From 005e7e00d0e9b9d4c0796c998b88d639ee316033 Mon Sep 17 00:00:00 2001 From: selias Date: Thu, 1 Dec 2016 10:11:53 +0100 Subject: HC Test: ACL updates - update low level ACL based on yang model changes - remove ietf-ACL test suite and test data and keywords - add ACL-plugin test suite, test data and keywords The ietf model of ACLs is no longer supported in Honeycomb. It has been replaced by the ACL plugin. Change-Id: Ic2c2a3e11c9717d1d3885275f6b868a0098343f9 Signed-off-by: selias --- resources/test_data/honeycomb/ietf_acl.py | 336 ------------------ resources/test_data/honeycomb/plugin_acl.py | 520 ++++++++++++++++++++++++++++ 2 files changed, 520 insertions(+), 336 deletions(-) delete mode 100644 resources/test_data/honeycomb/ietf_acl.py create mode 100644 resources/test_data/honeycomb/plugin_acl.py (limited to 'resources/test_data') diff --git a/resources/test_data/honeycomb/ietf_acl.py b/resources/test_data/honeycomb/ietf_acl.py deleted file mode 100644 index aaabfa49e2..0000000000 --- a/resources/test_data/honeycomb/ietf_acl.py +++ /dev/null @@ -1,336 +0,0 @@ -# Copyright (c) 2016 Cisco and/or its affiliates. -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at: -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -"""Test variables for ietf-ACL test suite.""" - - -def get_variables(test_case, name): - """Create and return a dictionary of test variables for the specified - test case. - - :param test_case: Determines which test variables to return. - :param name: Name for the classify chain used in test. - :type test_case: str - :type name: str - - :return: Dictionary of test variables - settings for Honeycomb's - ietf-acl node and packet fields to use in verification. - :rtype: dict - """ - - test_case = test_case.lower() - variables = { - # Variables for control packet, should always pass through DUT - "src_ip": "16.0.0.1", - "dst_ip": "16.0.1.1", - "dst_net": "16.0.1.0", - "src_port": "1234", - "dst_port": "1234", - "src_mac": "01:02:03:04:05:06", - "dst_mac": "10:20:30:40:50:60"} - - test_vars = { - "l2": { - # MACs classified directly - "classify_src": "12:23:34:45:56:67", - "classify_dst": "89:9A:AB:BC:CD:DE", - # MACs classified through mask - "classify_src2": "01:02:03:04:56:67", - "classify_dst2": "89:9A:AB:BC:50:60", - "src_mask": "00:00:00:00:FF:FF", - "dst_mask": "FF:FF:FF:FF:00:00" - }, - "l3_ip4": { - # IPs for DUT interface setup - "dut_to_tg_if1_ip": "16.0.0.2", - "dut_to_tg_if2_ip": "192.168.0.2", - "prefix_length": 24, - "gateway": "192.168.0.1", - # classified networks - "classify_src_net": "16.0.2.0", - "classify_dst_net": "16.0.3.0", - # IPs in classified networks - "classify_src": "16.0.2.1", - "classify_dst": "16.0.3.1", - }, - "l3_ip6": { - # Override control packet addresses with IPv6 - "src_ip": "10::1", - "dst_ip": "11::1", - "dst_net": "11::", - # IPs for DUT interface setup - "dut_to_tg_if1_ip": "10::2", - "dut_to_tg_if2_ip": "20::2", - "prefix_length": 64, - "gateway": "20::1", - # classified networks - "classify_src_net": "12::", - "classify_dst_net": "13::", - # IPs in classified networks - "classify_src": "12::1", - "classify_dst": "13::1", - }, - "l4": { - # IPs for DUT interface and route setup - "dut_to_tg_if1_ip": "16.0.0.2", - "dut_to_tg_if2_ip": "192.168.0.2", - "prefix_length": 24, - "gateway": "192.168.0.1", - "classify_dst_net": "16.0.3.0", - # Ports in classified ranges - "classify_src": 1500, - "classify_dst": 2000, - }, - "mixed": { - # IPs for DUT interface