options
| author |   selias <samelias@cisco.com> | 2016-12-01 10:11:53 +0100 |
|---|---|---|
| committer |   Peter Mikus <pmikus@cisco.com> | 2017-02-15 09:34:10 +0000 |
| commit | 005e7e00d0e9b9d4c0796c998b88d639ee316033 (patch) | |
| tree | c5fb57ec19aa6414122385d81934f9c2ea9b91c0 | |
| parent | 4e249c36f388a3c030ba83bd3aed8b38ebf54af4 (diff) | |
HC Test: ACL updates
- update low level ACL based on yang model changes
- remove ietf-ACL test suite and test data and keywords
- add ACL-plugin test suite, test data and keywords
The ietf model of ACLs is no longer supported in Honeycomb. It has
been replaced by the ACL plugin.
Change-Id: Ic2c2a3e11c9717d1d3885275f6b868a0098343f9
Signed-off-by: selias <samelias@cisco.com>
| -rw-r--r-- | resources/libraries/python/Classify.py | 33 | ||||
| -rw-r--r-- | resources/libraries/python/honeycomb/HcAPIKwACL.py | 105 | ||||
| -rw-r--r-- | resources/libraries/robot/honeycomb/access_control_lists.robot | 106 | ||||
| -rw-r--r-- | resources/templates/honeycomb/config_plugin_acl.url (renamed from resources/templates/honeycomb/config_ietf_classify_chain.url) | 0 | ||||
| -rw-r--r-- | resources/templates/vat/acl_plugin/acl_dump.vat | 1 | ||||
| -rw-r--r-- | resources/templates/vat/acl_plugin/acl_interface_dump.vat | 1 | ||||
| -rw-r--r-- | resources/test_data/honeycomb/ietf_acl.py | 336 | ||||
| -rw-r--r-- | resources/test_data/honeycomb/plugin_acl.py | 520 | ||||
| -rwxr-xr-x | resources/traffic_scripts/send_icmp_type_code.py | 125 | ||||
| -rw-r--r-- | tests/func/honeycomb/mgmt-cfg-ietfacl-apihc-apivat-func.robot | 375 | ||||
| -rw-r--r-- | tests/func/honeycomb/mgmt-cfg-pluginacl-apihc-apivat-func.robot | 700 |
11 files changed, 1495 insertions, 807 deletions
diff --git a/resources/libraries/python/Classify.py b/resources/libraries/python/Classify.py index ef140681d8..d0a5804bf8 100644 --- a/resources/libraries/python/Classify.py +++ b/resources/libraries/python/Classify.py @@ -1,4 +1,4 @@ -# Copyright (c) 2016 Cisco and/or its affiliates. +# Copyright (c) 2017 Cisco and/or its affiliates. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: @@ -363,3 +363,34 @@ class Classify(object): return data[0][session_index] else: return data[0] + + @staticmethod + def vpp_log_plugin_acl_settings(node): + """Retrieve configured settings from the ACL plugin + and write to robot log. + + :param node: VPP node. + :type node: dict + """ + try: + VatExecutor.cmd_from_template( + node, "acl_plugin/acl_dump.vat") + except ValueError: + # Fails to parse JSON data in response, but it is still logged + pass + + @staticmethod + def vpp_log_plugin_acl_interface_assignment(node): + """Retrieve interface assignment from the ACL plugin + and write to robot log. + + :param node: VPP node. + :type node: dict + """ + + try: + VatExecutor.cmd_from_template( + node, "acl_plugin/acl_interface_dump.vat", json_out=False) + except RuntimeError: + # Fails to parse response, but it is still logged + pass diff --git a/resources/libraries/python/honeycomb/HcAPIKwACL.py b/resources/libraries/python/honeycomb/HcAPIKwACL.py index 0cde6d4824..565ed486d8 100644 --- a/resources/libraries/python/honeycomb/HcAPIKwACL.py +++ b/resources/libraries/python/honeycomb/HcAPIKwACL.py @@ -269,43 +269,30 @@ class ACLKeywords(object): return {} @staticmethod - def create_ietf_classify_chain(node, list_name, layer, data): + def create_acl_plugin_classify_chain(node, list_name, data, macip=False): """Create classify chain using the ietf-acl node. :param node: Honeycomb node. :param list_name: Name for the classify list. - :param layer: Network layer to classify on. :param data: Dictionary of settings to send to Honeycomb. + :param macip: Use simple MAC+IP classifier. Optional. :type node: dict :type list_name: str - :type layer: string :type data: dict + :type macip: bool :return: Content of response. :rtype: bytearray :raises HoneycombError: If the operation fails. """ - layer = layer.lower() - suffix_dict = {"l2": "eth", - "l3_ip4": "ipv4", - "l3_ip6": "ipv6", - "mixed": "mixed"} - try: - suffix = suffix_dict[layer] - except KeyError: - raise ValueError("Unexpected value of layer argument {0}." - "Valid options are: {1}" - .format(layer, suffix_dict.keys())) - - if layer == "mixed": - path = "/acl/vpp-acl:{0}-acl/{1}" - else: - path = "/acl/ietf-access-control-list:{0}-acl/{1}" - path = path.format(suffix, list_name) + if macip: + path = "/acl/vpp-acl:vpp-macip-acl/{0}".format(list_name) + else: + path = "/acl/vpp-acl:vpp-acl/{0}".format(list_name) status_code, resp = HcUtil.put_honeycomb_data( - node, "config_ietf_classify_chain", data, path) + node, "config_plugin_acl", data, path) if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( @@ -315,37 +302,27 @@ class ACLKeywords(object): return resp @staticmethod - def set_ietf_interface_acl(node, interface, layer, direction, list_name, - default_action, mode=None): + def set_acl_plugin_interface(node, interface, acl_name, + direction, macip=False): """Assign an interface to an ietf-acl classify chain. :param node: Honeycomb node. :param interface: Name of an interface on the node. - :param layer: Network layer to classify packets on. - Valid options are: L2, L3, L4. Mixed ACL not supported yet. + :param acl_name: Name of an ACL chain configured through ACL-plugin. :param direction: Classify incoming or outgiong packets. Valid options are: ingress, egress - :param list_name: Name of an ietf-acl classify chain. - :param default_action: Default classifier action: permit or deny. - :param mode: When using mixed layers, this specifies operational mode - of the interface - L2 or L3. If layer is not "mixed", this argument - will be ignored. + :param macip: Use simple MAC+IP classifier. Optional. :type node: dict :type interface: str or int - :type layer: str + :type acl_name: str :type direction: str - :type list_name: str - :type default_action: str - :type mode: str + :type macip: bool :return: Content of response. :rtype: bytearray :raises HoneycombError: If the operation fails. """ - layer = layer.lower() - if mode is not None: - mode = mode.lower() interface = Topology.convert_interface_reference( node, interface, "name") @@ -356,36 +333,29 @@ class ACLKeywords(object): "Valid options are: ingress, egress." .format(direction)) - path = "/interface/{0}/ietf-acl/{1}/access-lists".format( + path = "/interface/{0}/interface-acl:acl/{1}".format( interface, direction) - types = { - "ietf": "ietf-access-control-list:{0}-acl", - "vpp": "vpp-acl:{0}-acl"} - layers = { - "l2": {"mode": "l2", "acl_type": types['ietf'].format("eth")}, - "l3_ip4": {"mode": "l3", "acl_type": types['ietf'].format("ipv4")}, - "l3_ip6": {"mode": "l3", "acl_type": types['ietf'].format("ipv6")}, - "mixed": {"mode": mode, "acl_type": types['vpp'].format("mixed")} + if macip: + data = { + direction: { + "vpp-macip-acl": { + "type": "vpp-acl:vpp-macip-acl", + "name": acl_name + } + } } - - try: + else: data = { - "access-lists": { - "acl": [ + direction: { + "vpp-acls": [ { - "type": layers[layer]['acl_type'], - "name": list_name + "type": "vpp-acl:vpp-acl", + "name": acl_name } - ], - "default-action": default_action, - "mode": layers[layer]['mode'] + ] } } - except KeyError: - raise ValueError("Unknown network layer {0}. " - "Valid options are: {1}". - format(layer, layers.keys())) status_code, resp = HcUtil.put_honeycomb_data( node, "config_vpp_interfaces", data, path) @@ -398,20 +368,21 @@ class ACLKeywords(object): return resp @staticmethod - def delete_ietf_interface_acls(node, interface): - """Remove all ietf-acl assignments from an interface. + def delete_interface_plugin_acls(node, interface): + """Remove all plugin-acl assignments from an interface. :param node: Honeycomb node. :param interface: Name of an interface on the node. :type node: dict - :type interface: str or int""" + :type interface: str or int + """ interface = Topology.convert_interface_reference( node, interface, "name") interface = interface.replace("/", "%2F") - path = "/interface/{0}/ietf-acl/".format(interface) + path = "/interface/{0}/interface-acl:acl/".format(interface) status_code, _ = HcUtil.delete_honeycomb_data( node, "config_vpp_interfaces", path) @@ -421,17 +392,17 @@ class ACLKeywords(object): "Status code: {0}.".format(status_code)) @staticmethod - def delete_ietf_classify_chains(node): - """Remove all classify chains from the ietf-acl node. + def delete_acl_plugin_classify_chains(node): + """Remove all plugin-ACL classify chains. :param node: Honeycomb node. :type node: dict """ status_code, _ = HcUtil.delete_honeycomb_data( - node, "config_ietf_classify_chain") + node, "config_plugin_acl") if status_code != HTTPCodes.OK: raise HoneycombError( - "Could not remove ietf-acl chain. " + "Could not remove plugin-acl chain. " "Status code: {0}.".format(status_code)) diff --git a/resources/libraries/robot/honeycomb/access_control_lists.robot b/resources/libraries/robot/honeycomb/access_control_lists.robot index d24da5bd96..29af35f0f5 100644 --- a/resources/libraries/robot/honeycomb/access_control_lists.robot +++ b/resources/libraries/robot/honeycomb/access_control_lists.robot @@ -1,4 +1,4 @@ -# Copyright (c) 2016 Cisco and/or its affiliates. +# Copyright (c) 2017 Cisco and/or its affiliates. