diff options
7 files changed, 309 insertions, 106 deletions
diff --git a/resources/libraries/python/HTTPRequest.py b/resources/libraries/python/HTTPRequest.py index 567ac791b7..1f5df52c01 100644 --- a/resources/libraries/python/HTTPRequest.py +++ b/resources/libraries/python/HTTPRequest.py @@ -32,6 +32,7 @@ from requests.auth import HTTPBasicAuth class HTTPCodes(IntEnum): """HTTP status codes""" OK = 200 + ACCEPTED = 201 UNAUTHORIZED = 401 FORBIDDEN = 403 NOT_FOUND = 404 diff --git a/resources/libraries/python/honeycomb/HcAPIKwACL.py b/resources/libraries/python/honeycomb/HcAPIKwACL.py index a69ab460f6..375820283b 100644 --- a/resources/libraries/python/honeycomb/HcAPIKwACL.py +++ b/resources/libraries/python/honeycomb/HcAPIKwACL.py @@ -60,7 +60,7 @@ class ACLKeywords(object): status_code, resp = HcUtil.\ delete_honeycomb_data(node, "config_classify_table", path) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "The configuration of classify table was not successful. " "Status code: {0}.".format(status_code)) @@ -287,8 +287,6 @@ class ACLKeywords(object): "l3_ip6": "ipv6", "mixed": "mixed" } - if layer == "l4": - raise NotImplementedError try: suffix = suffix_dict[layer] except KeyError: @@ -306,7 +304,7 @@ class ACLKeywords(object): status_code, resp = HcUtil.put_honeycomb_data( node, "config_ietf_classify_chain", data, path) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "Could not create classify chain." "Status code: {0}.".format(status_code)) @@ -368,31 +366,28 @@ class ACLKeywords(object): "mixed": {"mode": mode, "acl_type": types['vpp'].format("mixed")} } - if layer == "L4": - raise NotImplementedError - else: - try: - data = { - "access-lists": { - "acl": [ - { - "type": layers[layer]['acl_type'], - "name": list_name - } - ], - "default-action": default_action, - "mode": layers[layer]['mode'] - } + try: + data = { + "access-lists": { + "acl": [ + { + "type": layers[layer]['acl_type'], + "name": list_name + } + ], + "default-action": default_action, + "mode": layers[layer]['mode'] } - except KeyError: - raise ValueError("Unknown network layer {0}. " - "Valid options are: {1}".format( - layer, layers.keys())) + } + except KeyError: + raise ValueError("Unknown network layer {0}. " + "Valid options are: {1}".format( + layer, layers.keys())) status_code, resp = HcUtil.put_honeycomb_data( node, "config_vpp_interfaces", data, path) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "Could not configure ACL on interface. " "Status code: {0}.".format(status_code)) diff --git a/resources/libraries/python/honeycomb/HcAPIKwBridgeDomain.py b/resources/libraries/python/honeycomb/HcAPIKwBridgeDomain.py index f156f096e3..38d5324da7 100644 --- a/resources/libraries/python/honeycomb/HcAPIKwBridgeDomain.py +++ b/resources/libraries/python/honeycomb/HcAPIKwBridgeDomain.py @@ -61,7 +61,7 @@ class BridgeDomainKeywords(object): status_code, resp = HcUtil.\ put_honeycomb_data(node, "config_bridge_domain", data, data_representation=data_representation) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "The configuration of bridge domain '{0}' was not successful. " "Status code: {1}.".format(bd_name, status_code)) @@ -90,7 +90,7 @@ class BridgeDomainKeywords(object): status_code, resp = HcUtil.\ get_honeycomb_data(node, "config_bridge_domain") - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "Not possible to get configuration information about the " "bridge domains. Status code: {0}.".format(status_code)) diff --git a/resources/libraries/python/honeycomb/HcAPIKwInterfaces.py b/resources/libraries/python/honeycomb/HcAPIKwInterfaces.py index 83267b5e55..506db69720 100644 --- a/resources/libraries/python/honeycomb/HcAPIKwInterfaces.py +++ b/resources/libraries/python/honeycomb/HcAPIKwInterfaces.py @@ -92,7 +92,7 @@ class InterfaceKeywords(object): status_code, resp = HcUtil.