setup - "dut_to_tg_if1_ip": "16.0.0.2", - "dut_to_tg_if2_ip": "192.168.0.2", - "gateway": "192.168.0.1", - # classified networks - "classify_src_net": "16.0.2.0", - "classify_dst_net": "16.0.3.0", - # IPs in classified networks - "classify_src_ip": "16.0.2.1", - "classify_dst_ip": "16.0.3.1", - "prefix_length": 24, - # MACs classified through mask - "classify_src_mac": "01:02:03:04:56:67", - "classify_dst_mac": "89:9A:AB:BC:50:60", - "src_mask": "00:00:00:00:FF:FF", - "dst_mask": "FF:FF:FF:FF:00:00", - # classified ports - "classify_src_port": 1500, - "classify_dst_port": 2000, - }, - "multirule": { - # MACs classified by first rule - "classify_src": "12:23:34:45:56:67", - "classify_dst": "89:9A:AB:BC:CD:DE", - # MACs classified by second rule - "classify_src2": "01:02:03:04:56:67", - "classify_dst2": "89:9A:AB:BC:50:60", - # MAC rule masks - only match specific addresses - "src_mask": "FF:FF:FF:FF:FF:FF", - "dst_mask": "FF:FF:FF:FF:FF:FF", - } - } - acl_data = { - # ACL configuration for L2 tests - "l2": { - "acl": [{ - "acl-type": - "ietf-access-control-list:eth-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "source-mac-address": - test_vars["l2"]["classify_src"], - "source-mac-address-mask": - test_vars["l2"]["src_mask"], - "destination-mac-address": - test_vars["l2"]["classify_dst"], - "destination-mac-address-mask": - test_vars["l2"]["dst_mask"] - }, - "actions": { - "deny": {} - } - }]} - }] - }, - # ACL configuration for L3 IPv4 tests - "l3_ip4": { - "acl": [{ - "acl-type": - "ietf-access-control-list:ipv4-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "source-ipv4-network": - "{0}/{1}".format( - test_vars["l3_ip4"]["classify_src_net"], - test_vars["l3_ip4"]["prefix_length"]), - "destination-ipv4-network": - "{0}/{1}".format( - test_vars["l3_ip4"]["classify_dst_net"], - test_vars["l3_ip4"]["prefix_length"]), - "protocol": 17 - }, - "actions": { - "deny": {} - } - }]} - }] - }, - # ACL settings for L3 IPv6 tests - "l3_ip6": { - "acl": [{ - "acl-type": - "ietf-access-control-list:ipv6-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "source-ipv6-network": - "{0}/{1}".format( - test_vars["l3_ip6"]["classify_src_net"], - test_vars["l3_ip6"]["prefix_length"]), - "destination-ipv6-network": - "{0}/{1}".format( - test_vars["l3_ip6"]["classify_dst_net"], - test_vars["l3_ip6"]["prefix_length"]), - "protocol": 17 - }, - "actions": { - "deny": {} - } - }]} - }] - }, - # ACL configuration for L4 tests - "l4": { - "acl": [{ - "acl-type": - "vpp-acl:mixed-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "destination-ipv4-network": "0.0.0.0/0", - "destination-port-range": { - "lower-port": test_vars["l4"]["classify_dst"], - "upper-port": test_vars["l4"]["classify_dst"] + 50 - }, - "source-port-range": { - "lower-port": test_vars["l4"]["classify_src"], - "upper-port": test_vars["l4"]["classify_src"] + 50 - } - }, - "actions": { - "deny": {} - } - }]} - }] - }, - "mixed": { - "acl": [{ - "acl-type": - "vpp-acl:mixed-acl", - "acl-name": name, - "access-list-entries": {"ace": [{ - "rule-name": "rule1", - "matches": { - "vpp-acl:source-mac-address": - test_vars["mixed"]["classify_src_mac"], - "vpp-acl:source-mac-address-mask": - test_vars["mixed"]["src_mask"], - "vpp-acl:destination-mac-address": - test_vars["mixed"]["classify_dst_mac"], - "vpp-acl:destination-mac-address-mask": - test_vars["mixed"]["dst_mask"], - "vpp-acl:source-ipv4-network": - "{0}/{1}".format( - test_vars["mixed"]["classify_src_net"], - test_vars["mixed"]["prefix_length"]), - "vpp-acl:destination-ipv4-network": - "{0}/{1}".format( - test_vars["mixed"]["classify_dst_net"], - test_vars["mixed"]["prefix_length"]), - "vpp-acl:protocol": 