aboutsummaryrefslogtreecommitdiffstats
path: root/docs
diff options
context:
space:
mode:
authorMaciek Konstantynowicz <mkonstan@cisco.com>2017-04-26 12:37:26 +0100
committerPeter Mikus <pmikus@cisco.com>2017-04-26 15:52:35 +0200
commit01f9e5ccff93c600c793b78f4b8957289ad3359f (patch)
tree442fff38debb090901dad28726acaaa20afd0a92 /docs
parent4e32bebc47a000b1424ed8a3141a5b4cd4d1f740 (diff)
csit rls1704 report - updated csit_release_notes.rst and overview.rst files.
Change-Id: I0b5005a4c8dc566e559638d981fb0e8a7b079499 Signed-off-by: Maciek Konstantynowicz <mkonstan@cisco.com>
Diffstat (limited to 'docs')
-rw-r--r--docs/report/test_configuration/vpp_functional_configuration/index.rst4
-rw-r--r--docs/report/test_configuration/vpp_performance_configuration/index.rst4
-rw-r--r--docs/report/testpmd_performance_tests/csit_release_notes.rst15
-rw-r--r--docs/report/vpp_functional_tests/csit_release_notes.rst17
-rw-r--r--docs/report/vpp_performance_tests/csit_release_notes.rst38
-rw-r--r--docs/report/vpp_performance_tests/overview.rst60
6 files changed, 105 insertions, 33 deletions
diff --git a/docs/report/test_configuration/vpp_functional_configuration/index.rst b/docs/report/test_configuration/vpp_functional_configuration/index.rst
index c13f2d48fd..89ccbefa87 100644
--- a/docs/report/test_configuration/vpp_functional_configuration/index.rst
+++ b/docs/report/test_configuration/vpp_functional_configuration/index.rst
@@ -1,5 +1,5 @@
-VPP Functional Configuration
-============================
+VPP Functional Test Configs
+===========================
.. note::
diff --git a/docs/report/test_configuration/vpp_performance_configuration/index.rst b/docs/report/test_configuration/vpp_performance_configuration/index.rst
index 1d1b03f561..c5009cf30e 100644
--- a/docs/report/test_configuration/vpp_performance_configuration/index.rst
+++ b/docs/report/test_configuration/vpp_performance_configuration/index.rst
@@ -1,5 +1,5 @@
-VPP Performance Configuration
-=============================
+VPP Performance Test Configs
+============================
.. note::
diff --git a/docs/report/testpmd_performance_tests/csit_release_notes.rst b/docs/report/testpmd_performance_tests/csit_release_notes.rst
index ba78a1bc54..7f87d247c9 100644
--- a/docs/report/testpmd_performance_tests/csit_release_notes.rst
+++ b/docs/report/testpmd_performance_tests/csit_release_notes.rst
@@ -8,3 +8,18 @@ Changes in CSIT |release|
- new NICs - 2p40GE Intel xl710, 2p10GE Intel x710
+Known Issues
+------------
+
+Here is the list of known issues in CSIT |release| for Testpmd performance tests:
+
++---+---------------------------------------------------+------------+-----------------------------------------------------------------+
+| # | Issue | Jira ID | Description |
++---+---------------------------------------------------+------------+-----------------------------------------------------------------+
+| 1 | Testpmd in 1t1c and 2t2c setups - large variation | CSIT-568 | Suspected NIC firmware or DPDK driver issue affecting NDR |
+| | of discovered NDR throughput values across | | throughput. Applies to XL710 and X710 NICs, no issues observed |
+| | multiple test runs with xl710 and x710 NICs. | | on x520 NICs. |
++---+---------------------------------------------------+------------+-----------------------------------------------------------------+
+| 2 | Lower than expected NDR throughput with xl710 | CSIT-? | Suspected NIC firmware or DPDK driver issue affecting NDR |
+| | and x710 NICs, compared to x520 NICs. | | throughput. Applies to XL710 and X710 NICs. |
++---+---------------------------------------------------+------------+-----------------------------------------------------------------+ \ No newline at end of file
diff --git a/docs/report/vpp_functional_tests/csit_release_notes.rst b/docs/report/vpp_functional_tests/csit_release_notes.rst
index 3b2d02ebb1..8f63b8ed01 100644
--- a/docs/report/vpp_functional_tests/csit_release_notes.rst
+++ b/docs/report/vpp_functional_tests/csit_release_notes.rst
@@ -4,17 +4,24 @@ CSIT Release Notes
Changes in CSIT |release|
-------------------------
-#. Introduction of Centos7 tests
+#. VPP functional test environment changes
#. Implemented VAT command history collection for every test case as part of teardown
+ - Introduction of Centos7 tests in VIRL environment.