\ put_honeycomb_data(node, "config_vpp_interfaces", data, data_representation=data_representation) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "The configuration of interface '{0}' was not successful. " "Status code: {1}.".format(interface, status_code)) @@ -255,7 +255,7 @@ class InterfaceKeywords(object): status_code, resp = HcUtil. \ put_honeycomb_data(node, "config_vpp_interfaces", resp, path, data_representation=DataRepresentation.JSON) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "The configuration of interface '{0}' was not successful. " "Status code: {1}.".format(interface, status_code)) @@ -1407,7 +1407,7 @@ class InterfaceKeywords(object): status_code, resp = HcUtil.\ put_honeycomb_data(node, "config_vpp_interfaces", data, path, data_representation=DataRepresentation.JSON) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "The configuration of interface '{0}' was not successful. " "Status code: {1}.".format(interface, status_code)) @@ -1466,7 +1466,7 @@ class InterfaceKeywords(object): status_code, resp = HcUtil. \ put_honeycomb_data(node, "config_vpp_interfaces", params, path, data_representation=DataRepresentation.JSON) - if status_code != HTTPCodes.OK: + if status_code not in (HTTPCodes.OK, HTTPCodes.ACCEPTED): raise HoneycombError( "The configuration of PBB sub-interface '{0}' was not " "successful. Status code: {1}.".format(intf, status_code)) diff --git a/resources/libraries/robot/honeycomb/access_control_lists.robot b/resources/libraries/robot/honeycomb/access_control_lists.robot index 5c60af30ab..7072f597c4 100644 --- a/resources/libraries/robot/honeycomb/access_control_lists.robot +++ b/resources/libraries/robot/honeycomb/access_control_lists.robot @@ -172,7 +172,7 @@ | | ... | \| ACL table from VAT should not exist \| ${nodes['DUT1']} \ | | ... | \| ${0} \| | | [Arguments] | ${node} | ${table_index} -| | Run keyword and expect error | No JSON data. +| | Run keyword and expect error | VAT: no JSON data. | | ... | Get classify table data | ${node} | ${table_index} | ACL session from Honeycomb should be diff --git a/resources/test_data/honeycomb/ietf_acl.py b/resources/test_data/honeycomb/ietf_acl.py index 6f785acf2e..aaabfa49e2 100644 --- a/resources/test_data/honeycomb/ietf_acl.py +++ b/resources/test_data/honeycomb/ietf_acl.py @@ -54,6 +54,7 @@ def get_variables(test_case, name): # IPs for DUT interface setup "dut_to_tg_if1_ip": "16.0.0.2", "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, "gateway": "192.168.0.1", # classified networks "classify_src_net": "16.0.2.0", @@ -61,7 +62,6 @@ def get_variables(test_case, name): # IPs in classified networks "classify_src": "16.0.2.1", "classify_dst": "16.0.3.1", - "prefix_length": 24 }, "l3_ip6": { # Override control packet addresses with IPv6 @@ -71,6 +71,7 @@ def get_variables(test_case, name): # IPs for DUT interface setup "dut_to_tg_if1_ip": "10::2", "dut_to_tg_if2_ip": "20::2", + "prefix_length": 64, "gateway": "20::1", # classified networks "classify_src_net": "12::", @@ -78,7 +79,17 @@ def get_variables(test_case, name): # IPs in classified networks "classify_src": "12::1", "classify_dst": "13::1", - "prefix_length": 64 + }, + "l4": { + # IPs for DUT interface and route setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + "classify_dst_net": "16.0.3.0", + # Ports in classified ranges + "classify_src": 1500, + "classify_dst": 2000, }, "mixed": { # IPs for DUT interface setup @@ -96,7 +107,21 @@ def get_variables(test_case, name): "classify_src_mac": "01:02:03:04:56:67", "classify_dst_mac": "89:9A:AB:BC:50:60", "src_mask": "00:00:00:00:FF:FF", - "dst_mask": "FF:FF:FF:FF:00:00" + "dst_mask": "FF:FF:FF:FF:00:00", + # classified