From cf3451aa75baa207fee905096a805e8cd0946062 Mon Sep 17 00:00:00 2001 From: Maciek Konstantynowicz Date: Mon, 20 Jun 2016 06:39:15 -0700 Subject: iSuite: cop. Files: cop_whitelist_blacklist.robot, cop_whitelist_blacklist_IPv6.robot. Updates test cases documentation. Change-Id: I08a5cb0d64a0e02e72e0fbb3e59d8b9e34adde93 Signed-off-by: Maciek Konstantynowicz Conflicts: tests/suites/cop/cop_whitelist_blacklist.robot tests/suites/cop/cop_whitelist_blacklist_IPv6.robot Change-Id: I08a5cb0d64a0e02e72e0fbb3e59d8b9e34adde93 Signed-off-by: Jan Gelety --- tests/suites/cop/cop_whitelist_blacklist.robot | 38 +++++++++++++++------- .../suites/cop/cop_whitelist_blacklist_IPv6.robot | 38 +++++++++++++++------- 2 files changed, 54 insertions(+), 22 deletions(-) diff --git a/tests/suites/cop/cop_whitelist_blacklist.robot b/tests/suites/cop/cop_whitelist_blacklist.robot index 00267bf29b..c83b5e109b 100644 --- a/tests/suites/cop/cop_whitelist_blacklist.robot +++ b/tests/suites/cop/cop_whitelist_blacklist.robot @@ -27,13 +27,18 @@ | ... | AND | Update All Interface Data On All Nodes | ${nodes} | Test Setup | Clear interface counters on all vpp nodes in topology | ${nodes} | Test Teardown | Show packet trace on all DUTs | ${nodes} -| Documentation | *COP Blacklist and Whitelist Tests* +| Documentation | *COP Security IPv4 Blacklist and Whitelist Tests* | ... -| ... | Test suite uses 3-node topology TG - DUT1 - DUT2 - TG -| ... | with one link between nodes where DUT2 has xconnect. -| ... | Test packets are sent only in one direction with COP set either as -| ... | whitelist or blacklist. Subsequently, packet's IP src/dst and -| ... | MAC addresses are checked. +| ... | *[Top] Network Topologies:* TG-DUT1-DUT2-TG 3-node circular topology +| ... | with single links between nodes. +| ... | *[Enc] Packet Encapsulations:* Eth-IPv4-ICMPv4 on all links. +| ... | *[Cfg] DUT configuration:* DUT1 is configured with IPv4 routing and +| ... | static routes. COP security white-lists are applied on DUT1 ingress +| ... | interface from TG. DUT2 is configured with L2XC. +| ... | *[Ver] TG verification:* Test ICMPv4 Echo Request packets are sent in +| ... | one direction by TG on link to DUT1; on receive TG verifies packets for +| ... | correctness and drops as applicable. +| ... | *[Ref] Applicable standard specifications:* *** Variables *** | ${tg_node}= | ${nodes['TG']} @@ -56,8 +61,14 @@ | ${fib_table_number}= | 1 *** Test Cases *** -| VPP permits packets based on IPv4 src addr -| | [Documentation] | COP Whitelist test with basic setup. +| TC01: DUT permits IPv4 pkts with COP whitelist set with IPv4 src-addr +| | [Documentation] +| | ... | [Top] TG-DUT1-DUT2-TG. [Enc] Eth-IPv4-ICMPv4. [Cfg] On DUT1 \ +| | ... | configure interface IPv4 addresses and routes in the main +| | ... | routing domain, add COP whitelist on interface to TG with IPv4 +| | ... | src-addr matching packets generated by TG; on DUT2 configure L2 +| | ... | xconnect. [Ver] Make TG send ICMPv4 Echo Req on its interface to +| | ... | DUT1; verify received ICMPv4 Echo Req pkts are correct. [Ref] | | Given Path for 3-node testing is set | | ... | ${tg_node} | ${dut1_node} | ${dut2_node} | ${tg_node} | | And Interfaces in 3-node path are up @@ -83,9 +94,14 @@ | | ... | ${dut1_to_tg_mac} | ${tg_to_dut2} | ${dut1_to_dut2_mac} | | ... | ${tg_to_dut2_mac} - -| VPP drops packets based on IPv4 src addr -| | [Documentation] | COP blacklist test with basic setup. +| TC02: DUT drops IPv4 pkts with COP blacklist set with IPv4 src-addr +| | [Documentation] +| | ... | [Top] TG-DUT1-DUT2-TG. [Enc] Eth-IPv4-ICMPv4. [Cfg] On DUT1 \ +| | ... | configure interface IPv4 addresses and routes in the main +| | ... | routing domain, add COP blacklist on interface to TG with IPv4 +| | ... | src-addr matching packets generated by TG; on DUT2 configure L2 +| | ... | xconnect. [Ver] Make TG send ICMPv4 Echo Req on its interface to +| | ... | DUT1; verify no ICMPv4 Echo Req pkts are received. [Ref] | | Given Path for 3-node testing is set | | ... | ${tg_node} | ${dut1_node} | ${dut2_node} | ${tg_node} | | And Interfaces in 3-node path are up diff --git a/tests/suites/cop/cop_whitelist_blacklist_IPv6.robot b/tests/suites/cop/cop_whitelist_blacklist_IPv6.robot index cb3871cd07..054e376789 100644 --- a/tests/suites/cop/cop_whitelist_blacklist_IPv6.robot +++ b/tests/suites/cop/cop_whitelist_blacklist_IPv6.robot @@ -27,13 +27,18 @@ | ... | AND | Update All Interface Data On All Nodes | ${nodes} | Test Setup | Clear interface counters on all vpp nodes in topology | ${nodes} | Test Teardown | Show packet trace on all DUTs | ${nodes} -| Documentation | *COP Blacklist and Whitelist Tests* +| Documentation | *COP Security IPv6 Blacklist and Whitelist Tests* | ... -| ... | Test suite uses 3-node topology TG - DUT1 - DUT2 - TG -| ... | with one link between nodes where DUT2 has xconnect. -| ... | Test packets are sent only in one direction with COP set either as -| ... | whitelist or blacklist. Subsequently, packet's IP src/dst and -| ... | MAC addresses are checked. +| ... | *[Top] Network Topologies:* TG-DUT1-DUT2-TG 3-node circular topology +| ... | with single links between nodes. +| ... | *[Enc] Packet Encapsulations:* Eth-IPv6-ICMPv6 on all links. +| ... | *[Cfg] DUT configuration:* DUT1 is configured with IPv6 routing and +| ... | static routes. COP security white-lists are applied on DUT1 ingress +| ... | interface from TG. DUT2 is configured with L2XC. +| ... | *[Ver] TG verification:* Test ICMPv6 Echo Request packets are sent in +| ... | one direction by TG on link to DUT1; on receive TG verifies packets for +| ... | correctness and drops as applicable. +| ... | *[Ref] Applicable standard specifications:* *** Variables *** | ${tg_node}= | ${nodes['TG']} @@ -60,8 +65,14 @@ | ${fib_table_number}= | 1 *** Test Cases *** -| VPP permits packets based on IPv6 src addr -| | [Documentation] | COP Whitelist test with basic setup. +| TC01: DUT permits IPv6 pkts with COP whitelist set with IPv6 src-addr +| | [Documentation] +| | ... | [Top] TG-DUT1-DUT2-TG. [Enc] Eth-IPv6-ICMPv6. [Cfg] On DUT1 \ +| | ... | configure interface IPv6 addresses and routes in the main +| | ... | routing domain, add COP whitelist on interface to TG with IPv6 +| | ... | src-addr matching packets generated by TG; on DUT2 configure L2 +| | ... | xconnect. [Ver] Make TG send ICMPv6 Echo Req on its interface to +| | ... | DUT1; verify received ICMPv6 Echo Req pkts are correct. [Ref] | | Given Path for 3-node testing is set | | ... | ${tg_node} | ${dut1_node} | ${dut2_node} | ${tg_node} | | And Interfaces in 3-node path are up @@ -92,9 +103,14 @@ | | ... | ${dut1_to_tg_mac} | ${tg_to_dut2} | ${dut1_to_dut2_mac} | | ... | ${tg_to_dut2_mac} - -| VPP drops packets based on IPv6 src addr -| | [Documentation] | COP blacklist test with basic setup. +| TC02: DUT drops IPv6 pkts with COP blacklist set with IPv6 src-addr +| | [Documentation] +| | ... | [Top] TG-DUT1-DUT2-TG. [Enc] Eth-IPv6-ICMPv6. [Cfg] On DUT1 \ +| | ... | configure interface IPv6 addresses and routes in the main +| | ... | routing domain, add COP blacklist on interface to TG with IPv6 +| | ... | src-addr matching packets generated by TG; on DUT2 configure L2 +| | ... | xconnect. [Ver] Make TG send ICMPv6 Echo Req on its interface to +| | ... | DUT1; verify no ICMPv6 Echo Req pkts are received. [Ref] | | Given Path for 3-node testing is set | | ... | ${tg_node} | ${dut1_node} | ${dut2_node} | ${tg_node} | | And Interfaces in 3-node path are up -- cgit 1.2.3-korg