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: @@ -339,50 +339,46 @@ | | [Arguments] | ${node} | | Remove all classify tables | ${node} -| Honeycomb creates ACL chain through IETF node -| | [Documentation] | Creates classify chain through the high-level\ -| | ... | IETF-ACL node. +| Honeycomb creates ACL chain through ACL plugin +| | [Documentation] | Creates classify chain using the ACL plugin. | | ... | | ... | *Arguments:* | | ... | - node - Information about a DUT node. Type: dictionary | | ... | - acl_list_name - Name for the classify chain. Type: string -| | ... | - layer - Classification layer (L2, L3, L4, mixed). Type: string | | ... | - acl_list_settings - classify rules. Type: dictionary +| | ... | - macip - Use MAC+IP classifier. Optional. Type: boolean | | ... | | ... | *Example:* | | ... -| | ... | \| Honeycomb creates ACL chain through IETF node \ +| | ... | \| Honeycomb creates ACL chain through ACL plugin \ | | ... | \| ${nodes['DUT1']} \| acl_test \| ${settings} \| -| | [Arguments] | ${node} | ${acl_list_name} | ${layer} | ${acl_list_settings} -| | Create IETF classify chain -| | ... | ${node} | ${acl_list_name} | ${layer} | ${acl_list_settings} +| | [Arguments] | ${node} | ${acl_list_name} | ${acl_list_settings} +| | ... | ${macip}=${False} +| | Create ACL plugin classify chain +| | ... | ${node} | ${acl_list_name} | ${acl_list_settings} | ${macip} -| Honeycomb assigns IETF-ACL chain to interface +| Honeycomb assigns plugin-ACL chain to interface | | [Documentation] | Applies classification through the high-level\ | | ... | IETF-ACL node to an interface. | | ... | | ... | *Arguments:* | | ... | - node - Information about a DUT node. Type: dictionary -| | ... | - interface - Interface to apply classifier to. | Type: string -| | ... | - layer - Classification layer (L2, L3, L4, mixed). Type: string -| | ... | - direction - Ingress or Egress ACL. Type: string -| | ... | - acl_list_name - Name of the classify chain to apply. Type: string -| | ... | - default_action - Default classify action: permit or deny.\ -| | ... | Type: string +| | ... | - interface - Interface to assign classifier to. Type: string +| | ... | - acl_list_name - Name of the clasify chain. Type: string +| | ... | - direction - Classifier direction, ingress or egress. Type: string +| | ... | - macip - Use MAC+IP classifier. Optional. Type: boolean | | ... | | ... | *Example:* | | ... -| | ... | \| Honeycomb assigns IETF-ACL chain to interface \ -| | ... | \| ${nodes['DUT1']} \| GigabitEthernet0/8/0 \| L2 \| ingress \ -| | ... | \| acl_test \| permit \| +| | ... | \| Honeycomb assigns plugin-ACL chain to interface \ +| | ... | \| ${nodes['DUT1']} \| GigabitEthernet0/8/0 \| acl_test \| ingress \| | | [Arguments] -| | ... | ${node} | ${interface} | ${layer} | ${direction} | ${acl_list_name} -| | ... | ${default-action} | ${mode}=${None} -| | Set IETF interface ACL -| | ... | ${node} | ${interface} | ${layer} | ${direction} | ${acl_list_name} -| | ... | ${default-action} | ${mode} +| | ... | ${node} | ${interface} | ${acl_list_name} | ${direction} +| | ... | ${macip}=${False} +| | Set ACL plugin interface +| | ... | ${node} | ${interface} | ${acl_list_name} | ${direction} | ${macip} -| Clear IETF-ACL settings +| Clear plugin-ACL settings | | [Documentation] | Removes ACl assignment from interface, then deletes\ | | ... | IETF-ACL chain. | | ... @@ -392,7 +388,61 @@ | | ... | | ... | *Example:* | | ... -| | ... | Clear IETF-ACL settings | ${nodes['DUT1']} \| GigabitEthernet0/8/0 \| +| | ... | \| Clear plugin-ACL settings | ${nodes['DUT1']} \ +| | ... | \| GigabitEthernet0/8/0 \| | | [Arguments] | ${node} | ${interface} -| | Delete IETF interface ACLs | ${node} | ${interface} -| | Delete IETF classify chains | ${node}
\ No newline at end of file +| | Delete interface plugin ACLs | ${node} | ${interface} +| | Delete ACL plugin classify chains | ${node} + +| Read plugin-ACL configuration from VAT +| | [Documentation] | Obtains ACL-plugin configuration through VAT and logs\ +| | ... | the reply. +| | ... +| | ... | *Arguments:* +| | ... | - node - Information about a DUT node. Type: dictionary +| | ... +| | ... | *Example:* +| | ... +| | ... | \| Read plugin-ACL configuration from VAT \| ${nodes['DUT1']} \| +| | [Arguments] | ${node} +| | VPP log plugin acl settings | ${node} +| | VPP log plugin acl interface assignment | ${node} + +| Send ICMP packet with type and code +| | [Documentation] | Sends an ICMP packet with specified code and type. +| | ... +| | ... | *Arguments:* +| | ... +| | ... | _NOTE:_ Arguments are based on topology: +| | ... | TG(if1)->(if1)DUT(if2)->TG(if2) +| | ... +| | ... | - tg_node - Node to execute scripts on (TG). Type: dictionary +| | ... | - src_ip - IP of source interface (TG-if1). Type: integer +| | ... | - dst_ip - IP of destination interface (TG-if2). Type: integer +| | ... | - tx_port - Source interface (TG-if1). Type: string +| | ... | - tx_mac - MAC address of source interface (TG-if1). Type: string +| | ... | - rx_port - Destionation interface (TG-if1). Type: string +| | ... | - rx_mac - MAC address of destination interface (TG-if1). Type: string +| | ... | - icmp_type - ICMP type to use. Type: int +| | ... | - icmp_code - ICMP code to use. Type: int +| | ... +| | ... | *Example:* +| | ... +| | ... | \| Send ICMP packet with type and code \| ${nodes['TG']} \ +| | ... | \| 16.0.0.1 \| 32.0.0.1 \| eth2 \| 08:00:27:cc:4f:54 \ +| | ... | \| eth4 \| 08:00:27:c9:6a:d5 \| ${1} \| ${1} \| +| | ... +| | [Arguments] | ${tg_node} | ${src_ip} | ${dst_ip} | ${tx_port} | +| | ... | ${tx_mac} | ${rx_port} | ${rx_mac} | ${icmp_type} | ${icmp_code} +| | ${tx_port_name}= | Get interface name | ${tg_node} | ${tx_port} +| | ${rx_port_name}= | Get interface name | ${tg_node} | ${rx_port} +| | ${args}= | Catenate | --src_mac | ${tx_mac} +| | ... | --dst_mac | ${rx_mac} +| | ... | --src_ip | ${src_ip} +| | ... | --dst_ip | ${dst_ip} +| | ... | --tx_if | ${tx_port_name} +| | ... | --rx_if | ${rx_port_name} +| | ... | --icmp_type | ${icmp_type} +| | ... | --icmp_code | ${icmp_code} +| | Run Traffic Script On Node | send_icmp_type_code.py +| | ... | ${tg_node} | ${args} diff --git a/resources/templates/honeycomb/config_ietf_classify_chain.url b/resources/templates/honeycomb/config_plugin_acl.url index 79a9670f44..79a9670f44 100644 --- a/resources/templates/honeycomb/config_ietf_classify_chain.url +++ b/resources/templates/honeycomb/config_plugin_acl.url diff --git a/resources/templates/vat/acl_plugin/acl_dump.vat b/resources/templates/vat/acl_plugin/acl_dump.vat new file mode 100644 index 0000000000..f24fc99005 --- /dev/null +++ b/resources/templates/vat/acl_plugin/acl_dump.vat @@ -0,0 +1 @@ +acl_dump
\ No newline at end of file diff --git a/resources/templates/vat/acl_plugin/acl_interface_dump.vat b/resources/templates/vat/acl_plugin/acl_interface_dump.vat new file mode 100644 index 0000000000..83da2e86dd --- /dev/null +++ b/resources/templates/vat/acl_plugin/acl_interface_dump.vat @@ -0,0 +1 @@ +acl_interface_list_dump
\ No newline at end of file diff --git a/resources/test_data/honeycomb/ietf_acl.py b/resources/test_data/honeycomb/ietf_acl.py deleted file mode 100644 index aaabfa49e2..0000000000 --- a/resources/test_data/honeycomb/ietf_acl.py +++ /dev/null @@ -1,336 +0,0 @@ -# Copyright (c) 2016 Cisco and/or its affiliates. -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at: -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -"""Test variables for ietf-ACL test suite.""" - - -def get_variables(test_case, name): - """Create and return a dictionary of test variables for the specified - test case. - - :param test_case: Determines which test variables to return. - :param name: Name for the classify chain used in test. - :type test_case: str - :type name: str - - :return: Dictionary of test variables - settings for Honeycomb's - ietf-acl node and packet fields to use in verification. - :rtype: dict - """ - - test_case = test_case.lower() - variables = { - # Variables for control packet, should always pass through DUT - "src_ip": "16.0.0.1", - "dst_ip": "16.0.1.1", - "dst_net": "16.0.1.0", - "src_port": "1234", - "dst_port": "1234", - "src_mac": "01:02:03:04:05:06", - "dst_mac": "10:20:30:40:50:60"} - - test_vars = { - "l2": { - # MACs classified directly - "classify_src": "12:23:34:45:56:67", - "classify_dst": "89:9A:AB:BC:CD:DE", - # MACs classified through mask - "classify_src2": "01:02:03:04:56:67", - "classify_dst2": "89:9A:AB:BC:50:60", - "src_mask": "00:00:00:00:FF:FF", - "dst_mask": "FF:FF:FF:FF:00:00" - }, - "l3_ip4": { - # IPs for DUT interface setup - "dut_to_tg_if1_ip": "16.0.0.2", - "dut_to_tg_if2_ip": "192.168.0.2", - "prefix_length": 24, - "gateway": "192.168.0.1", - # classified networks - "classify_src_net": "16.0.2.0", - "classify_dst_net": "16.0.3.0", - # IPs in classified networks - "classify_src": "16.0.2.1", - "classify_dst": "16.0.3.1", - }, - "l3_ip6": { - # Override control packet addresses with IPv6 - "src_ip": "10::1", - "dst_ip": "11::1", - "dst_net": "11::", - # IPs for DUT interface setup - "dut_to_tg_if1_ip": "10::2", - "dut_to_tg_if2_ip": "20::2", - "prefix_length": 64, - "gateway": "20::1", - # classified