ports + "classify_src_port": 1500, + "classify_dst_port": 2000, + }, + "multirule": { + # MACs classified by first rule + "classify_src": "12:23:34:45:56:67", + "classify_dst": "89:9A:AB:BC:CD:DE", + # MACs classified by second rule + "classify_src2": "01:02:03:04:56:67", + "classify_dst2": "89:9A:AB:BC:50:60", + # MAC rule masks - only match specific addresses + "src_mask": "FF:FF:FF:FF:FF:FF", + "dst_mask": "FF:FF:FF:FF:FF:FF", } } acl_data = { @@ -174,6 +199,31 @@ def get_variables(test_case, name): }]} }] }, + # ACL configuration for L4 tests + "l4": { + "acl": [{ + "acl-type": + "vpp-acl:mixed-acl", + "acl-name": name, + "access-list-entries": {"ace": [{ + "rule-name": "rule1", + "matches": { + "destination-ipv4-network": "0.0.0.0/0", + "destination-port-range": { + "lower-port": test_vars["l4"]["classify_dst"], + "upper-port": test_vars["l4"]["classify_dst"] + 50 + }, + "source-port-range": { + "lower-port": test_vars["l4"]["classify_src"], + "upper-port": test_vars["l4"]["classify_src"] + 50 + } + }, + "actions": { + "deny": {} + } + }]} + }] + }, "mixed": { "acl": [{ "acl-type": @@ -198,22 +248,89 @@ def get_variables(test_case, name): "{0}/{1}".format( test_vars["mixed"]["classify_dst_net"], test_vars["mixed"]["prefix_length"]), - "vpp-acl:protocol": 17 + "vpp-acl:protocol": 17, + "vpp-acl:destination-port-range": { + "lower-port": test_vars["l4"]["classify_dst"], + "upper-port": test_vars["l4"]["classify_dst"] + 50 + }, + "vpp-acl:source-port-range": { + "lower-port": test_vars["l4"]["classify_src"], + "upper-port": test_vars["l4"]["classify_src"] + 50 + } }, "actions": { "deny": {} } }]} }] + }, + "multirule": { + "acl": [{ + "acl-type": + "ietf-access-control-list:eth-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "source-mac-address": + test_vars["multirule"]["classify_src"], + "source-mac-address-mask": + test_vars["multirule"]["src_mask"], + "destination-mac-address": + test_vars["multirule"]["classify_dst"], + "destination-mac-address-mask": + test_vars["multirule"]["dst_mask"] + }, + "actions": { + "deny": {} + } + }, + { + "rule-name": "rule2", + "matches": { + "source-mac-address": + test_vars["multirule"]["classify_src2"], + "source-mac-address-mask": + test_vars["multirule"]["src_mask"], + "destination-mac-address": + test_vars["multirule"]["classify_dst2"], + "destination-mac-address-mask": + test_vars["multirule"]["dst_mask"] + }, + "actions": { + "deny": {} + } + }, + { + "rule-name": "rule3", + "matches": { + "source-mac-address": + variables["src_mac"], + "source-mac-address-mask": + test_vars["multirule"]["src_mask"], + "destination-mac-address": + variables["dst_mac"], + "destination-mac-address-mask": + test_vars["multirule"]["dst_mask"] + }, + "actions": { + "permit": {} + } + } + ]} + }] } } try: - variables.update(test_vars[test_case]) - variables.update( + ret_vars = {} + ret_vars.update(variables) + ret_vars.update(test_vars[test_case]) + ret_vars.update( {"acl_settings": acl_data[test_case]} ) except KeyError: raise Exception("Unrecognized test case {0}." " Valid options are: {1}".format( test_case, acl_data.keys())) - return variables + return ret_vars diff --git a/tests/func/honeycomb/081_ietf_acl_traffic.robot b/tests/func/honeycomb/081_ietf_acl_traffic.robot index be6ea16947..93a0e70330 100644 --- a/tests/func/honeycomb/081_ietf_acl_traffic.robot +++ b/tests/func/honeycomb/081_ietf_acl_traffic.robot @@ -22,7 +22,9 @@ | ${acl_name_l2}= | acl_l2 | ${acl_name_l3_ip4}= | acl_l3_ip4 | ${acl_name_l3_ip6}= | acl_l3_ip6 +| ${acl_name_l4}= | acl_l4 | ${acl_name_mixed}= | acl_mixed +| ${acl_name_multirule}= | acl_multirule *** Settings *** | Resource | resources/libraries/robot/default.robot @@ -47,7 +49,7 @@ | Force Tags | Honeycomb_sanity *** Test Cases *** -| TC01: Honeycomb can configure L2 ACL MAC filtering through IETF-ACL node +| TC01: L2 ACL MAC filtering through IETF-ACL node | | [Documentation] | | ... | [Top] TG=DUT1=TG. | | ... | [Enc] Eth-IPv4-TCP. @@ -57,33 +59,69 @@ | | ... | using different MACs. Receive all packets except those with\ | | ... | MACs in the filtered ranges. | | [Teardown] | Run Keywords -| | ... | Clear IETF-ACL settings | ${node} | ${dut_to_tg_if1} | AND -| | ... | Show Packet Trace on All DUTs | ${nodes} | AND -| | ... | Honeycomb removes all bridge domains +| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Show Packet Trace On All DUTs | ${nodes} | AND +| | ... | Honeycomb Removes All Bridge Domains | | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} -| | Given Setup interfaces and bridge domain for ietf-ACL test +| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test | | ... | L2 | ${acl_name_l2} -| | When Honeycomb creates ACL chain through IETF node +| | When Honeycomb Creates ACL Chain Through IETF Node | | ... | ${dut_node} | ${acl_name_l2} | L2 | ${acl_settings} -| | And Honeycomb assigns IETF-ACL chain to interface +| | And Honeycomb Assigns IETF-ACL Chain To Interface | | ... | ${dut_node} | ${dut_to_tg_if1} | L2 | ingress | ${acl_name_l2} | | ... | permit -| | Then Send TCP or UDP packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} | | ... | ${tg_to_dut_if1} | ${src_mac} | | ... | ${tg_to_dut_if2} | ${dst_mac} | | ... | TCP | ${src_port} | ${dst_port} -| | And Run keyword and expect error | TCP/UDP Rx timeout -| | ... | Send TCP or UDP packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} | | ... | ${tg_to_dut_if1} | ${classify_src} | | ... | ${tg_to_dut_if2} | ${classify_dst} | | ... | TCP | ${src_port} | ${dst_port} -| | And Run keyword and expect error | TCP/UDP Rx timeout -| | ... | Send TCP or UDP packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} | | ... | ${tg_to_dut_if1} | ${classify_src2} | | ... | ${tg_to_dut_if2} | ${classify_dst2} | | ... | TCP | ${src_port} | ${dst_port} -| TC02: Honeycomb can configure L3 ACL IPv4 filtering through IETF-ACL node +| TC02: L2 ACL MAC filtering through IETF-ACL node on egress interface +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure L2 MAC ACL on egress interface. +| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ +| | ... | using different MACs. Receive all packets except those with\ +| | ... | MACs in the filtered ranges. +| | [Teardown] | Run Keywords +| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if2} | AND +| | ... | Show Packet Trace On All DUTs | ${nodes} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test +| | ... | L2 | ${acl_name_l2} +| | When Honeycomb Creates ACL Chain Through IETF Node +| | ... | ${dut_node} | ${acl_name_l2} | L2 | ${acl_settings} +| | And Honeycomb Assigns IETF-ACL Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if2} | L2 | egress | ${acl_name_l2} +| | ... | permit +| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${classify_src} +| | ... | ${tg_to_dut_if2} | ${classify_dst} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${classify_src2} +| | ... | ${tg_to_dut_if2} | ${classify_dst2} +| | ... | TCP | ${src_port} | ${dst_port} + +| TC03: L3 ACL IPv4 filtering through IETF-ACL node | | [Documentation] | | ... | [Top] TG=DUT1=TG. | | ... | [Enc] Eth-IPv4-TCP. @@ -93,31 +131,31 @@ | | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ | | ... | to the other, using different IPv4 IPs. Receive all packets except\ | | ... | those with IPs in the filtered ranges and UDP protocol payload. -| | Given Setup interface IPs and routes for IPv4 ietf-ACL test +| | Given Setup Interface IPs And