+
+#. VPP performance test framework changes
+
+ - Added VAT command history collection for every test case as part of teardown.
+
#. Added VPP functional tests
- - IPv4 routed-forwarding with dot1q VLAN sub-interfaces
- - L2BD switched-forwarding with dot1q VLAN sub-interfaces and vhost-user to VM
- - IPv4 routed-forwarding with vhost-user interfaces to VM
- - Vhost-User interface re-connect tests
+ - IPv4 routed-forwarding with dot1q VLAN sub-interfaces.
+ - L2BD switched-forwarding with dot1q VLAN sub-interfaces and vhost-user to VM.
+ - IPv4 routed-forwarding with vhost-user interfaces to VM.
+ - Vhost-user interface re-connect tests.
+>>>>>>> csit rls1704 report - updated csit_release_notes.rst and overview.rst files.
Known Issues
------------
diff --git a/docs/report/vpp_performance_tests/csit_release_notes.rst b/docs/report/vpp_performance_tests/csit_release_notes.rst
index 10e01ababa..7c17e0f448 100644
--- a/docs/report/vpp_performance_tests/csit_release_notes.rst
+++ b/docs/report/vpp_performance_tests/csit_release_notes.rst
@@ -6,31 +6,36 @@ Changes in CSIT |release|
#. VPP performance test environment changes
- - Further VM and vhost-user test environment optimizations - Qemu virtio
+ - Further optimizations of VM and vhost-user test environment - Qemu virtio
queue size increased from default value of 256 to 1024.
- - Addition of HW cryptodev devices in all three LF FD.io physical testbeds.
+ - Addition of HW cryptodev devices - Intel QAT 8950 50G - in all three
+ LF FD.io physical testbeds.
-#. Added tests
+#. VPP performance test framework changes
- - CGNAT
+ - Added VAT command history collection for every test case as part of teardown.
+
+#. Added VPP performance tests
+
+ - **CGNAT**
- Carrier Grade Network Address Translation tests with varying number
of users and ports per user: 1u-15p, 10u-15p, 100u-15p, 1000u-15p,
2000u-15p, 4000u-15p - with Intel x520 NIC.
- - vhost-user tests with one VM
+ - **vhost-user tests with one VM**
- L2 Bridge Domain switched-forwarding with Intel x710 NIC, Intel x520 NIC,
Intel xl710 NIC.
- VXLAN and L2 Bridge Domain switched-forwarding with Intel x520 NIC.
- - vhost-user tests with two VM service chain
+ - **vhost-user tests with two VMs service chain**
- L2 cross-connect switched-forwarding with Intel x520 NIC, Intel xl710 NIC.
- L2 Bridge Domain switched-forwarding with Intel x520 NIC, Intel xl710 NIC.
- IPv4 routed-forwarding with Intel x520 NIC, Intel xl710 NIC.
- - IPSec encryption with
+ - **IPSec encryption with**
- AES-GCM, CBC-SHA1 ciphers, in combination with IPv4 routed-forwarding
with Intel xl710 NIC.
