diff options
| -rw-r--r-- | src/plugins/acl/acl.c | 346 | ||||
| -rw-r--r-- | src/plugins/acl/acl.h | 5 | ||||
| -rw-r--r-- | test/test_acl_plugin_macip.py | 722 | ||||
| -rw-r--r-- | test/vpp_papi_provider.py | 17 |
4 files changed, 820 insertions, 270 deletions
diff --git a/src/plugins/acl/acl.c b/src/plugins/acl/acl.c index 50e9557db38..dc7f1ebcdb5 100644 --- a/src/plugins/acl/acl.c +++ b/src/plugins/acl/acl.c @@ -318,12 +318,14 @@ acl_del_list (u32 acl_list_index) /* Some aids in ASCII graphing the content */ #define XX "\377" #define __ "\000" +#define DOT1AD "\210\250" +#define DOT1Q "\201\00" #define _(x) #define v u8 ip4_5tuple_mask[] = -_(" dmac smac etype ") -_(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v + _(" dmac smac etype ") + _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v _(" v ihl totlen ") _(0x0000) __ __ __ __ @@ -349,8 +351,8 @@ _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v _(padeth) __ __; - u8 ip6_5tuple_mask[] = - _(" dmac smac etype ") + u8 ip6_5tuple_mask[] = + _(" dmac smac etype ") _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v _(" v tc + flow ") _(0x0000) __ __ __ __ @@ -369,12 +371,29 @@ _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v _("L4T/U sport dport ") _(tcpudp) XX XX XX XX _(padpad) __ __ __ __ _(padeth) __ __; + u8 dot1q_5tuple_mask[] = + _(" dmac smac dot1q etype ") + _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v DOT1Q __ __ v XX XX v + _(padpad) __ __ __ __ + _(padpad) __ __ __ __ + _(padpad) __ __ __ __ + _(padeth) __ __; + + u8 dot1ad_5tuple_mask[] = + _(" dmac smac dot1ad etype ") + _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v DOT1AD __ __ DOT1Q __ __ v XX XX v + _(padpad) __ __ __ __ + _(padpad) __ __ __ __ + _(padeth) __ __; + #undef XX #undef __ +#undef DOT1AD +#undef DOT1Q #undef _ #undef v - static int count_skip (u8 * p, u32 size) +static int count_skip (u8 * p, u32 size) { u64 *p64 = (u64 *) p; /* Be tolerant to null pointer */ @@ -443,19 +462,24 @@ acl_classify_add_del_table_small (vnet_classify_main_t * cm, u8 * mask, return ret; } - static int acl_unhook_l2_input_classify (acl_main_t * am, u32 sw_if_index) { vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; + u32 dot1q_table_index = ~0; + u32 dot1ad_table_index = ~0; void *oldheap = acl_set_heap(am); vec_validate_init_empty (am->acl_ip4_input_classify_table_by_sw_if_index, sw_if_index, ~0); vec_validate_init_empty (am->acl_ip6_input_classify_table_by_sw_if_index, sw_if_index, ~0); + vec_validate_init_empty (am->acl_dot1q_input_classify_table_by_sw_if_index, + sw_if_index, ~0); + vec_validate_init_empty (am->acl_dot1ad_input_classify_table_by_sw_if_index, + sw_if_index, ~0); /* switch to global heap while calling vnet_* functions */ clib_mem_set_heap (cm->vlib_main->heap_base); @@ -481,6 +505,26 @@ acl_unhook_l2_input_classify (acl_main_t * am, u32 sw_if_index) am->l2_input_classify_next_acl_ip6, &ip6_table_index, 0); } + if (am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] != ~0) + { + dot1q_table_index = + am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index]; + am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] = ~0; + acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask, + sizeof (ip6_5tuple_mask) - 1, ~0, + ~0, + &dot1q_table_index, 0); + } + if (am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] != ~0) + { + dot1ad_table_index = + am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index]; + am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] = ~0; + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, + &dot1ad_table_index, 0); + } clib_mem_set_heap (oldheap); return 0; } @@ -491,12 +535,18 @@ acl_unhook_l2_output_classify (acl_main_t * am, u32 sw_if_index) vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; + u32 dot1q_table_index = ~0; + u32 dot1ad_table_index = ~0; void *oldheap = acl_set_heap(am); vec_validate_init_empty (am->acl_ip4_output_classify_table_by_sw_if_index, sw_if_index, ~0); vec_validate_init_empty (am->acl_ip6_output_classify_table_by_sw_if_index, sw_if_index, ~0); + vec_validate_init_empty (am->acl_dot1q_output_classify_table_by_sw_if_index, + sw_if_index, ~0); + vec_validate_init_empty (am->acl_dot1ad_output_classify_table_by_sw_if_index, + sw_if_index, ~0); /* switch to global heap while calling vnet_* functions */ clib_mem_set_heap (cm->vlib_main->heap_base); @@ -523,16 +573,76 @@ acl_unhook_l2_output_classify (acl_main_t * am, u32 sw_if_index) am->l2_output_classify_next_acl_ip6, &ip6_table_index, 0); } + if (am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] != ~0) + { + dot1q_table_index = + am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index]; + am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] = ~0; + acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask, + sizeof (ip6_5tuple_mask) - 1, ~0, + ~0, + &dot1q_table_index, 0); + } + if (am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] != ~0) + { + dot1ad_table_index = + am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index]; + am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] = ~0; + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, + &dot1ad_table_index, 0); + } clib_mem_set_heap (oldheap); return 0; } +static void +acl_add_vlan_session(acl_main_t * am, u32 table_index, u8 is_output, u8 is_dot1ad, u8 is_ip6) +{ + vnet_classify_main_t *cm = &vnet_classify_main; + u8 *match; + u32 next_acl; + u8 idx; + u8 session_idx; + + if (is_ip6) + { + next_acl = (is_output)?am->l2_output_classify_next_acl_ip6:am->l2_input_classify_next_acl_ip6; + } + else + { + next_acl = (is_output)?am->l2_output_classify_next_acl_ip4:am->l2_input_classify_next_acl_ip4; + } + match = (is_dot1ad)?dot1ad_5tuple_mask:dot1q_5tuple_mask; + idx = (is_dot1ad)?20:16; + + /* add sessions to vlan tables per ethernet_type */ + if (is_ip6) + { + match[idx] = 0x86; + match[idx+1] = 0xdd; + session_idx = 1; + } + else + { + match[idx] = 0x08; + match[idx+1] = 0x00; + session_idx = 0; + } + vnet_classify_add_del_session (cm, table_index, match, next_acl, + session_idx, 0, 0, 0, 1); + memset (&match[idx], 0x00, 2); +} + static int acl_hook_l2_input_classify (acl_main_t * am, u32 sw_if_index) { vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; + u32 dot1q_table_index = ~0; + u32 dot1ad_table_index = ~0; int rv; void *prevheap = clib_mem_set_heap (cm->vlib_main->heap_base); @@ -546,6 +656,7 @@ acl_hook_l2_input_classify (acl_main_t * am, u32 sw_if_index) &ip4_table_index, 1); if (rv) goto done; + rv = acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, @@ -559,26 +670,68 @@ acl_hook_l2_input_classify (acl_main_t * am, u32 sw_if_index) &ip4_table_index, 0); goto done; } + + rv = + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, &dot1ad_table_index, 1); + rv = + acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask, + sizeof (dot1q_5tuple_mask) - 1, dot1ad_table_index, + ~0, &dot1q_table_index, 1); + if (rv) + { + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, &dot1ad_table_index, 0); + acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask, + sizeof (ip6_5tuple_mask) - 1, ~0, + am->l2_input_classify_next_acl_ip6, + &ip6_table_index, 0); + acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask, + sizeof (ip4_5tuple_mask) - 1, ~0, + am->l2_input_classify_next_acl_ip4, + &ip4_table_index, 0); + goto done; + } + rv = vnet_l2_input_classify_set_tables (sw_if_index, ip4_table_index, - ip6_table_index, ~0); + ip6_table_index, dot1q_table_index); + if (rv) { + acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask, + sizeof (ip4_5tuple_mask) - 1, ~0, + am->l2_input_classify_next_acl_ip4, + &ip4_table_index, 0); acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip6, &ip6_table_index, 0); - acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask, - sizeof (ip4_5tuple_mask) - 1, ~0, - am->l2_input_classify_next_acl_ip4, - &ip4_table_index, 0); + acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask, + sizeof (dot1q_5tuple_mask) - 1, ~0, + ~0, &dot1q_table_index, 0); + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, &dot1ad_table_index, 0); goto