networks - "classify_src_net": "12::", - "classify_dst_net": "13::", - # IPs in classified networks - "classify_src": "12::1", - "classify_dst": "13::1", - }, - "l4": { - # IPs for DUT interface and route setup - "dut_to_tg_if1_ip": "16.0.0.2", - "dut_to_tg_if2_ip": "192.168.0.2", - "prefix_length": 24, - "gateway": "192.168.0.1", - "classify_dst_net": "16.0.3.0", - # Ports in classified ranges - "classify_src": 1500, - "classify_dst": 2000, - }, - "mixed": { - # IPs for DUT interface setup - "dut_to_tg_if1_ip": "16.0.0.2", - "dut_to_tg_if2_ip": "192.168.0.2", - "gateway": "192.168.0.1", - # classified networks - "classify_src_net": "16.0.2.0", - "classify_dst_net": "16.0.3.0", - # IPs in classified networks - "classify_src_ip": "16.0.2.1", - "classify_dst_ip": "16.0.3.1", - "prefix_length": 24, - # MACs classified through mask - "classify_src_mac": "01:02:03:04:56:67", - "classify_dst_mac": "89:9A:AB:BC:50:60", - "src_mask": "00:00:00:00:FF:FF", - "dst_mask": "FF:FF:FF:FF:00:00", - # classified ports - "classify_src_port": 1500, - "classify_dst_port": 2000, - }, - "multirule": { - # MACs classified by first rule - "classify_src": "12:23:34:45:56:67", - "classify_dst": "89:9A:AB:BC:CD:DE", - # MACs classified by second rule - "classify_src2": "01:02:03:04:56:67", - "classify_dst2": "89:9A:AB:BC:50:60", - # MAC rule masks - only match specific addresses - "src_mask": "FF:FF:FF:FF:FF:FF", - "dst_mask": "FF:FF:FF:FF:FF:FF", - } - } - acl_data = { - # ACL configuration for L2 tests - "l2": { - "acl": [{ - "acl-type": - "ietf-access-control-list:eth-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "source-mac-address": - test_vars["l2"]["classify_src"], - "source-mac-address-mask": - test_vars["l2"]["src_mask"], - "destination-mac-address": - test_vars["l2"]["classify_dst"], - "destination-mac-address-mask": - test_vars["l2"]["dst_mask"] - }, - "actions": { - "deny": {} - } - }]} - }] - }, - # ACL configuration for L3 IPv4 tests - "l3_ip4": { - "acl": [{ - "acl-type": - "ietf-access-control-list:ipv4-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "source-ipv4-network": - "{0}/{1}".format( - test_vars["l3_ip4"]["classify_src_net"], - test_vars["l3_ip4"]["prefix_length"]), - "destination-ipv4-network": - "{0}/{1}".format( - test_vars["l3_ip4"]["classify_dst_net"], - test_vars["l3_ip4"]["prefix_length"]), - "protocol": 17 - }, - "actions": { - "deny": {} - } - }]} - }] - }, - # ACL settings for L3 IPv6 tests - "l3_ip6": { - "acl": [{ - "acl-type": - "ietf-access-control-list:ipv6-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "source-ipv6-network": - "{0}/{1}".format( - test_vars["l3_ip6"]["classify_src_net"], - test_vars["l3_ip6"]["prefix_length"]), - "destination-ipv6-network": - "{0}/{1}".format( - test_vars["l3_ip6"]["classify_dst_net"], - test_vars["l3_ip6"]["prefix_length"]), - "protocol": 17 - }, - "actions": { - "deny": {} - } - }]} - }] - }, - # ACL configuration for L4 tests - "l4": { - "acl": [{ - "acl-type": - "vpp-acl:mixed-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "destination-ipv4-network": "0.0.0.0/0", - "destination-port-range": { - "lower-port": test_vars["l4"]["classify_dst"], - "upper-port": test_vars["l4"]["classify_dst"] + 50 - }, - "source-port-range": { - "lower-port": test_vars["l4"]["classify_src"], - "upper-port": test_vars["l4"]["classify_src"] + 50 - } - }, - "actions": { - "deny": {} - } - }]} - }] - }, - "mixed": { - "acl": [{ - "acl-type": - "vpp-acl:mixed-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "vpp-acl:source-mac-address": - test_vars["mixed"]["classify_src_mac"], - "vpp-acl:source-mac-address-mask": - test_vars["mixed"]["src_mask"], - "vpp-acl:destination-mac-address": - test_vars["mixed"]["classify_dst_mac"], - "vpp-acl:destination-mac-address-mask": - test_vars["mixed"]["dst_mask"], - "vpp-acl:source-ipv4-network": - "{0}/{1}".format( - test_vars["mixed"]["classify_src_net"], - test_vars["mixed"]["prefix_length"]), - "vpp-acl:destination-ipv4-network": - "{0}/{1}".format( - test_vars["mixed"]["classify_dst_net"], - test_vars["mixed"]["prefix_length"]), - "vpp-acl:protocol": 17, - "vpp-acl:destination-port-range": { - "lower-port": test_vars["l4"]["classify_dst"], - "upper-port": test_vars["l4"]["classify_dst"] + 50 - }, - "vpp-acl:source-port-range": { - "lower-port": test_vars["l4"]["classify_src"], - "upper-port": test_vars["l4"]["classify_src"] + 50 - } - }, - "actions": { - "deny": {} - } - }]} - }] - }, - "multirule": { - "acl": [{ - "acl-type": - "ietf-access-control-list:eth-acl", - "acl-name": name, - "access-list-entries": {"ace": [ - { - "rule-name": "rule1", - "matches": { - "source-mac-address": - test_vars["multirule"]["classify_src"], - "source-mac-address-mask": - test_vars["multirule"]["src_mask"], - "destination-mac-address": - test_vars["multirule"]["classify_dst"], - "destination-mac-address-mask": - test_vars["multirule"]["dst_mask"] - }, - "actions": { - "deny": {} - } - }, - { - "rule-name": "rule2", - "matches": { - "source-mac-address": - test_vars["multirule"]["classify_src2"], - "source-mac-address-mask": - test_vars["multirule"]["src_mask"], - "destination-mac-address": - test_vars["multirule"]["classify_dst2"], - "destination-mac-address-mask": - test_vars["multirule"]["dst_mask"] - }, - "actions": { - "deny": {} - } - }, - { - "rule-name": "rule3", - "matches": { - "source-mac-address": - variables["src_mac"], - "source-mac-address-mask": - test_vars["multirule"]["src_mask"], - "destination-mac-address": - variables["dst_mac"], - "destination-mac-address-mask": - test_vars["multirule"]["dst_mask"] - }, - "actions": { - "permit": {} - } - } - ]} - }] - } - } - try: - ret_vars = {} - ret_vars.update(variables) - ret_vars.update(test_vars[test_case]) - ret_vars.update( - {"acl_settings": acl_data[test_case]} - ) - except KeyError: - raise Exception("Unrecognized test case {0}." - " Valid options are: {1}".format( - test_case, acl_data.keys())) - return ret_vars diff --git a/resources/test_data/honeycomb/plugin_acl.py b/resources/test_data/honeycomb/plugin_acl.py new file mode 100644 index 0000000000..d9d2ecd90f --- /dev/null +++ b/resources/test_data/honeycomb/plugin_acl.py @@ -0,0 +1,520 @@ +# Copyright (c) 2017 Cisco and/or its affiliates. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Test variables for ACL-plugin test suite.""" + + +def get_variables(test_case, name): + """Create and return a dictionary of test variables for the specified + test case. + + :param test_case: Determines which test variables to return. + :param name: Name for the classify chain used in test. + :type test_case: str + :type name: str + + :returns: Dictionary of test variables - settings for Honeycomb's + ietf-acl node and packet fields to use in verification. + :rtype: dict + :raises KeyError: If the test_case parameter is incorrect. + """ + + test_case = test_case.lower() + variables = { + # Variables for control packet + "src_ip": "16.0.0.1", + "dst_ip": "16.0.1.1", + "dst_net": "16.0.1.0", + "src_port": "1234", + "dst_port": "1234", + "src_mac": "01:02:03:04:05:06", + "dst_mac": "10:20:30:40:50:60"} + + test_vars = { + "macip": { + # MACs classified directly + "classify_src": "12:23:34:45:56:67", + "classify_dst": "89:9A:AB:BC:CD:DE", + # MACs classified through mask + "classify_src2": "01:02:03:04:56:67", + "classify_dst2": "89:9A:AB:BC:50:60", + "src_mask": "00:00:00:00:FF:FF", + "dst_mask": "FF:FF:FF:FF:00:00" + }, + "l3_ip4": { + # IPs for DUT interface setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + # classified networks + "classify_src_net": "16.0.2.0", + "classify_dst_net": "16.0.3.0", + # IPs in classified networks + "classify_src": "16.0.2.1", + "classify_dst": "16.0.3.1", + }, + "l3_ip6": { + # Override control packet addresses with IPv6 + "src_ip": "10::1", + "dst_ip": "11::1", + "dst_net": "11::", + # IPs for DUT interface setup + "dut_to_tg_if1_ip": "10::2", + "dut_to_tg_if2_ip": "20::2", + "prefix_length": 64, + "gateway": "20::1", + # classified networks + "classify_src_net": "12::", + "classify_dst_net": "13::", + # IPs in classified networks + "classify_src": "12::1", + "classify_dst": "13::1", + }, + "l4": { + # IPs for DUT interface and route setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + "classify_dst_net": "16.0.3.0", + # Ports in classified ranges + "classify_src": 60000, + "classify_dst": 61000, + }, + "mixed": { + # IPs for DUT interface and route setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + "classify_dst_net": "16.0.3.0", + # IPs in classified networks + "classify_src_ip": "16.0.2.1", + "classify_dst_ip": "16.0.3.1", + # Ports in classified ranges + "classify_src_port": 60000, + "classify_dst_port": 61000, + }, + "icmp": { + # ICMP code and type for control packet + "icmp_type": 0, + "icmp_code": 0, + # classified ICMP code and type + "classify_type": 3, + "classify_code": 3 + + }, + "icmpv6": { + # Override control packet addresses with IPv6 + "src_ip": "10::1", + "dst_ip": "11::1", + "dst_net": "11::", + # ICMP code and type for control packet + "icmp_type": 1, + "icmp_code": 0, + # classified ICMP code and type + "classify_type": 4, + "classify_code": 2 + + }, + "reflex": { + # IPs for DUT interface setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + "gateway2": "192.168.0.1", + # classified networks + "classify_src_net": "16.0.2.0", + "classify_dst_net": "16.0.3.0", + # IPs in classified networks + "classify_src": "16.0.2.1", + "classify_dst": "16.0.3.1", + }, + "block_all": {} + } + acl_data = { + # ACL configuration for L2 tests + "macip": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-macip-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-macip-ace-nodes": { + "source-mac-address": + test_vars["macip"]["classify_src"], + "source-mac-address-mask": + test_vars["macip"]["src_mask"], + "source-ipv4-network": "16.0.0.0/24" + } + }, + "actions": { + "deny": {} + } + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-macip-ace-nodes": { + "source-mac-address": + test_vars["macip"]["classify_src"], + "source-mac-address-mask": "00:00:00:00:00:00", + "source-ipv4-network": "0.0.0.0/0" + } + }, + "actions": { + "permit": {} + } + }, + ]} + }] + }, + # ACL configuration for L3 IPv4 tests + "l3_ip4": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": + "{0}/{1}".format( + test_vars["l3_ip4"]["classify_src_net"], + test_vars["l3_ip4"]["prefix_length"]), + "destination-ipv4-network": + "{0}/{1}".format( + test_vars["l3_ip4"]["classify_dst_net"], + test_vars["l3_ip4"]["prefix_length"]), + "udp-nodes": { + "source-port-range": { + "lower-port": "0", + "upper-port": "65535" + }, + "destination-port-range": { + "lower-port": "0", + "upper-port": "65535" + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + # ACL settings for L3 IPv6 tests + "l3_ip6": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "source-ipv6-network": + "{0}/{1}".format( + test_vars["l3_ip6"]["classify_src_net"], + test_vars["l3_ip6"]["prefix_length"]), + "destination-ipv6-network": + "{0}/{1}".format( + test_vars["l3_ip6"]["classify_dst_net"], + test_vars["l3_ip6"]["prefix_length"]), + "udp-nodes": { + "source-port-range": { + "lower-port": "0", + "upper-port": "65535" + }, + "destination-port-range": { + "lower-port": "0", + "upper-port": "65535" + } + } + } + }, + "actions": { + "deny": {} + } + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv6-network": "0::0/0", + "destination-ipv6-network": "0::0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + # ACL configuration for L4 tests + "l4": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [{ + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "tcp-nodes": { + "destination-port-range": { + "lower-port": + test_vars["l4"]["classify_dst"], + "upper-port": + test_vars["l4"]["classify_dst"] + 10 + }, + "source-port-range": { + "lower-port": + test_vars["l4"]["classify_src"], + "upper-port": + test_vars["l4"]["classify_src"] + 10 + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "mixed": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [{ + "rule-name": "ports", + "matches": { + "vpp-ace-nodes": { + "tcp-nodes": { + "destination-port-range": { + "lower-port": + test_vars["l4"]["classify_dst"], + "upper-port": + test_vars["l4"]["classify_dst"] + 10 + }, + "source-port-range": { + "lower-port": + test_vars["l4"]["classify_src"], + "upper-port": + test_vars["l4"]["classify_src"] + 10 + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "icmp": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "icmp-nodes": { + "icmp-type-range": { + "first": "1", + "last": "5" + }, + "icmp-code-range": { + "first": "1", + "last": "5" + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "icmpv6": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "icmp-v6-nodes": { + "icmp-type-range": { + "first": "1", + "last": "5" + }, + "icmp-code-range": { + "first": "1", + "last": "5" + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv6-network": "0::0/0", + "destination-ipv6-network": "0::0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "reflex": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": + "{0}/{1}".format( + test_vars["reflex"]["classify_dst_net"], + test_vars["reflex"]["prefix_length"]), + "destination-ipv4-network": + "{0}/{1}".format( + test_vars["reflex"]["classify_src_net"], + test_vars["reflex"]["prefix_length"]), + } + }, + "actions": { + # TODO: will be renamed in HC2VPP-57 + "vpp-acl:permit": {} + }, + }, + ]} + }] + }, + "block_all": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "deny": {} + } + } + ]} + }] + }, + } + + try: + ret_vars = {} + ret_vars.update(variables) + ret_vars.update(test_vars[test_case]) + ret_vars.update( + {"acl_settings": acl_data[test_case]} + ) + except KeyError: + raise KeyError( + "Unrecognized test case {0}. Valid options are: {1}".format( + test_case, acl_data.keys())) + return ret_vars diff --git a/resources/traffic_scripts/send_icmp_type_code.py b/resources/traffic_scripts/send_icmp_type_code.py new file mode 100755 index 0000000000..dffaafff38 --- /dev/null +++ b/resources/traffic_scripts/send_icmp_type_code.py @@ -0,0 +1,125 @@ +#!/usr/bin/env python +# Copyright (c) 2017 Cisco and/or its affiliates. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Traffic script that sends an IP ICMPv4/ICMPv6 packet from one interface to +the other one. Dot1q or Dot1ad tagging of the ethernet frame can be set. +""" + +import sys +import ipaddress + +from scapy.layers.inet import ICMP, IP +from scapy.layers.l2 import Ether +from scapy.layers.inet6 import ICMPv6EchoRequest +from scapy.layers.inet6 import IPv6 + +from resources.libraries.python.PacketVerifier import RxQueue, TxQueue +from resources.libraries.python.TrafficScriptArg import TrafficScriptArg + + +def valid_ipv4(ip): + """Check if IP address has the correct IPv4 address format. + + :param ip: IP address. + :type ip: str + :returns: True in case of correct IPv4 address format, + otherwise return false. + :rtype: bool + """ + try: + ipaddress.IPv4Address(unicode(ip)) + return True + except (AttributeError, ipaddress.AddressValueError): + return False + + +def valid_ipv6(ip): + """Check if IP address has the correct IPv6 address format. + + :param ip: IP address. + :type ip: str + :returns: True in case of correct IPv6 address format, + otherwise return false. + :rtype: bool + """ + try: + ipaddress.IPv6Address(unicode(ip)) + return True + except (AttributeError, ipaddress.AddressValueError): + return False + + +def main(): + """Send IP ICMPv4/ICMPv6 packet from one traffic generator interface to + the other one.""" + + args = TrafficScriptArg(['src_mac', 'dst_mac', 'src_ip', 'dst_ip', + 'icmp_type', 'icmp_code']) + + src_mac = args.get_arg('src_mac') + dst_mac = args.get_arg('dst_mac') + src_ip = args.get_arg('src_ip') + dst_ip = args.get_arg('dst_ip') + + tx_if = args.get_arg('tx_if') + rx_if = args.get_arg('rx_if') + + icmp_type = int(args.get_arg('icmp_type')) + icmp_code = int(args.get_arg('icmp_code')) + + rxq = RxQueue(rx_if) + txq = TxQueue(tx_if) + + sent_packets = [] + + # Create empty ip ICMP packet and add padding before sending + if valid_ipv4(src_ip) and valid_ipv4(dst_ip): + pkt_raw = (Ether(src=src_mac, dst=dst_mac) / + IP(src=src_ip, dst=dst_ip) / + ICMP(code=icmp_code, type=icmp_type)) + ip_format = 'IP' + icmp_format = 'ICMP' + elif valid_ipv6(src_ip) and valid_ipv6(dst_ip): + pkt_raw = (Ether(src=src_mac, dst=dst_mac) / + IPv6(src=src_ip, dst=dst_ip) / + ICMPv6EchoRequest(code=icmp_code, type=icmp_type)) + ip_format = 'IPv6' + icmp_format = 'ICMPv6' + else: + raise ValueError("IP(s) not in correct format") + + # Send created packet on one interface and receive on the other + sent_packets.append(pkt_raw) + txq.send(pkt_raw) + + ether = rxq.recv(2) + + # Check whether received packet contains layers Ether, IP and ICMP + if ether is None: + raise RuntimeError('ICMP echo Rx timeout') + + if not ether.haslayer(ip_format): + raise RuntimeError('Not an IP packet received {0}' + .format(ether.__repr__())) + + # Cannot use haslayer for ICMPv6, every type of ICMPv6 is a separate layer + # Next header value of 58 means the next header is ICMPv6 + if not ether.haslayer(icmp_format) and ether[ip_format].nh != 58: + raise RuntimeError('Not an ICMP packet received {0}' + .format(ether.__repr__())) + + sys.exit(0) + +if __name__ == "__main__": + main() diff --git a/tests/func/honeycomb/mgmt-cfg-ietfacl-apihc-apivat-func.robot b/tests/func/honeycomb/mgmt-cfg-ietfacl-apihc-apivat-func.robot deleted file mode 100644 index 4d4785a6df..0000000000 --- a/tests/func/honeycomb/mgmt-cfg-ietfacl-apihc-apivat-func.robot +++ /dev/null @@ -1,375 +0,0 @@ -# Copyright (c) 2016 Cisco and/or its affiliates. -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at: -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -*** Variables *** -| &{if_settings}= | enabled=True -# Bridge domain settings -| ${bd_name}= | bd1 -| &{bd_settings}= | flood=${True} | forward=${True} | learn=${True} -| ... | unknown-unicast-flood=${True} | arp-termination=${False} -| &{bd_if_settings}= | split_horizon_group=${0} | bvi=${False} -# Names for AC lists -| ${acl_name_l2}= | acl_l2 -| ${acl_name_l3_ip4}= | acl_l3_ip4 -| ${acl_name_l3_ip6}= | acl_l3_ip6 -| ${acl_name_l4}= | acl_l4 -| ${acl_name_mixed}= | acl_mixed -| ${acl_name_multirule}= | acl_multirule - -*** Settings *** -| Resource | resources/libraries/robot/default.robot -| Resource | resources/libraries/robot/honeycomb/honeycomb.robot -| Resource | resources/libraries/robot/honeycomb/interfaces.robot -| Resource | resources/libraries/robot/honeycomb/bridge_domain.robot -| Resource | resources/libraries/robot/honeycomb/access_control_lists.robot -| Resource | resources/libraries/robot/testing_path.robot -| Resource | resources/libraries/robot/traffic.robot -| Library | resources.libraries.python.honeycomb.HcAPIKwACL.ACLKeywords -| Library | resources.libraries.python.Trace -| Library | resources.libraries.python.IPv4Setup -| Library | resources.libraries.python.IPv4Util -| Library | resources.libraries.python.IPv6Util -| Library | resources.libraries.python.Routing -| Test Teardown | Run Keywords | Clear IETF-ACL settings -| ... | ${node} | ${dut_to_tg_if1} | AND -| ... | Show Packet Trace on All DUTs | ${nodes} -| Suite Teardown | Run Keyword If Any Tests Failed -| ... | Restart Honeycomb And VPP And Clear Persisted Configuration | ${node} -| Documentation | *Honeycomb access control lists test suite for IETF-ACL node.