@@ -205,22 +210,21 @@ Here is the list of known issues in CSIT |release| for VPP performance tests:
| | for ip4scale200k, ip4scale2m scale IPv4 routed- | | Observed frequency: all test runs. |
| | forwarding tests. ip4scale20k tests are fine. | | |
+---+-------------------------------------------------+------------+-----------------------------------------------------------------+
-| 2 | VAT API timeouts during ip6scale2m scale IPv6 | | Needs fixing VPP VAT API timeouts for large volume of IPv6 |
-| | routed-forwarding tests when volume adding IPv6 | VPP-? | routes. |
+| 2 | VAT API timeouts during ip6scale2m scale IPv6 | VPP-712 | Needs fixing VPP VAT API timeouts for large volume of IPv6 |
+| | routed-forwarding tests when volume adding IPv6 | | routes. |
| | routes - 2M in this case. ip6scale2kk works. | | |
+---+-------------------------------------------------+------------+-----------------------------------------------------------------+
-| 3 | Vic1385 and Vic1227 low performance | CSIT-? | Low NDR performance. |
+| 3 | Vic1385 and Vic1227 low performance | VPP-664 | Low NDR performance. |
| | | | . |
+---+-------------------------------------------------+------------+-----------------------------------------------------------------+
-| 4 | Sporadic NDR discovery test failures on x520 | CSIT-? | Suspected issue with HW settings (BIOS, FW) in LF |
+| 4 | Sporadic NDR discovery test failures on x520 | CSIT-750 | Suspected issue with HW settings (BIOS, FW) in LF |
| | | | infrastructure. Issue can't be replicated outside LF. |
+---+-------------------------------------------------+------------+-----------------------------------------------------------------+
-| 5 | Testpmd - Non-repeatible zig-zagging NDR | CSIT-? | Suspected NIC firmware or driver issue affecting NDR |
-| | throughput in multi-thread/-core tests | | in multi-thread/-core operation. Need to update to latest |
-| | - 2t2c - for some tested NICs. | | firmware in NICs. Applies to XL710 and X710 NICs. |
+| 5 | VPP in 2t2c setups - large variation | CSIT-568 | Suspected NIC firmware or DPDK driver issue affecting NDR |
+| | of discovered NDR throughput values across | | throughput. Applies to XL710 and X710 NICs, x520 NICs are fine. |
+| | multiple test runs with xl710 and x710 NICs. | | . |
+---+-------------------------------------------------+------------+-----------------------------------------------------------------+
-| 6 | VPP - Non-repeatible zig-zagging NDR | CSIT-? | Suspected NIC firmware or driver issue affecting NDR |
-| | throughput in multi-thread/-core tests | | in multi-thread/-core operation. Need to update to latest |
-| | - 2t2c - for some tested NICs. | | firmware in NICs. Applies to XL710 and X710 NICs. |
+| 6 | Lower than expected NDR and PDR throughput with | CSIT-569 | Suspected NIC firmware or DPDK driver issue affecting NDR and |
+| | xl710 and x710 NICs, compared to x520 NICs. | | PDR throughput. Applies to XL710 and X710 NICs. |
+---+-------------------------------------------------+------------+-----------------------------------------------------------------+
diff --git a/docs/report/vpp_performance_tests/overview.rst b/docs/report/vpp_performance_tests/overview.rst
index 96a9377511..56ffda03df 100644
--- a/docs/report/vpp_performance_tests/overview.rst
+++ b/docs/report/vpp_performance_tests/overview.rst
@@ -238,11 +238,6 @@ suites:
switching to/from four vhost interfaces and two VMs, NDR throughput
discovery.
-Methodology: TRex Traffic Generator Usage
------------------------------------------
-
-TODO Description to be added.
-
Methodology: Multi-Thread and Multi-Core
----------------------------------------
@@ -338,5 +333,56 @@ guest dealing with data plan.
Methodology: IPSec with Intel QAT HW cards
------------------------------------------
-TODO Description to be added.
-Intel QAT 8950 50G (Walnut Hill) \ No newline at end of file
+VPP IPSec performance tests are using DPDK cryptodev device driver in
+combination with HW cryptodev devices - Intel QAT 8950 50G - present in
+LF FD.io physical testbeds. DPDK cryptodev can be used for all IPSec
+data plane functions supported by VPP.
+
+Currently CSIT |release| implements following IPSec test cases:
+
+- AES-GCM, CBC-SHA1 ciphers, in combination with IPv4 routed-forwarding
+ with Intel xl710 NIC.
+- CBC-SHA1 ciphers, in combination with LISP-GPE overlay tunneling for
+ IPv4-over-IPv4 with Intel xl710 NIC.
+
+Methodology: TRex Traffic Generator Usage
+-----------------------------------------
+
+The `TRex traffic generator <https://wiki.fd.io/view/TRex>`_ is used for all
+CSIT performance tests. TRex stateless mode is used to measure NDR and PDR
+throughputs using binary search (NDR and PDR discovery tests) and for quick
+checks of DUT performance against the reference NDRs (NDR check tests) for
+specific configuration.