Routes For IPv4 IETF-ACL Test | | ... | L3_IP4 | ${acl_name_l3_ip4} -| | When Honeycomb creates ACL chain through IETF node +| | When Honeycomb Creates ACL Chain Through IETF Node | | ... | ${dut_node} | ${acl_name_l3_ip4} | L3_IP4 | ${acl_settings} -| | And Honeycomb assigns IETF-ACL chain to interface +| | And Honeycomb Assigns IETF-ACL Chain To Interface | | ... | ${dut_node} | ${dut_to_tg_if1} | L3_IP4 | ingress | ${acl_name_l3_ip4} | | ... | permit -| | Then Send TCP or UDP packet | ${tg_node} +| | Then Send TCP Or UDP Packet | ${tg_node} | | ... | ${src_ip} | ${dst_ip} | | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} | | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} | | ... | UDP | ${src_port} | ${dst_port} -| | And Send TCP or UDP packet | ${tg_node} +| | And Send TCP Or UDP Packet | ${tg_node} | | ... | ${classify_src} | ${classify_dst} | | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} | | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} | | ... | TCP | ${src_port} | ${dst_port} -| | And Run keyword and expect error | TCP/UDP Rx timeout -| | ... | Send TCP or UDP packet | ${tg_node} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | | ... | ${classify_src} | ${classify_dst} | | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} | | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} | | ... | UDP | ${src_port} | ${dst_port} -| TC03: Honeycomb can configure L3 ACL IPv6 filtering through IETF-ACL node +| TC04: L3 ACL IPv6 filtering through IETF-ACL node | | [Documentation] | | ... | [Top] TG=DUT1=TG. | | ... | [Enc] Eth-IPv4-TCP. @@ -146,104 +184,156 @@ | | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False | | And VPP Route Add | ${node} | ${classify_dst_net} | ${prefix_length} | | ... | ${gateway} | interface=${dut_to_tg_if2} | use_sw_index=False -| | When Honeycomb creates ACL chain through IETF node +| | When Honeycomb Creates ACL Chain Through IETF Node | | ... | ${dut_node} | ${acl_name_l3_ip6} | L3_IP6 | ${acl_settings} -| | And Honeycomb assigns IETF-ACL chain to interface +| | And Honeycomb Assigns IETF-ACL Chain To Interface | | ... | ${dut_node} | ${dut_to_tg_if1} | L3_IP6 | ingress | ${acl_name_l3_ip6} | | ... | permit -| | Then Send TCP or UDP packet | ${tg_node} +| | Then Send TCP Or UDP Packet | ${tg_node} | | ... | ${src_ip} | ${dst_ip} | | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} | | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} | | ... | UDP | ${src_port} | ${dst_port} -| | And Send TCP or UDP packet | ${tg_node} +| | And Send TCP Or UDP Packet | ${tg_node} | | ... | ${classify_src} | ${classify_dst} | | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} | | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} | | ... | TCP | ${src_port} | ${dst_port} -| | And Run keyword and expect error | TCP/UDP Rx timeout -| | ... | Send TCP or UDP packet | ${tg_node} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | | ... | ${classify_src} | ${classify_dst} | | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} | | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} | | ... | UDP | ${src_port} | ${dst_port} -| TC04: Honeycomb can configure L2 and L3 ACL on L2-mode interface +| TC05: L4 ACL port filtering through IETF-ACL node +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ +| | ... | interfaces to TG, add ARP entry and routes, and configure L4 port ACL\ +| | ... | on ingress interface with src/dst port ranges. +| | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ +| | ... | to the other, using different ports. Receive all packets except\ +| | ... | those with ports in the filtered ranges. +| | Given Setup Interface IPs And Routes For IPv4 IETF-ACL Test +| | ... | L4 | ${acl_name_l4} +| | When Honeycomb Creates ACL Chain Through IETF Node +| | ... | ${dut_node} | ${acl_name_l4} | mixed | ${acl_settings} +| | And Honeycomb Assigns IETF-ACL Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | mixed | ingress | ${acl_name_l4} +| | ... | permit | L3 +| | Then Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} +| | ... | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} +| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} +| | ... | TCP | ${classify_src} | ${classify_dst} + +| TC06: L2,L3 and L4 ACL together on L2-mode interface | | [Documentation] | | ... | [Top] TG=DUT1=TG. | | ... | [Enc] Eth-IPv4-TCP. | | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ -| | ... | and configure L2 and L3 ACL on ingress interface\ -| | ... | with src/dst MAC, src/dst IP and protocol. +| | ... | and configure L2, L3 and L4 ACL on ingress interface\ +| | ... | with src/dst MAC, src/dst IP, protocol and src/dst port ranges. | | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ -| | ... | to the other, using different MACs and IPv4 IPs. Receive all packets\ -| | ... | except those with MACs and IPs in the filtered ranges and UDP\ -| | ... | protocol payload. +| | ... | to the other, using different MACs, IPv4 IPs and ports. Receive\ +| | ... | all packets except those with MACs, IPs and ports in the filtered\ +| | ... | ranges and UDP protocol payload. | | [Teardown] | Run Keywords -| | ... | Clear IETF-ACL settings | ${node} | ${dut_to_tg_if1} | AND -| | ... | Show Packet Trace on All DUTs | ${nodes} | AND -| | ... | Honeycomb removes all bridge domains +| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Show Packet Trace On All DUTs | ${nodes} | AND +| | ... | Honeycomb Removes All Bridge Domains | | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} -| | Given Setup interfaces and bridge domain for ietf-ACL test +| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test | | ... | mixed | ${acl_name_mixed} -| | When Honeycomb creates ACL chain through IETF node +| | When Honeycomb Creates ACL Chain Through IETF Node | | ... | ${dut_node} | ${acl_name_mixed} | mixed | ${acl_settings} -| | And Honeycomb assigns IETF-ACL chain to interface +| | And Honeycomb Assigns IETF-ACL Chain To Interface | | ... | ${dut_node} | ${dut_to_tg_if1} | mixed | ingress | ${acl_name_mixed} | | ... | permit | L2 -| | Then Send TCP or UDP packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} | | ... | ${tg_to_dut_if1} | ${classify_src_mac} | | ... | ${tg_to_dut_if2} | ${classify_dst_mac} | | ... | TCP | ${src_port} | ${dst_port} -| | And Send TCP or UDP packet | ${tg_node} -| | ... | ${classify_src_ip} | ${classify_dst_ip} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | UDP | ${src_port} | ${dst_port} -| | And Run keyword and expect error | TCP/UDP Rx timeout -| | ... | Send TCP or UDP packet | ${tg_node} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | | ... | ${classify_src_ip} | ${classify_dst_ip} | | ... | ${tg_to_dut_if1} | ${classify_src_mac} | | ... | ${tg_to_dut_if2} | ${classify_dst_mac} -| | ... | UDP | ${src_port} | ${dst_port} +| | ... | UDP | ${classify_src_port} | ${classify_dst_port} -| TC05: Honeycomb can configure L2 and L3 ACL on L3-mode interface +| TC07: L2,L3 and L4 ACL together on L3-mode interface | | [Documentation] | | ... | [Top] TG=DUT1=TG. | | ... | [Enc] Eth-IPv4-TCP. | | ... | [Cfg] (Using Honeycomb API) On DUT1 set IPv4 addresses on both\ | | ... | interfaces to TG, add ARP entry and routes, and configure\ -| | ... | L2 and L3 ACL on ingress interface with src/dst MAC, src/dst IP\ -| | ... | and protocol. +| | ... | L2, L3 and L4 ACL on ingress interface with src/dst MAC, src/dst IP,\ +| | ... | protocol and src/dst port