* -# Test suite out of date since https://gerrit.fd.io/r/#/c/4331/ -# Ietf-ACL fucntionality will be removed -# | Force Tags | Honeycomb_sanity - -*** Test Cases *** -| TC01: L2 ACL MAC filtering through IETF-ACL node -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ -| | ... | and configure L2 MAC ACL on ingress interface. -| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ -| | ... | using different MACs. Receive all packets except those with\ -| | ... | MACs in the filtered ranges. -| | [Teardown] | Run Keywords -| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if1} | AND -| | ... | Show Packet Trace On All DUTs | ${nodes} | AND -| | ... | Honeycomb Removes All Bridge Domains -| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} -| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test -| | ... | L2 | ${acl_name_l2} -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_l2} | L2 | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if1} | L2 | ingress | ${acl_name_l2} -| | ... | permit -| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${src_mac} -| | ... | ${tg_to_dut_if2} | ${dst_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src} -| | ... | ${tg_to_dut_if2} | ${classify_dst} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src2} -| | ... | ${tg_to_dut_if2} | ${classify_dst2} -| | ... | TCP | ${src_port} | ${dst_port} - -| TC02: L2 ACL MAC filtering through IETF-ACL node on egress interface -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ -| | ... | and configure L2 MAC ACL on egress interface. -| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ -| | ... | using different MACs. Receive all packets except those with\ -| | ... | MACs in the filtered ranges. -| | [Teardown] | Run Keywords -| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if2} | AND -| | ... | Show Packet Trace On All DUTs | ${nodes} | AND -| | ... | Honeycomb Removes All Bridge Domains -| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} -| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test -| | ... | L2 | ${acl_name_l2} -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_l2} | L2 | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if2} | L2 | egress | ${acl_name_l2} -| | ... | permit -| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${src_mac} -| | ... | ${tg_to_dut_if2} | ${dst_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src} -| | ... | ${tg_to_dut_if2} | ${classify_dst} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src2} -| | ... | ${tg_to_dut_if2} | ${classify_dst2} -| | ... | TCP | ${src_port} | ${dst_port} - -| TC03: L3 ACL IPv4 filtering through IETF-ACL node -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ -| | ... | interfaces to TG, add ARP entry and routes, and configure L3 IPv4 ACL\ -| | ... | on ingress interface with src/dst IP and protocol. -| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ -| | ... | to the other, using different IPv4 IPs. Receive all packets except\ -| | ... | those with IPs in the filtered ranges and UDP protocol payload. -| | Given Setup Interface IPs And Routes For IPv4 IETF-ACL Test -| | ... | L3_IP4 | ${acl_name_l3_ip4} -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_l3_ip4} | L3_IP4 | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if1} | L3_IP4 | ingress | ${acl_name_l3_ip4} -| | ... | permit -| | Then Send TCP Or UDP Packet | ${tg_node} -| | ... | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | UDP | ${src_port} | ${dst_port} -| | And Send TCP Or UDP Packet | ${tg_node} -| | ... | ${classify_src} | ${classify_dst} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} -| | ... | ${classify_src} | ${classify_dst} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | UDP | ${src_port} | ${dst_port} - -| TC04: L3 ACL IPv6 filtering through IETF-ACL node -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv6 addresses on both\ -| | ... | interfaces to TG, add IP neighbor entry and routes, and configure\ -| | ... | L3 IPv6 ACL on ingress interface with src/dst IP and next-header. -| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ -| | ... | to the other, using different IPv6 IPs. Receive all packets except\ -| | ... | those with IPs in the filtered ranges and UDP protocol payload. -| | Given Path for 2-node testing is set -| | ... | ${nodes['TG']} | ${nodes['DUT1']} | ${nodes['TG']} -| | And Import Variables | resources/test_data/honeycomb/ietf_acl.py -| | ... | L3_IP6 | ${acl_name_l3_ip6} -| | And Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if1} | up -| | And Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if2} | up -# TODO: Configure addresses through Honeycomb when implemented. (Honeycomb-102) -| | And Set Interface Address | ${dut_node} -| | ... | ${dut_to_tg_if1} | ${dut_to_tg_if1_ip} | ${prefix_length} -| | And Set Interface Address | ${dut_node} -| | ... | ${dut_to_tg_if2} | ${dut_to_tg_if2_ip} | ${prefix_length} -| | And VPP RA suppress link layer | ${dut_node} | ${dut_to_tg_if2} -# TODO: Configure route through Honeycomb when implemented.(Honeycomb-58) -| | And Add IP Neighbor -| | ... | ${node} | ${dut_to_tg_if2} | ${gateway} | ${tg_to_dut_if2_mac} -| | And VPP Route Add | ${node} | ${dst_net} | ${prefix_length} -| | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False -| | And VPP Route Add | ${node} | ${classify_dst_net} | ${prefix_length} -| | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_l3_ip6} | L3_IP6 | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if1} | L3_IP6 | ingress | ${acl_name_l3_ip6} -| | ... | permit -| | Then Send TCP Or UDP Packet | ${tg_node} -| | ... | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | UDP | ${src_port} | ${dst_port} -| | And Send TCP Or UDP Packet | ${tg_node} -| | ... | ${classify_src} | ${classify_dst} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} -| | ... | ${classify_src} | ${classify_dst} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | UDP | ${src_port} | ${dst_port} - -| TC05: L4 ACL port filtering through IETF-ACL node -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ -| | ... | interfaces to TG, add ARP entry and routes, and configure L4 port ACL\ -| | ... | on ingress interface with src/dst port ranges. -| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ -| | ... | to the other, using different ports. Receive all packets except\ -| | ... | those with ports in the filtered ranges. -| | Given Setup Interface IPs And Routes For IPv4 IETF-ACL Test -| | ... | L4 | ${acl_name_l4} -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_l4} | mixed | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if1} | mixed | ingress | ${acl_name_l4} -| | ... | permit | L3 -| | Then Send TCP Or UDP Packet | ${tg_node} -| | ... | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} -| | ... | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | TCP | ${classify_src} | ${classify_dst} - -| TC06: L2,L3 and L4 ACL together on L2-mode interface -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ -| | ... | and configure L2, L3 and L4 ACL on ingress interface\ -| | ... | with src/dst MAC, src/dst IP, protocol and src/dst port ranges. -| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ -| | ... | to the other, using different MACs, IPv4 IPs and ports. Receive\ -| | ... | all packets except those with MACs, IPs and ports in the filtered\ -| | ... | ranges and UDP protocol payload. -| | [Teardown] | Run Keywords -| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if1} | AND -| | ... | Show Packet Trace On All DUTs | ${nodes} | AND -| | ... | Honeycomb Removes All Bridge Domains -| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} -| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test -| | ... | mixed | ${acl_name_mixed} -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_mixed} | mixed | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if1} | mixed | ingress | ${acl_name_mixed} -| | ... | permit | L2 -| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src_mac} -| | ... | ${tg_to_dut_if2} | ${classify_dst_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} -| | ... | ${classify_src_ip} | ${classify_dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src_mac} -| | ... | ${tg_to_dut_if2} | ${classify_dst_mac} -| | ... | UDP | ${classify_src_port} | ${classify_dst_port} - -| TC07: L2,L3 and L4 ACL together on L3-mode interface -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ -| | ... | interfaces to TG, add ARP entry and routes, and configure\ -| | ... | L2, L3 and L4 ACL on ingress interface with src/dst MAC, src/dst IP,\ -| | ... | protocol and src/dst port ranges. -| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ -| | ... | to the other, using different MACs, IPv4 IPs and ports. Receive\ -| | ... | all packets except those with MACs, IPs and ports in the filtered\ -| | ... | ranges and UDP protocol payload. -| | Setup Interface IPs And Routes For IPv4 IETF-ACL Test -| | ... | mixed | ${acl_name_mixed} -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_mixed} | mixed | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if1} | mixed | ingress | ${acl_name_mixed} -| | ... | permit | L3 -| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src_mac} -| | ... | ${tg_to_dut_if2} | ${classify_dst_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} -| | ... | ${classify_src_ip} | ${classify_dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src_mac} -| | ... | ${tg_to_dut_if2} | ${classify_dst_mac} -| | ... | UDP | ${classify_src_port} | ${classify_dst_port} - -| TC08: Multiple classify rules in one ACL -| | [Documentation] -| | ... | [Top] TG=DUT1=TG. -| | ... | [Enc] Eth-IPv4-TCP. -| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ -| | ... | and configure a series of L2 MAC ACL rules on ingress interface. -| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ -| | ... | using different MACs. Receive all packets except those with\ -| | ... | MACs in the ranges filtered by any rule. -| | [Teardown] | Run Keywords -| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if1} | AND -| | ... | Show Packet Trace On All DUTs | ${nodes} | AND -| | ... | Honeycomb Removes All Bridge Domains -| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} -| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test -| | ... | multirule | ${acl_name_multirule} -| | When Honeycomb Creates ACL Chain Through IETF Node -| | ... | ${dut_node} | ${acl_name_multirule} | L2 | ${acl_settings} -| | And Honeycomb Assigns IETF-ACL Chain To Interface -| | ... | ${dut_node} | ${dut_to_tg_if1} | L2 | ingress | ${acl_name_multirule} -| | ... | permit -| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${src_mac} -| | ... | ${tg_to_dut_if2} | ${dst_mac} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src} -| | ... | ${tg_to_dut_if2} | ${classify_dst} -| | ... | TCP | ${src_port} | ${dst_port} -| | And Run Keyword And Expect Error | TCP/UDP Rx timeout -| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} -| | ... | ${tg_to_dut_if1} | ${classify_src2} -| | ... | ${tg_to_dut_if2} | ${classify_dst2} -| | ... | TCP | ${src_port} | ${dst_port} - -*** Keywords *** -| Setup interface IPs and routes for IPv4 ietf-ACL test -| | [Arguments] | ${test_data_id} | ${acl_name} -| | Path for 2-node testing is set -| | ... | ${nodes['TG']} | ${nodes['DUT1']} | ${nodes['TG']} -| | Import Variables | resources/test_data/honeycomb/ietf_acl.py -| | ... | ${test_data_id} | ${acl_name} -| | Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if1} | up -| | Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if2} | up -| | Honeycomb sets interface ipv4 address with prefix | ${dut_node} -| | ... | ${dut_to_tg_if1} | ${dut_to_tg_if1_ip} | ${prefix_length} -| | Honeycomb sets interface ipv4 address with prefix | ${dut_node} -| | ... | ${dut_to_tg_if2} | ${dut_to_tg_if2_ip} | ${prefix_length} -# TODO: Configure routes through Honeycomb when implemented.(Honeycomb-58) -| | Add ARP on DUT -| | ... | ${node} | ${dut_to_tg_if2} | ${gateway} | ${tg_to_dut_if2_mac} -| | VPP Route Add -| | ... | ${node} | ${dst_net} | ${prefix_length} | ${gateway} -| | ... | interface=${dut_to_tg_if2} | use_sw_index=False -| | VPP Route Add -| | ... | ${node} | ${classify_dst_net} | ${prefix_length} | ${gateway} -| | ... | interface=${dut_to_tg_if2} | use_sw_index=False - -| Setup interfaces and bridge domain for ietf-ACL test -| | [Arguments] | ${test_data_id} | ${acl_name} -| | Path For 2-node Testing Is Set -| | ... | ${nodes['TG']} | ${nodes['DUT1']} | ${nodes['TG']} -| | Import Variables | resources/test_data/honeycomb/ietf_acl.py -| | ... | ${test_data_id} | ${acl_name} -| | Honeycomb Sets Interface State | ${dut_node} | ${dut_to_tg_if1} | up -| | Honeycomb Sets Interface State | ${dut_node} | ${dut_to_tg_if2} | up -| | Honeycomb Creates first L2 Bridge Domain -| | ... | ${dut_node} | ${bd_name} | ${bd_settings} -| | Honeycomb Adds Interfaces To Bridge Domain -| | ... | ${dut_node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} -| | ... | ${bd_name} | ${bd_if_settings}
\ No newline at end of file diff --git a/tests/func/honeycomb/mgmt-cfg-pluginacl-apihc-apivat-func.robot b/tests/func/honeycomb/mgmt-cfg-pluginacl-apihc-apivat-func.robot new file mode 100644 index 0000000000..c4c58a863c --- /dev/null +++ b/tests/func/honeycomb/mgmt-cfg-pluginacl-apihc-apivat-func.robot @@ -0,0 +1,700 @@ +# Copyright (c) 2016 Cisco and/or its affiliates. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +*** Variables *** +| &{if_settings}= | enabled=True +# Bridge domain settings +| ${bd_name}= | bd1 +| &{bd_settings}= | flood=${True} | forward=${True} | learn=${True} +| ... | unknown-unicast-flood=${True} | arp-termination=${False} +| &{bd_if_settings}= | split_horizon_group=${0} | bvi=${False} +# Names for AC lists +| ${acl_name_macip}= | macip +| ${acl_name_l3_ip4}= | acl_l3_ip4 +| ${acl_name_l3_ip6}= | acl_l3_ip6 +| ${acl_name_l4}= | acl_l4 +| ${acl_name_mixed}= | acl_mixed +| ${acl_name_icmp}= | acl_icmp +| ${acl_name_icmpv6}= | acl_icmpv6 +| ${acl_name_reflex}= | acl_reflex + +*** Settings *** +| Resource | resources/libraries/robot/default.robot +| Resource | resources/libraries/robot/honeycomb/honeycomb.robot +| Resource | resources/libraries/robot/honeycomb/interfaces.robot +| Resource | resources/libraries/robot/honeycomb/bridge_domain.robot +| Resource | resources/libraries/robot/honeycomb/access_control_lists.robot +| Resource | resources/libraries/robot/testing_path.robot +| Resource | resources/libraries/robot/traffic.robot +| Library | resources.libraries.python.honeycomb.HcAPIKwACL.ACLKeywords +| Library | resources.libraries.python.Trace +| Library | resources.libraries.python.IPv4Setup +| Library | resources.libraries.python.IPv4Util +| Library | resources.libraries.python.IPv6Util +| Library | resources.libraries.python.Routing +| Test Teardown | Run Keywords | Read plugin-ACL configuration from VAT +| ... | ${node} | AND +| ... | Clear plugin-acl settings | ${node} | ${dut_to_tg_if1} +| Suite Teardown | Run Keywords | Show Packet Trace on All DUTs | ${nodes} | AND +| ... | Run Keyword If Any Tests Failed +| ... | Restart Honeycomb And VPP And Clear Persisted Configuration | ${node} +| Documentation | *Honeycomb access control lists test suite for ACL plugin.* +| Force Tags | Honeycomb_sanity + +*** Test Cases *** +| TC01: ACL MAC filtering through plugin-acl node - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure L2 MAC ACL on ingress interface. +| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ +| | ... | using different MACs. Receive all packets except those with\ +| | ... | MACs in the filtered ranges. +| | [Teardown] | Run Keywords +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup Interfaces And Bridge Domain For plugin-acl Test +| | ... | macip | ${acl_name_macip} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_macip} | ${acl_settings} | macip=${True} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_macip} +| | ... | ingress | macip=${True} +| | When Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${classify_src} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${classify_src2} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} + +| TC02: ACL IPv4 filtering through plugin-acl node - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure L3 IPv4 ACL on ingress interface with src/dst IP +| | ... | and protocol number. +| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ +| | ... | to the other, using different IPv4 IPs. Receive all packets except\ +| | ... | those with IPs in the filtered ranges and UDP protocol payload. +| | [Teardown] | Run Keywords +| | ... | Read plugin-ACL configuration from VAT | ${node} | AND +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup Interfaces And Bridge Domain For plugin-acl Test +| | ... | l3_ip4 | ${acl_name_l3_ip4} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_l3_ip4} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_l3_ip4} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} + +| TC03: ACL IPv6 filtering through plugin-acl node - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv6-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure L3 IPv6 ACL on ingress interface with src/dst IP +| | ... | and protocol number. +| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ +| | ... | to the other, using different IPv6 IPs. Receive all packets except\ +| | ... | those with IPs in the filtered ranges and UDP protocol payload. +| | [Teardown] | Run Keywords +| | ... | Read plugin-ACL configuration from VAT | ${node} | AND +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup interfaces and bridge domain for plugin-acl test +| | ... | l3_ip6 | ${acl_name_l3_ip6} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_l3_ip6} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_l3_ip6} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} + +| TC04: ACL port filtering through plugin-acl node - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and and configure L4 port ACL on ingress interface +| | ... | with src/dst port ranges. +| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ +| | ... | to the other, using different ports. Receive all packets except\ +| | ... | those with ports in the filtered ranges. +| | [Teardown] | Run Keywords +| | ... | Read plugin-ACL configuration from VAT | ${node} | AND +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup interfaces and bridge domain for plugin-acl test +| | ... | L4 | ${acl_name_l4} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_l4} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_l4} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${classify_src} | ${classify_dst} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${classify_src+5} | ${classify_dst+5} + +| TC05: ACL filtering with IPv4 address and TCP port in one rule - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure a mixed rule with src/dst IP, TCP protocol +| | ... | and port ranges. +| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ +| | ... | using IPs and ports. Receive all packets except those with\ +| | ... | both IPs and ports in the filtered ranges. +| | [Teardown] | Run Keywords +| | ... | Read plugin-ACL configuration from VAT | ${node} | AND +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup Interfaces And Bridge Domain For plugin-acl Test +| | ... | mixed | ${acl_name_mixed} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_mixed} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_mixed} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src_ip} | ${classify_dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src_ip} | ${classify_dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${classify_src_port} | ${classify_dst_port} + +| TC06: ACL ICMP packet filtering - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-ICMP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure a ICMP protocol filtering by ICMP type and code. +| | ... | [Ver] Send ICMP packets from one TG interface\ +| | ... | to the other, using different codes and types. Receive all packets\ +| | ... | except those with types and codes in the filtered ranges. +| | [Tags] | EXPECTED_FAILING +# Bug VPP-624, ICMP type/code values are not matched +| | [Teardown] | Run Keywords +| | ... | Read plugin-ACL configuration from VAT | ${node} | AND +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup interfaces and bridge domain for plugin-acl test +| | ... | icmp | ${acl_name_icmp} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_icmp} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_icmp} | ingress +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${icmp_type} | ${icmp_code} +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${icmp_code} +| | And Run Keyword And Expect Error | ICMP echo Rx timeout +| | ... | Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${classify_code} + +| TC07: ACL ICMPv6 packet filtering - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv6-ICMP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure a ICMPv6 protocol filtering by ICMPv6 type and code. +| | ... | [Ver] Send ICMPv6 packets from one TG interface\ +| | ... | to the other, using different codes and types. Receive all packets\ +| | ... | except those with the filtered type and code. +| | [Tags] | EXPECTED_FAILING +# Bug VPP-624, ICMP type/code values are not matched +| | [Teardown] | Run Keywords +| | ... | Read plugin-ACL configuration from VAT | ${node} | AND +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup interfaces and bridge domain for plugin-acl test +| | ... | icmpv6 | ${acl_name_icmpv6} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_icmpv6} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_icmpv6} | ingress +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${icmp_type} | ${icmp_code} +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${icmp_code} +| | And Run Keyword And Expect Error | ICMP echo Rx timeout +| | ... | Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${classify_code} + +| TC08: ACL reflexive IPv4 filtering through plugin-acl node - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG,\ +| | ... | configure a "drop all" ACL on ingress and reflexive ACL on egress. +| | ... | [Ver] Send a simple TCP packet to VPP interface 1 and do not receive\ +| | ... | it back. Then send the packet with reversed src/dst IP address\ +| | ... | to VPP interface 2 and receive it from interface 1(this should create\ +| | ... | a reflexive "permit" rule) Finally, send the original packet again\ +| | ... | and receive it from interface 2. +| | [Teardown] | Run Keywords +| | ... | Read plugin-ACL configuration from VAT | ${node} | AND +| | ... | Clear plugin-acl Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup Interfaces And Bridge Domain For plugin-acl Test +| | ... | reflex | ${acl_name_reflex} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_reflex} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_reflex} | egress +| | And Import Variables | resources/test_data/honeycomb/plugin_acl.py +| | ... | block_all | block_all +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | block_all | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | block_all | ingress +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_dst} | ${classify_src} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if2_mac} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if2_mac} +| | ... | TCP | ${dst_port} | ${src_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} + +# Routing section +# =============== + +| TC09: ACL IPv4 filtering through plugin-acl node - routed +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ +| | ... | interfaces to TG, add ARP entry and routes, and configure L3 IPv4 ACL\ +| | ... | on ingress interface with src/dst IP and protocol. +| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ +| | ... | to the other, using different IPv4 IPs. Receive all packets except\ +| | ... | those with IPs in the filtered ranges and UDP protocol payload. +| | [Tags] | EXPECTED_FAILING +# routed interfaces not yet supported by ACL plugin (no Jira id available) +| | Given Setup Interface IPs And Routes For IPv4 plugin-acl Test +| | ... | l3_ip4 | ${acl_name_l3_ip4} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_l3_ip4} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_l3_ip4} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} + +| TC10: ACL IPv6 filtering through plugin-acl node - routed +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv6-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv6 addresses on both\ +| | ... | interfaces to TG, add IP neighbor entry and routes, and configure\ +| | ... | L3 IPv6 ACL on ingress interface with src/dst IP and next-header. +| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ +| | ... | to the other, using different IPv6 IPs. Receive all packets except\ +| | ... | those with IPs in the filtered ranges and UDP protocol payload. +| | [Tags] | EXPECTED_FAILING +# routed interfaces not yet supported by ACL plugin (no Jira id available) +| | Given Path for 2-node testing is set +| | ... | ${nodes['TG']} | ${nodes['DUT1']} | ${nodes['TG']} +| | And Import Variables | resources/test_data/honeycomb/plugin_acl.py +| | ... | L3_IP6 | ${acl_name_l3_ip6} +| | And Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if1} | up +| | And Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if2} | up +# TODO: Configure addresses through Honeycomb when implemented. (Honeycomb-102) +| | And Set Interface Address | ${dut_node} +| | ... | ${dut_to_tg_if1} | ${dut_to_tg_if1_ip} | ${prefix_length} +| | And Set Interface Address | ${dut_node} +| | ... | ${dut_to_tg_if2} | ${dut_to_tg_if2_ip} | ${prefix_length} +| | And VPP RA suppress link layer | ${dut_node} | ${dut_to_tg_if2} +# TODO: Configure route through Honeycomb when implemented.