17, - "vpp-acl:destination-port-range": { - "lower-port": test_vars["l4"]["classify_dst"], - "upper-port": test_vars["l4"]["classify_dst"] + 50 - }, - "vpp-acl:source-port-range": { - "lower-port": test_vars["l4"]["classify_src"], - "upper-port": test_vars["l4"]["classify_src"] + 50 - } - }, - "actions": { - "deny": {} - } - }]} - }] - }, - "multirule": { - "acl": [{ - "acl-type": - "ietf-access-control-list:eth-acl", - "acl-name": name, - "access-list-entries": {"ace": [ - { - "rule-name": "rule1", - "matches": { - "source-mac-address": - test_vars["multirule"]["classify_src"], - "source-mac-address-mask": - test_vars["multirule"]["src_mask"], - "destination-mac-address": - test_vars["multirule"]["classify_dst"], - "destination-mac-address-mask": - test_vars["multirule"]["dst_mask"] - }, - "actions": { - "deny": {} - } - }, - { - "rule-name": "rule2", - "matches": { - "source-mac-address": - test_vars["multirule"]["classify_src2"], - "source-mac-address-mask": - test_vars["multirule"]["src_mask"], - "destination-mac-address": - test_vars["multirule"]["classify_dst2"], - "destination-mac-address-mask": - test_vars["multirule"]["dst_mask"] - }, - "actions": { - "deny": {} - } - }, - { - "rule-name": "rule3", - "matches": { - "source-mac-address": - variables["src_mac"], - "source-mac-address-mask": - test_vars["multirule"]["src_mask"], - "destination-mac-address": - variables["dst_mac"], - "destination-mac-address-mask": - test_vars["multirule"]["dst_mask"] - }, - "actions": { - "permit": {} - } - } - ]} - }] - } - } - try: - ret_vars = {} - ret_vars.update(variables) - ret_vars.update(test_vars[test_case]) - ret_vars.update( - {"acl_settings": acl_data[test_case]} - ) - except KeyError: - raise Exception("Unrecognized test case {0}." - " Valid options are: {1}".format( - test_case, acl_data.keys())) - return ret_vars diff --git a/resources/test_data/honeycomb/plugin_acl.py b/resources/test_data/honeycomb/plugin_acl.py new file mode 100644 index 0000000000..d9d2ecd90f --- /dev/null +++ b/resources/test_data/honeycomb/plugin_acl.py @@ -0,0 +1,520 @@ +# Copyright (c) 2017 Cisco and/or its affiliates. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Test variables for ACL-plugin test suite.""" + + +def get_variables(test_case, name): + """Create and return a dictionary of test variables for the specified + test case. + + :param test_case: Determines which test variables to return. + :param name: Name for the classify chain used in test. + :type test_case: str + :type name: str + + :returns: Dictionary of test variables - settings for Honeycomb's + ietf-acl node and packet fields to use in verification. + :rtype: dict + :raises KeyError: If the test_case parameter is incorrect. + """ + + test_case = test_case.lower() + variables = { + # Variables for control packet + "src_ip": "16.0.0.1", + "dst_ip": "16.0.1.1", + "dst_net": "16.0.1.0", + "src_port": "1234", + "dst_port": "1234", + "src_mac": "01:02:03:04:05:06", + "dst_mac": "10:20:30:40:50:60"} + + test_vars = { + "macip": { + # MACs classified directly + "classify_src": "12:23:34:45:56:67", + "classify_dst": "89:9A:AB:BC:CD:DE", + # MACs classified through mask + "classify_src2": "01:02:03:04:56:67", + "classify_dst2": "89:9A:AB:BC:50:60", + "src_mask": "00:00:00:00:FF:FF", + "dst_mask": "FF:FF:FF:FF:00:00" + }, + "l3_ip4": { + # IPs