+
+TRex is installed and run on the TG compute node. The typical procedure is:
+
+ - If the TRex is not already installed on TG, it is installed in the
+ suite setup phase - see `TRex intallation <https://gerrit.fd.io/r/gitweb?p=csit.git;a=blob;f=resources/tools/t-rex/t-rex-installer.sh;h=8090b7568327ac5f869e82664bc51b24f89f603f;hb=refs/heads/rls1704>`_.
+ - TRex configuration is set in its configuration file::
+
+ /etc/trex_cfg.yaml
+
+ - TRex is started in the background mode::
+
+ sh -c 'cd /opt/trex-core-2.22/scripts/ && sudo nohup ./t-rex-64 -i -c 7 --iom 0 > /dev/null 2>&1 &' > /dev/null
+
+ - There are traffic streams dynamically prepared for each test. The traffic
+ is sent and the statistics obtained using trex_stl_lib.api.STLClient.
+
+**Measuring packet loss**
+
+ - Create an instance of STLClient
+ - Connect to the client
+ - Add all streams
+ - Clear statistics
+ - Send the traffic for defined time
+ - Get the statistics
+
+If there is a warm-up phase required, the traffic is sent also before test and
+the statistics are ignored.
+
+**Measuring latency**
+
+If measurement of latency is requested, two more packet streams are created (one
+for each direction) with TRex flow_stats parameter set to STLFlowLatencyStats. In
+that case, returned statistics will also include min/avg/max latency values.
an> */ struct rte_acl_ipv4vlan_rule { struct rte_acl_rule_data data; /**< Miscellaneous data for the rule. */ uint8_t proto; /**< IPv4 protocol ID. */ uint8_t proto_mask; /**< IPv4 protocol ID mask. */ uint16_t vlan; /**< VLAN ID. */ uint16_t vlan_mask; /**< VLAN ID mask. */ uint16_t domain; /**< VLAN domain. */ uint16_t domain_mask; /**< VLAN domain mask. */ uint32_t src_addr; /**< IPv4 source address. */ uint32_t src_mask_len; /**< IPv4 source address mask. */ uint32_t dst_addr; /**< IPv4 destination address. */ uint32_t dst_mask_len; /**< IPv4 destination address mask. */ uint16_t src_port_low; /**< L4 source port low. */ uint16_t src_port_high; /**< L4 source port high. */ uint16_t dst_port_low; /**< L4 destination port low. */ uint16_t dst_port_high; /**< L4 destination port high. */ }; /** * Specifies fields layout inside rte_acl_rule for rte_acl_ipv4vlan_rule. */ enum { RTE_ACL_IPV4VLAN_PROTO_FIELD, RTE_ACL_IPV4VLAN_VLAN1_FIELD, RTE_ACL_IPV4VLAN_VLAN2_FIELD, RTE_ACL_IPV4VLAN_SRC_FIELD, RTE_ACL_IPV4VLAN_DST_FIELD, RTE_ACL_IPV4VLAN_SRCP_FIELD, RTE_ACL_IPV4VLAN_DSTP_FIELD, RTE_ACL_IPV4VLAN_NUM_FIELDS }; /** * Macro to define rule size for rte_acl_ipv4vlan_rule. */ #define RTE_ACL_IPV4VLAN_RULE_SZ \ RTE_ACL_RULE_SZ(RTE_ACL_IPV4VLAN_NUM_FIELDS) /* * That effectively defines order of IPV4VLAN classifications: * - PROTO * - VLAN (TAG and DOMAIN) * - SRC IP ADDRESS * - DST IP ADDRESS * - PORTS (SRC and DST) */ enum { RTE_ACL_IPV4VLAN_PROTO, RTE_ACL_IPV4VLAN_VLAN, RTE_ACL_IPV4VLAN_SRC, RTE_ACL_IPV4VLAN_DST, RTE_ACL_IPV4VLAN_PORTS, RTE_ACL_IPV4VLAN_NUM }; /* rules for invalid layout test */ struct rte_acl_ipv4vlan_rule invalid_layout_rules[] = { /* test src and dst address */ { .data = {.userdata = 1, .category_mask = 1}, .src_addr = IPv4(10,0,0,0), .src_mask_len = 24, }, { .data = {.userdata = 2, .category_mask = 1}, .dst_addr = IPv4(10,0,0,0), .dst_mask_len = 24, }, /* test src and dst ports */ { .data = {.userdata = 