(Honeycomb-58) +| | And Add IP Neighbor +| | ... | ${node} | ${dut_to_tg_if2} | ${gateway} | ${tg_to_dut_if2_mac} +| | And VPP Route Add | ${node} | ${dst_net} | ${prefix_length} +| | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False +| | And VPP Route Add | ${node} | ${classify_dst_net} | ${prefix_length} +| | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_l3_ip6} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_l3_ip6} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | UDP | ${src_port} | ${dst_port} + +| TC11: ACL port filtering through plugin-acl node - routed +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ +| | ... | interfaces to TG, add ARP entry and routes, and configure L4 port ACL\ +| | ... | on ingress interface with src/dst port ranges. +| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ +| | ... | to the other, using different ports. Receive all packets except\ +| | ... | those with ports in the filtered ranges. +| | [Tags] | EXPECTED_FAILING +# routed interfaces not yet supported by ACL plugin (no Jira id available) +| | Given Setup Interface IPs And Routes For IPv4 plugin-acl Test +| | ... | L4 | ${acl_name_l4} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_l4} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_l4} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${classify_src} | ${classify_dst} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${classify_src+5} | ${classify_dst+5} + +| TC12: ACL filtering with IPv4 address and TCP port in one rule - routed +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ +| | ... | interfaces to TG, add ARP entry and routes and configure a mixed +| | ... | rule with src/dst IP, TCP protocol and port ranges. +| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ +| | ... | using IPs and ports. Receive all packets except those with\ +| | ... | both IPs and ports in the filtered ranges. +| | [Tags] | EXPECTED_FAILING +# routed interfaces not yet supported by ACL plugin (no Jira id available) +| | Given Setup Interface IPs And Routes For IPv4 plugin-acl Test +| | ... | mixed | ${acl_name_mixed} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_mixed} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_mixed} | ingress +| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src_ip} | ${classify_dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src_ip} | ${classify_dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${classify_src_port} | ${classify_dst_port} + +| TC13: ACL ICMP packet filtering - routed +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ +| | ... | interfaces to TG, add ARP entry and routes, and configure ICMP ACL\ +| | ... | on ingress interface with ICMP type and code. +| | ... | [Ver] Send ICMP packets from one TG interface\ +| | ... | to the other, using different codes and types. Receive all packets\ +| | ... | except those with the filtered type and code. +| | [Tags] | EXPECTED_FAILING +# Bug VPP-624, ICMP type/code values are not matched +# routed interfaces not yet supported by ACL plugin (no Jira id available) +| | Given Setup Interface IPs And Routes For IPv4 plugin-acl Test +| | ... | icmp | ${acl_name_icmp} +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_icmp} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_icmp} | ingress +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${icmp_type} | ${icmp_code} +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${icmp_code} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${classify_code} + +| TC14: ACL ICMPv6 packet filtering - routed +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv6 addresses on both\ +| | ... | interfaces to TG, add ARP entry and routes, and configure ICMP ACL\ +| | ... | on ingress interface with ICMPv6 type and code. +| | ... | [Ver] Send ICMPv6 packets from one TG interface\ +| | ... | to the other, using different codes and types. Receive all packets\ +| | ... | except those with the filtered type and code. +| | [Tags] | EXPECTED_FAILING +# Bug VPP-624, ICMP type/code values are not matched +# routed interfaces not yet supported by ACL plugin (no Jira id available) +| | Given Path for 2-node testing is set +| | ... | ${nodes['TG']} | ${nodes['DUT1']} | ${nodes['TG']} +| | And Import Variables | resources/test_data/honeycomb/plugin_acl.py +| | ... | L3_IP6 | ${acl_name_l3_ip6} +| | And Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if1} | up +| | And Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if2} | up +# TODO: Configure addresses through Honeycomb when implemented. (Honeycomb-102) +| | And Set Interface Address | ${dut_node} +| | ... | ${dut_to_tg_if1} | ${dut_to_tg_if1_ip} | ${prefix_length} +| | And Set Interface Address | ${dut_node} +| | ... | ${dut_to_tg_if2} | ${dut_to_tg_if2_ip} | ${prefix_length} +| | And VPP RA suppress link layer | ${dut_node} | ${dut_to_tg_if2} +# TODO: Configure route through Honeycomb when implemented.(Honeycomb-58) +| | And Add IP Neighbor +| | ... | ${node} | ${dut_to_tg_if2} | ${gateway} | ${tg_to_dut_if2_mac} +| | And VPP Route Add | ${node} | ${dst_net} | ${prefix_length} +| | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False +| | And VPP Route Add | ${node} | ${classify_dst_net} | ${prefix_length} +| | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_icmp} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_icmp} | ingress +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${icmp_type} | ${icmp_code} +| | Then Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${icmp_code} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send ICMP packet with type and code | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | ${classify_type} | ${classify_code} + +| TC15: ACL reflexive IPv4 filtering through plugin-acl node - bridged +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ +| | ... | interfaces to TG, add ARP entries and routes,\ +| | ... | configure a "drop all" ACL on ingress and reflexive ACL on egress. +| | ... | [Ver] Send a simple TCP packet to VPP interface 1 and do not receive\ +| | ... | it back. Then send the packet with reversed src/dst IP address\ +| | ... | to VPP interface 2 and receive it from interface 1(this should create\ +| | ... | a reflexive "permit" rule) Finally, send the original packet again\ +| | ... | and receive it from interface 2. +| | [Tags] | EXPECTED_FAILING +# routed interfaces not yet supported by ACL plugin (no Jira id available) +| | Given Setup Interface IPs And Routes For IPv4 plugin-acl Test +| | ... | icmp | ${acl_name_reflex} +| | And Add ARP on DUT +| | ... | ${node} | ${dut_to_tg_if1} | ${gateway2} | ${tg_to_dut_if1_mac} +| | And VPP Route Add +| | ... | ${node} | ${src_net} | ${prefix_length} | ${gateway2} +| | ... | interface=${dut_to_tg_if1} | use_sw_index=False +| | And VPP Route Add +| | ... | ${node} | ${classify_src_net} | ${prefix_length} | ${gateway2} +| | ... | interface=${dut_to_tg_if1} | use_sw_index=False +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | ${acl_name_reflex} | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${acl_name_reflex} | egress +| | And Import Variables | resources/test_data/honeycomb/plugin_acl.py +| | ... | block_all | block_all +| | When Honeycomb Creates ACL Chain Through ACL plugin +| | ... | ${dut_node} | block_all | ${acl_settings} +| | And Honeycomb Assigns plugin-acl Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | block_all | ingress +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_dst} | ${classify_src} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if2_mac} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if2_mac} +| | ... | TCP | ${dst_port} | ${src_port} +| | And Send TCP Or UDP Packet | ${tg_node} +| | ... | ${classify_src} | ${classify_dst} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} + +*** Keywords *** +| Setup interface IPs and routes for IPv4 plugin-acl test +| | [Arguments] | ${test_data_id} | ${acl_name} +| | Path for 2-node testing is set +| | ... | ${nodes['TG']} | ${nodes['DUT1']} | ${nodes['TG']} +| | Import Variables | resources/test_data/honeycomb/plugin_acl.py +| | ... | ${test_data_id} | ${acl_name} +| | Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if1} | up +| | Honeycomb sets interface state | ${dut_node} | ${dut_to_tg_if2} | up +| | Honeycomb sets interface ipv4 address with prefix | ${dut_node} +| | ... | ${dut_to_tg_if1} | ${dut_to_tg_if1_ip} | ${prefix_length} +| | Honeycomb sets interface ipv4 address with prefix | ${dut_node} +| | ... | ${dut_to_tg_if2} | ${dut_to_tg_if2_ip} | ${prefix_length} +# TODO: Configure routes through Honeycomb once routing tests are added +| | Add ARP on DUT +| | ... | ${node} | ${dut_to_tg_if2} | ${gateway} | ${tg_to_dut_if2_mac} +| | VPP Route Add +| | ... | ${node} | ${dst_net} | ${prefix_length} | ${gateway} +| | ... | interface=${dut_to_tg_if2} | use_sw_index=False +| | VPP Route Add +| | ... | ${node} | ${classify_dst_net} | ${prefix_length} | ${gateway} +| | ... | interface=${dut_to_tg_if2} | use_sw_index=False + +| Setup interfaces and bridge domain for plugin-acl test +| | [Arguments] | ${test_data_id} | ${acl_name} +| | Path For 2-node Testing Is Set +| | ... | ${nodes['TG']} | ${nodes['DUT1']} | ${nodes['TG']} +| | Import Variables | resources/test_data/honeycomb/plugin_acl.py +| | ... | ${test_data_id} | ${acl_name} +| | Honeycomb Sets Interface State | ${dut_node} | ${dut_to_tg_if1} | up +| | Honeycomb Sets Interface State | ${dut_node} | ${dut_to_tg_if2} | up +| | Honeycomb Creates first L2 Bridge Domain +| | ... | ${dut_node} | ${bd_name} | ${bd_settings} +| | Honeycomb Adds Interfaces To Bridge Domain +| | ... | ${dut_node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | ... | ${bd_name} | ${bd_if_settings} |