for DUT interface setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + # classified networks + "classify_src_net": "16.0.2.0", + "classify_dst_net": "16.0.3.0", + # IPs in classified networks + "classify_src": "16.0.2.1", + "classify_dst": "16.0.3.1", + }, + "l3_ip6": { + # Override control packet addresses with IPv6 + "src_ip": "10::1", + "dst_ip": "11::1", + "dst_net": "11::", + # IPs for DUT interface setup + "dut_to_tg_if1_ip": "10::2", + "dut_to_tg_if2_ip": "20::2", + "prefix_length": 64, + "gateway": "20::1", + # classified networks + "classify_src_net": "12::", + "classify_dst_net": "13::", + # IPs in classified networks + "classify_src": "12::1", + "classify_dst": "13::1", + }, + "l4": { + # IPs for DUT interface and route setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + "classify_dst_net": "16.0.3.0", + # Ports in classified ranges + "classify_src": 60000, + "classify_dst": 61000, + }, + "mixed": { + # IPs for DUT interface and route setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + "classify_dst_net": "16.0.3.0", + # IPs in classified networks + "classify_src_ip": "16.0.2.1", + "classify_dst_ip": "16.0.3.1", + # Ports in classified ranges + "classify_src_port": 60000, + "classify_dst_port": 61000, + }, + "icmp": { + # ICMP code and type for control packet + "icmp_type": 0, + "icmp_code": 0, + # classified ICMP code and type + "classify_type": 3, + "classify_code": 3 + + }, + "icmpv6": { + # Override control packet addresses with IPv6 + "src_ip": "10::1", + "dst_ip": "11::1", + "dst_net": "11::", + # ICMP code and type for control packet + "icmp_type": 1, + "icmp_code": 0, + # classified ICMP code and type + "classify_type": 4, + "classify_code": 2 + + }, + "reflex": { + # IPs for DUT interface setup + "dut_to_tg_if1_ip": "16.0.0.2", + "dut_to_tg_if2_ip": "192.168.0.2", + "prefix_length": 24, + "gateway": "192.168.0.1", + "gateway2": "192.168.0.1", + # classified networks + "classify_src_net": "16.0.2.0", + "classify_dst_net": "16.0.3.0", + # IPs in classified networks + "classify_src": "16.0.2.1", + "classify_dst": "16.0.3.1", + }, + "block_all": {} + } + acl_data = { + # ACL configuration for L2 tests + "macip": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-macip-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-macip-ace-nodes": { + "source-mac-address": + test_vars["macip"]["classify_src"], + "source-mac-address-mask": + test_vars["macip"]["src_mask"], + "source-ipv4-network": "16.0.0.0/24" + } + }, + "actions": { + "deny": {} + } + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-macip-ace-nodes": { + "source-mac-address": + test_vars["macip"]["classify_src"], + "source-mac-address-mask": "00:00:00:00:00:00", + "source-ipv4-network": "0.0.0.0/0" + } + }, + "actions": { + "permit": {} + } + }, + ]} + }] + }, + # ACL configuration for L3 IPv4 tests + "l3_ip4": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": + "{0}/{1}".format( + test_vars["l3_ip4"]["classify_src_net"], + test_vars["l3_ip4"]["prefix_length"]), + "destination-ipv4-network": + "{0}/{1}".format( + test_vars["l3_ip4"]["classify_dst_net"], + test_vars["l3_ip4"]["prefix_length"]), + "udp-nodes": { + "source-port-range": { + "lower-port": "0", + "upper-port": "65535" + }, + "destination-port-range": { + "lower-port": "0", + "upper-port": "65535" + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + # ACL settings for L3 