3, .category_mask = 1}, .dst_port_low = 100, .dst_port_high = 100, }, { .data = {.userdata = 4, .category_mask = 1}, .src_port_low = 100, .src_port_high = 100, }, /* test proto */ { .data = {.userdata = 5, .category_mask = 1}, .proto = 0xf, .proto_mask = 0xf }, { .data = {.userdata = 6, .category_mask = 1}, .dst_port_low = 0xf, .dst_port_high = 0xf, } }; /* these might look odd because they don't match up the rules. This is * intentional, as the invalid layout test presumes returning the correct * results using the wrong data layout. */ struct ipv4_7tuple invalid_layout_data[] = { {.ip_src = IPv4(10,0,1,0)}, /* should not match */ {.ip_src = IPv4(10,0,0,1), .allow = 2}, /* should match 2 */ {.port_src = 100, .allow = 4}, /* should match 4 */ {.port_dst = 0xf, .allow = 6}, /* should match 6 */ }; #define ACL_ALLOW 0 #define ACL_DENY 1 #define ACL_ALLOW_MASK 0x1 #define ACL_DENY_MASK 0x2 /* ruleset for ACL unit test */ struct rte_acl_ipv4vlan_rule acl_test_rules[] = { /* destination IP addresses */ /* matches all packets traveling to 192.168.0.0/16 */ { .data = {.userdata = 1, .category_mask = ACL_ALLOW_MASK, .priority = 230}, .dst_addr = IPv4(192,168,0,0), .dst_mask_len = 16, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets traveling to 192.168.1.0/24 */ { .data = {.userdata = 2, .category_mask = ACL_ALLOW_MASK, .priority = 330}, .dst_addr = IPv4(192,168,1,0), .dst_mask_len = 24, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets traveling to 192.168.1.50 */ { .data = {.userdata = 3, .category_mask = ACL_DENY_MASK, .priority = 230}, .dst_addr = IPv4(192,168,1,50), .dst_mask_len = 32, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* source IP addresses */ /* matches all packets traveling from 10.0.0.0/8 */ { .data = {.userdata = 4, .category_mask = ACL_ALLOW_MASK, .priority = 240}, .src_addr = IPv4(10,0,0,0), .src_mask_len = 8, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets traveling from 10.1.1.0/24 */ { .data = {.userdata = 5, .category_mask = ACL_ALLOW_MASK, .priority = 340}, .src_addr = IPv4(10,1,1,0), .src_mask_len = 24, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets traveling from 10.1.1.1 */ { .data = {.userdata = 6, .category_mask = ACL_DENY_MASK, .priority = 240}, .src_addr = IPv4(10,1,1,1), .src_mask_len = 32, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* VLAN tag */ /* matches all packets with lower 7 bytes of VLAN tag equal to 0x64 */ { .data = {.userdata = 7, .category_mask = ACL_ALLOW_MASK, .priority = 260}, .vlan = 0x64, .vlan_mask = 0x7f, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets with VLAN tags that have 0x5 in them */ { .data = {.userdata = 8, .category_mask = ACL_ALLOW_MASK, .priority = 260}, .vlan = 0x5, .vlan_mask = 0x5, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets with VLAN tag 5 */ { .data = {.userdata = 9, .category_mask = ACL_DENY_MASK, .priority = 360}, .vlan = 0x5, .vlan_mask = 0xffff, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* VLAN domain */ /* matches all packets with lower 7 bytes of domain equal to 0x64 */ { .data = {.userdata = 10, .category_mask = ACL_ALLOW_MASK, .priority = 250}, .domain = 0x64, .domain_mask = 0x7f, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets with domains that have 0x5 in them */ { .data = {.userdata = 11, .category_mask = ACL_ALLOW_MASK, .priority = 350}, .domain = 0x5, .domain_mask = 0x5, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets with domain 5 */ { .data = {.userdata = 12, .category_mask = ACL_DENY_MASK, .priority = 350}, .domain = 0x5, .domain_mask = 0xffff, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* destination port */ /* matches everything with dst port 80 */ { .data = {.userdata = 13, .category_mask = ACL_ALLOW_MASK, .priority = 310}, .dst_port_low = 80, .dst_port_high = 80, .src_port_low = 0, .src_port_high = 0xffff, }, /* matches everything with dst port 22-1023 */ { .data = {.userdata = 14, .category_mask = ACL_ALLOW_MASK, .priority = 210}, .dst_port_low = 22, .dst_port_high = 1023, .src_port_low = 0, .src_port_high = 0xffff, }, /* matches everything with dst port 1020 */ { .data = {.userdata = 15, .category_mask = ACL_DENY_MASK, .priority = 310}, .dst_port_low = 1020, .dst_port_high = 1020, .src_port_low = 0, .src_port_high = 0xffff, }, /* matches everything with dst portrange 1000-2000 */ { .data = {.userdata = 16, .category_mask = ACL_DENY_MASK, .priority = 210}, .dst_port_low = 1000, .dst_port_high = 2000, .src_port_low = 0, .src_port_high = 0xffff, }, /* source port */ /* matches everything with src port 80 */ { .data = {.userdata = 17, .category_mask = ACL_ALLOW_MASK, .priority = 320}, .src_port_low = 80, .src_port_high = 80, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches everything with src port 22-1023 */ { .data = {.userdata = 18, .category_mask = ACL_ALLOW_MASK, .priority = 220}, .src_port_low = 22, .src_port_high = 1023, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches everything with src port 1020 */ { .data = {.userdata = 19, .category_mask = ACL_DENY_MASK, .priority = 320}, .src_port_low = 1020, .src_port_high = 1020, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches everything with src portrange 1000-2000 */ { .data = {.userdata = 20, .category_mask = ACL_DENY_MASK, .priority = 220}, .src_port_low = 1000, .src_port_high = 2000, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* protocol number */ /* matches all packets with protocol number either 0x64 or 0xE4 */ { .data = {.userdata = 21, .category_mask = ACL_ALLOW_MASK, .priority = 270}, .proto = 0x64, .proto_mask = 0x7f, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets with protocol that have 0x5 in them */ { .data = {.userdata = 22, .category_mask = ACL_ALLOW_MASK, .priority = 1}, .proto = 0x5, .proto_mask = 0x5, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* matches all packets with protocol 5 */ { .data = {.userdata = 23, .category_mask = ACL_DENY_MASK, .priority = 370}, .proto = 0x5, .proto_mask = 0xff, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 0, .dst_port_high = 0xffff, }, /* rules combining various fields */ { .data = {.userdata = 24, .category_mask = ACL_ALLOW_MASK, .priority = 400}, /** make sure that unmasked bytes don't fail! */ .dst_addr = IPv4(1,2,3,4), .dst_mask_len = 16, .src_addr = IPv4(5,6,7,8), .src_mask_len = 24, .proto = 0x5, .proto_mask = 0xff, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 22, .dst_port_high = 1024, .vlan = 0x8100, .vlan_mask = 0xffff, .domain = 0x64, .domain_mask = 0xffff, }, { .data = {.userdata = 25, .category_mask = ACL_DENY_MASK, .priority = 400}, .dst_addr = IPv4(5,6,7,8), .dst_mask_len = 24, .src_addr = IPv4(1,2,3,4), .src_mask_len = 16, .proto = 0x5, .proto_mask = 0xff, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 22, .dst_port_high = 1024, .vlan = 0x8100, .vlan_mask = 0xffff, .domain = 0x64, .domain_mask = 0xffff, }, { .data = {.userdata = 26, .category_mask = ACL_ALLOW_MASK, .priority = 500}, .dst_addr = IPv4(1,2,3,4), .dst_mask_len = 8, .src_addr = IPv4(5,6,7,8), .src_mask_len = 32, .proto = 0x5, .proto_mask = 0xff, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 22, .dst_port_high = 1024, .vlan = 0x64, .vlan_mask = 0xffff, }, { .data = {.userdata = 27, .category_mask = ACL_DENY_MASK, .priority = 500}, .dst_addr = IPv4(5,6,7,8), .dst_mask_len = 32, .src_addr = IPv4(1,2,3,4), .src_mask_len = 8, .proto = 0x5, .proto_mask = 0xff, .src_port_low = 0, .src_port_high = 0xffff, .dst_port_low = 22, .dst_port_high = 1024, .vlan = 0x64, .vlan_mask = 0xffff, }, }; /* data for ACL unit test */ struct ipv4_7tuple acl_test_data[] = { /* testing single rule aspects */ {.ip_src = IPv4(10,0,0,0), .allow = 4}, /* should match 4 */ {.ip_src = IPv4(10,1,1,2), .allow = 5}, /* should match 5 */ {.ip_src = IPv4(10,1,1,1), .allow = 5, .deny = 6}, /* should match 5, 6 */ {.ip_dst = IPv4(10,0,0,0)}, /* should not match */ {.ip_dst = IPv4(10,1,1,2)}, /* should not match */ {.ip_dst = IPv4(10,1,1,1)}, /* should not match */ {.ip_src = IPv4(192,168,2,50)}, /* should not match */ {.ip_src = IPv4(192,168,1,2)}, /* should not match */ {.ip_src = IPv4(192,168,1,50)}, /* should not match */ {.ip_dst = IPv4(192,168,2,50), .allow = 1}, /* should match 1 */ {.ip_dst = IPv4(192,168,1,49), .allow = 2}, /* should match 2 */ {.ip_dst = IPv4(192,168,1,50), .allow = 2, .deny = 3}, /* should match 2, 3 */ {.vlan = 0x64, .allow = 7}, /* should match 7 */ {.vlan = 0xfE4, .allow = 7}, /* should match 7 */ {.vlan = 0xE2}, /* should not match */ {.vlan = 0xD, .allow = 8}, /* should match 8 */ {.vlan = 0x6}, /* should not match */ {.vlan = 0x5, .allow = 8, .deny = 9}, /* should match 8, 9 */ {.domain = 0x64, .allow = 10}, /* should match 10 */ {.domain = 0xfE4, .allow = 10}, /* should match 10 */ {.domain = 0xE2}, /* should not match */ {.domain = 0xD, .allow = 11}, /* should match 11 */ {.domain = 0x6}, /* should not match */ {.domain = 0x5, .allow = 11, .deny = 12}, /* should match 11, 12 */ {.port_dst = 80, .allow = 13}, /* should match 13 */ {.port_dst = 79, .allow = 14}, /* should match 14 */ {.port_dst = 81, .allow = 14}, /* should match 14 */ {.port_dst = 21}, /* should not match */ {.port_dst = 1024, .deny = 16}, /* should match 16 */ {.port_dst = 1020, .allow = 14, .deny = 15}, /* should match 14, 15 */ {.port_src = 80, .allow = 17}, /* should match 17 */ {.port_src = 79, .allow = 18}, /* should match 18 */ {.port_src = 81, .allow = 18}, /* should match 18 */ {.port_src = 21}, /* should not match */ {.port_src = 1024, .deny = 20}, /* should match 20 */ {.port_src = 1020, .allow = 18, .deny = 19}, /* should match 18, 19 */ {.proto = 0x64, .allow = 21}, /* should match 21 */ {.proto = 0xE4, .allow = 21}, /* should match 21 */ {.proto = 0xE2}, /* should not match */ {.proto = 0xD, .allow = 22}, /* should match 22 */ {.proto = 0x6}, /* should not match */ {.proto = 0x5, .allow = 22, .deny = 23}, /* should match 22, 23 */ /* testing matching multiple rules at once */ {.vlan = 0x5, .ip_src = IPv4(10,1,1,1), .allow = 5, .deny = 9}, /* should match 5, 9 */ {.vlan = 0x5, .ip_src = IPv4(192,168,2,50), .allow = 8, .deny = 9}, /* should match 8, 9 */ {.vlan = 0x55, .ip_src = IPv4(192,168,1,49), .allow = 8}, /* should match 8 */ {.port_dst = 80, .port_src = 1024, .allow = 13, .deny = 20}, /* should match 13,20 */ {.port_dst = 79, .port_src = 1024, .allow = 14, .deny = 20}, /* should match 14,20 */ {.proto = 0x5, .ip_dst = IPv4(192,168,2,50), .allow = 1, .deny = 23}, /* should match 1, 23 */ {.proto = 0x5, .ip_dst = IPv4(192,168,1,50), .allow = 2, .deny = 23}, /* should match 2, 23 */ {.vlan = 0x64, .domain = 0x5, .allow = 11, .deny = 12}, /* should match 11, 12 */ {.proto = 0x5, .port_src = 80, .allow = 17, .deny = 23}, /* should match 17, 23 */ {.proto = 0x5, .port_dst = 80, .allow = 13, .deny = 23}, /* should match 13, 23 */ {.proto = 0x51, .port_src = 5000}, /* should not match */ {.ip_src = IPv4(192,168,1,50), .ip_dst = IPv4(10,0,0,0), .proto = 0x51, .port_src = 5000, .port_dst = 5000}, /* should not match */ /* test full packet rules */ { .ip_dst = IPv4(1,2,100,200), .ip_src = IPv4(5,6,7,254), .proto = 0x5, .vlan = 0x8100, .domain = 0x64, .port_src = 12345, .port_dst = 80, .allow = 24, .deny = 23 }, /* should match 23, 24 */ { .ip_dst = IPv4(5,6,7,254), .ip_src = IPv4(1,2,100,200), .proto = 0x5, .vlan = 0x8100, .domain = 0x64, .port_src = 12345, .port_dst = 80, .allow = 13, .deny = 25 }, /* should match 13, 25 */ { .ip_dst = IPv4(1,10,20,30), .ip_src = IPv4(5,6,7,8), .proto = 0x5, .vlan = 0x64, .port_src = 12345, .port_dst = 80, .allow = 26, .deny = 23 }, /* should match 23, 26 */ { .ip_dst = IPv4(5,6,7,8), .ip_src = IPv4(1,10,20,30), .proto = 0x5, .vlan = 0x64, .port_src = 12345, .port_dst = 80, .allow = 13, .deny = 27 }, /* should match 13, 27 */ { .ip_dst = IPv4(2,2,3,4), .ip_src = IPv4(4,6,7,8), .proto = 0x5, .vlan = 0x64, .port_src = 12345, .port_dst = 80, .allow = 13, .deny = 23 }, /* should match 13, 23 */ { .ip_dst = IPv4(1,2,3,4), .ip_src = IPv4(4,6,7,8), .proto = 0x5, .vlan = 0x64, .port_src = 12345, .port_dst = 80, .allow = 13, .deny = 23 }, /* should match 13, 23 */ /* visual separator! */ { .ip_dst = IPv4(1,2,100,200), .ip_src = IPv4(5,6,7,254), .proto = 0x55, .vlan = 0x8000, .domain = 0x6464, .port_src = 12345, .port_dst = 8080, .allow = 10 }, /* should match 10 */ { .ip_dst = IPv4(5,6,7,254), .ip_src = IPv4(1,2,100,200), .proto = 0x55, .vlan = 0x8100, .domain = 0x6464, .port_src = 12345, .port_dst = 180, .allow = 10 }, /* should match 10 */ { .ip_dst = IPv4(1,10,20,30), .ip_src = IPv4(5,6,7,8), .proto = 0x55, .vlan = 0x64, .port_src = 12345, .port_dst = 180, .allow = 7 }, /* should match 7 */ { .ip_dst = IPv4(5,6,7,8), .ip_src = IPv4(1,10,20,30), .proto = 0x55, .vlan = 0x64, .port_src = 12345, .port_dst = 180, .allow = 7 }, /* should match 7 */ { .ip_dst = IPv4(2,2,3,4), .ip_src = IPv4(4,6,7,8), .proto = 0x55, .vlan = 0x64, .port_src = 12345, .port_dst = 180, .allow = 7 }, /* should match 7 */ { .ip_dst = IPv4(1,2,3,4), .ip_src = IPv4(4,6,7,8), .proto = 0x50, .vlan = 0x6466, .port_src = 12345, .port_dst = 12345, }, /* should not match */ }; #endif /* TEST_ACL_H_ */