ranges. | | ... | [Ver] Send simple TCP and UDP packets from one TG interface\ -| | ... | to the other, using different MACs and IPv4 IPs. Receive all packets\ -| | ... | except those with MACs and IPs in the filtered ranges and UDP\ -| | ... | protocol payload. -| | Setup interface IPs and routes for IPv4 ietf-ACL test +| | ... | to the other, using different MACs, IPv4 IPs and ports. Receive\ +| | ... | all packets except those with MACs, IPs and ports in the filtered\ +| | ... | ranges and UDP protocol payload. +| | Setup Interface IPs And Routes For IPv4 IETF-ACL Test | | ... | mixed | ${acl_name_mixed} -| | When Honeycomb creates ACL chain through IETF node +| | When Honeycomb Creates ACL Chain Through IETF Node | | ... | ${dut_node} | ${acl_name_mixed} | mixed | ${acl_settings} -| | And Honeycomb assigns IETF-ACL chain to interface +| | And Honeycomb Assigns IETF-ACL Chain To Interface | | ... | ${dut_node} | ${dut_to_tg_if1} | mixed | ingress | ${acl_name_mixed} | | ... | permit | L3 -| | Then Send TCP or UDP packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} | | ... | ${tg_to_dut_if1} | ${classify_src_mac} | | ... | ${tg_to_dut_if2} | ${classify_dst_mac} | | ... | TCP | ${src_port} | ${dst_port} -| | And Send TCP or UDP packet | ${tg_node} -| | ... | ${classify_src_ip} | ${classify_dst_ip} -| | ... | ${tg_to_dut_if1} | ${tg_to_dut_if1_mac} -| | ... | ${tg_to_dut_if2} | ${dut_to_tg_if1_mac} -| | ... | UDP | ${src_port} | ${dst_port} -| | And Run keyword and expect error | TCP/UDP Rx timeout -| | ... | Send TCP or UDP packet | ${tg_node} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | | ... | ${classify_src_ip} | ${classify_dst_ip} | | ... | ${tg_to_dut_if1} | ${classify_src_mac} | | ... | ${tg_to_dut_if2} | ${classify_dst_mac} -| | ... | UDP | ${src_port} | ${dst_port} +| | ... | UDP | ${classify_src_port} | ${classify_dst_port} -# TODO: Test case for L4 ACL port-based filtering -# TODO: Test case for multiple classify rules and rule ordering +| TC08: Multiple classify rules in one ACL +| | [Documentation] +| | ... | [Top] TG=DUT1=TG. +| | ... | [Enc] Eth-IPv4-TCP. +| | ... | [Cfg] (Using Honeycomb API) On DUT1 bridge both interfaces to TG\ +| | ... | and configure a series of L2 MAC ACL rules on ingress interface. +| | ... | [Ver] Send simple TCP packets from one TG interface to the other,\ +| | ... | using different MACs. Receive all packets except those with\ +| | ... | MACs in the ranges filtered by any rule. +| | [Teardown] | Run Keywords +| | ... | Clear IETF-ACL Settings | ${node} | ${dut_to_tg_if1} | AND +| | ... | Show Packet Trace On All DUTs | ${nodes} | AND +| | ... | Honeycomb Removes All Bridge Domains +| | ... | ${node} | ${dut_to_tg_if1} | ${dut_to_tg_if2} +| | Given Setup Interfaces And Bridge Domain For IETF-ACL Test +| | ... | multirule | ${acl_name_multirule} +| | When Honeycomb Creates ACL Chain Through IETF Node +| | ... | ${dut_node} | ${acl_name_multirule} | L2 | ${acl_settings} +| | And Honeycomb Assigns IETF-ACL Chain To Interface +| | ... | ${dut_node} | ${dut_to_tg_if1} | L2 | ingress | ${acl_name_multirule} +| | ... | permit +| | Then Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${src_mac} +| | ... | ${tg_to_dut_if2} | ${dst_mac} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${classify_src} +| | ... | ${tg_to_dut_if2} | ${classify_dst} +| | ... | TCP | ${src_port} | ${dst_port} +| | And Run Keyword And Expect Error | TCP/UDP Rx timeout +| | ... | Send TCP Or UDP Packet | ${tg_node} | ${src_ip} | ${dst_ip} +| | ... | ${tg_to_dut_if1} | ${classify_src2} +| | ... | ${tg_to_dut_if2} | ${classify_dst2} +| | ... | TCP | ${src_port} | ${dst_port} *** Keywords *** | Setup interface IPs and routes for IPv4 ietf-ACL test |