IPv6 tests + "l3_ip6": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "source-ipv6-network": + "{0}/{1}".format( + test_vars["l3_ip6"]["classify_src_net"], + test_vars["l3_ip6"]["prefix_length"]), + "destination-ipv6-network": + "{0}/{1}".format( + test_vars["l3_ip6"]["classify_dst_net"], + test_vars["l3_ip6"]["prefix_length"]), + "udp-nodes": { + "source-port-range": { + "lower-port": "0", + "upper-port": "65535" + }, + "destination-port-range": { + "lower-port": "0", + "upper-port": "65535" + } + } + } + }, + "actions": { + "deny": {} + } + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv6-network": "0::0/0", + "destination-ipv6-network": "0::0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + # ACL configuration for L4 tests + "l4": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [{ + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "tcp-nodes": { + "destination-port-range": { + "lower-port": + test_vars["l4"]["classify_dst"], + "upper-port": + test_vars["l4"]["classify_dst"] + 10 + }, + "source-port-range": { + "lower-port": + test_vars["l4"]["classify_src"], + "upper-port": + test_vars["l4"]["classify_src"] + 10 + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "mixed": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [{ + "rule-name": "ports", + "matches": { + "vpp-ace-nodes": { + "tcp-nodes": { + "destination-port-range": { + "lower-port": + test_vars["l4"]["classify_dst"], + "upper-port": + test_vars["l4"]["classify_dst"] + 10 + }, + "source-port-range": { + "lower-port": + test_vars["l4"]["classify_src"], + "upper-port": + test_vars["l4"]["classify_src"] + 10 + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "icmp": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "icmp-nodes": { + "icmp-type-range": { + "first": "1", + "last": "5" + }, + "icmp-code-range": { + "first": "1", + "last": "5" + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "icmpv6": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "icmp-v6-nodes": { + "icmp-type-range": { + "first": "1", + "last": "5" + }, + "icmp-code-range": { + "first": "1", + "last": "5" + } + } + } + }, + "actions": { + "deny": {} + }, + }, + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv6-network": "0::0/0", + "destination-ipv6-network": "0::0/0", + } + }, + "actions": { + "permit": {} + } + } + ]} + }] + }, + "reflex": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule1", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": + "{0}/{1}".format( + test_vars["reflex"]["classify_dst_net"], + test_vars["reflex"]["prefix_length"]), + "destination-ipv4-network": + "{0}/{1}".format( + test_vars["reflex"]["classify_src_net"], + test_vars["reflex"]["prefix_length"]), + } + }, + "actions": { + # TODO: will be renamed in HC2VPP-57 + "vpp-acl:permit": {} + }, + }, + ]} + }] + }, + "block_all": { + "acl": [{ + "acl-type": + "vpp-acl:vpp-acl", + "acl-name": name, + "access-list-entries": {"ace": [ + { + "rule-name": "rule_all", + "matches": { + "vpp-ace-nodes": { + "source-ipv4-network": "0.0.0.0/0", + "destination-ipv4-network": "0.0.0.0/0", + } + }, + "actions": { + "deny": {} + } + } + ]} + }] + }, + } + + try: + ret_vars = {} + ret_vars.update(variables) + ret_vars.update(test_vars[test_case]) + ret_vars.update( + {"acl_settings": acl_data[test_case]} + ) + except KeyError: + raise KeyError( + "Unrecognized test case {0}. Valid options are: {1}".format( + test_case, acl_data.keys())) + return ret_vars -- cgit 1.2.3-korg