done; } + /* add sessions to vlan tables per ethernet_type */ + acl_add_vlan_session(am, dot1q_table_index, 0, 0, 0); + acl_add_vlan_session(am, dot1q_table_index, 0, 0, 1); + acl_add_vlan_session(am, dot1ad_table_index, 0, 1, 0); + acl_add_vlan_session(am, dot1ad_table_index, 0, 1, 1); + am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] = ip4_table_index; am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] = ip6_table_index; + am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] = + dot1q_table_index; + am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] = + dot1ad_table_index; vnet_l2_input_classify_enable_disable (sw_if_index, 1); done: @@ -592,6 +745,8 @@ acl_hook_l2_output_classify (acl_main_t * am, u32 sw_if_index) vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; + u32 dot1q_table_index = ~0; + u32 dot1ad_table_index = ~0; int rv; void *prevheap = clib_mem_set_heap (cm->vlib_main->heap_base); @@ -618,9 +773,35 @@ acl_hook_l2_output_classify (acl_main_t * am, u32 sw_if_index) &ip4_table_index, 0); goto done; } + + rv = + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, &dot1ad_table_index, 1); + rv = + acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask, + sizeof (dot1q_5tuple_mask) - 1, dot1ad_table_index, + ~0, &dot1q_table_index, 1); + if (rv) + { + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, &dot1ad_table_index, 0); + acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask, + sizeof (ip6_5tuple_mask) - 1, ~0, + am->l2_output_classify_next_acl_ip6, + &ip6_table_index, 0); + acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask, + sizeof (ip4_5tuple_mask) - 1, ~0, + am->l2_output_classify_next_acl_ip4, + &ip4_table_index, 0); + goto done; + } + rv = vnet_l2_output_classify_set_tables (sw_if_index, ip4_table_index, - ip6_table_index, ~0); + ip6_table_index, dot1q_table_index); + clib_warning ("ACL enabling on interface sw_if_index %d, setting tables to the following: ip4: %d ip6: %d\n", sw_if_index, ip4_table_index, ip6_table_index); @@ -634,13 +815,31 @@ acl_hook_l2_output_classify (acl_main_t * am, u32 sw_if_index) sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip4, &ip4_table_index, 0); + acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask, + sizeof (dot1q_5tuple_mask) - 1, ~0, + ~0, + &dot1q_table_index, 0); + acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask, + sizeof (dot1ad_5tuple_mask) - 1, ~0, + ~0, + &dot1ad_table_index, 0); goto done; } + /* add sessions to vlan tables per ethernet_type */ + acl_add_vlan_session(am, dot1q_table_index, 1, 0, 0); + acl_add_vlan_session(am, dot1q_table_index, 1, 0, 1); + acl_add_vlan_session(am, dot1ad_table_index, 1, 1, 0); + acl_add_vlan_session(am, dot1ad_table_index, 1, 1, 1); + am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] = ip4_table_index; am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] = ip6_table_index; + am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] = + dot1q_table_index; + am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] = + dot1ad_table_index; vnet_l2_output_classify_enable_disable (sw_if_index, 1); done: @@ -648,8 +847,6 @@ done: return rv; } - - int acl_interface_in_enable_disable (acl_main_t * am, u32 sw_if_index, int enable_disable) @@ -917,6 +1114,8 @@ typedef struct u32 count; u32 table_index; u32 arp_table_index; + u32 dot1q_table_index; + u32 dot1ad_table_index; } macip_match_type_t; static u32 @@ -1007,6 +1206,8 @@ macip_create_classify_tables (acl_main_t * am, u32 macip_acl_index) mvec[match_type_index].prefix_len = a->rules[i].src_prefixlen; mvec[match_type_index].is_ipv6 = a->rules[i].is_ipv6; mvec[match_type_index].table_index = ~0; + mvec[match_type_index].dot1q_table_index = ~0; + mvec[match_type_index].dot1ad_table_index = ~0; } mvec[match_type_index].count++; } @@ -1047,8 +1248,36 @@ macip_create_classify_tables (acl_main_t * am, u32 macip_acl_index) int mask_len; int is6 = mt->is_ipv6; int l3_src_offs = get_l3_src_offset(is6); - memset (mask, 0, sizeof (mask)); - memcpy (&mask[6], mt->mac_mask, 6); + int tags; + u32 *last_tag_table; + + /* + * create chained tables for VLAN (no-tags, dot1q and dot1ad) packets + */ + l3_src_offs += 8; + for (tags = 2; tags >= 0; tags--) + { + memset (mask, 0, sizeof (mask)); + memcpy (&mask[6], mt->mac_mask, 6); + switch (tags) + { + case 0: + default: + memset (&mask[12], 0xff, 2); /* ethernet protocol */ + last_tag_table = &mt->table_index; + break; + case 1: + memset (&mask[12], 0xff, 2); /* VLAN tag1 */ + memset (&mask[16], 0xff, 2); /* ethernet protocol */ + last_tag_table = &mt->dot1q_table_index; + break; + case 2: + memset (&mask[12], 0xff, 2); /* VLAN tag1 */ + memset (&mask[16], 0xff, 2); /* VLAN tag2 */ + memset (&mask[20], 0xff, 2); /* ethernet protocol */ + last_tag_table = &mt->dot1ad_table_index; + break; + } for (i = 0; i < (mt->prefix_len / 8); i++) { mask[l3_src_offs + i] = 0xff; @@ -1065,9 +1294,13 @@ macip_create_classify_tables (acl_main_t * am, u32 macip_acl_index) mask_len = ((l3_src_offs + ((mt->prefix_len+7) / 8) + (sizeof (u32x4)-1))/sizeof(u32x4)) * sizeof (u32x4); acl_classify_add_del_table_small (cm, mask, mask_len, last_table, - (~0 == last_table) ? 0 : ~0, &mt->table_index, + (~0 == last_table) ? 0 : ~0, last_tag_table, 1); - last_table = mt->table_index; + last_table = *last_tag_table; + + memset (&mask[12], 0, sizeof (mask)-12); + l3_src_offs -= 4; + } } a->ip4_table_index = last_table; a->ip6_table_index = last_table; @@ -1080,30 +1313,63 @@ macip_create_classify_tables (acl_main_t * am, u32 macip_acl_index) u32 metadata = 0; int is6 = a->rules[i].is_ipv6; int l3_src_offs = get_l3_src_offset(is6); - memset (mask, 0, sizeof (mask)); - memcpy (&mask[6], a->rules[i].src_mac, 6); - memset (&mask[12], 0xff, 2); /* ethernet protocol */ - if (is6) - { - memcpy (&mask[l3_src_offs], &a->rules[i].src_ip_addr.ip6, 16); - mask[12] = 0x86; - mask[13] = 0xdd; - } - else - { - memcpy (&mask[l3_src_offs], &a->rules[i].src_ip_addr.ip4, 4); - mask[12] = 0x08; - mask[13] = 0x00; - } + u32 tag_table; + int tags, eth; + match_type_index = - macip_find_match_type (mvec, a->rules[i].src_mac_mask, - a->rules[i].src_prefixlen, - a->rules[i].is_ipv6); + macip_find_match_type (mvec, a->rules[i].src_mac_mask, + a->rules[i].src_prefixlen, + a->rules[i].is_ipv6); ASSERT(match_type_index != ~0); - /* add session to table mvec[match_type_index].table_index; */ - vnet_classify_add_del_session (cm, mvec[match_type_index].table_index, - mask, a->rules[i].is_permit ? ~0 : 0, i, - 0, action, metadata, 1); + + l3_src_offs += 8; + for (tags = 2; tags >= 0; tags--) + { + memset (mask, 0, sizeof (mask)); + memcpy (&mask[6], a->rules[i].src_mac, 6); + switch (tags) + { + case 0: + default: + tag_table = mvec[match_type_index].table_index; + eth = 12; + break; + case 1: + tag_table = mvec[match_type_index].dot1q_table_index; + mask[12] = 0x81; + mask[13] = 0x00; + eth = 16; + break; + case 2: + tag_table = mvec[match_type_index].dot1ad_table_index; + mask[12] = 0x88; + mask[13] = 0xa8; + mask[16] = 0x81; + mask[17] = 0x00; + eth = 20; + break; + } + if (is6) + { + memcpy (&mask[l3_src_offs], &a->rules[i].src_ip_addr.ip6, 16); + mask[eth] = 0x86; + mask[eth+1] = 0xdd; + } + else + { + memcpy (&mask[l3_src_offs], &a->rules[i].src_ip_addr.ip4, 4); + mask[eth] = 0x08; + mask[eth+1] = 0x00; + } + + /* add session to table mvec[match_type_index].table_index; */ + vnet_classify_add_del_session (cm, tag_table, + mask, a->rules[i].is_permit ? ~0 : 0, i, + 0, action, metadata, 1); + memset (&mask[12], 0, sizeof (mask)-12); + l3_src_offs -= 4; + } + /* add ARP table entry too */ if (!is6 && (mvec[match_type_index].arp_table_index != ~0)) { diff --git a/src/plugins/acl/acl.h b/src/plugins/acl/acl.h index bed22e5fc89..d38c12990de 100644 --- a/src/plugins/acl/acl.h +++ b/src/plugins/acl/acl.h @@ -179,6 +179,11 @@ typedef struct { u32 *acl_ip4_output_classify_table_by_sw_if_index; u32 *acl_ip6_output_classify_table_by_sw_if_index; + u32 *acl_dot1q_input_classify_table_by_sw_if_index; + u32 *acl_dot1ad_input_classify_table_by_sw_if_index; + u32 *acl_dot1q_output_classify_table_by_sw_if_index; + u32 *acl_dot1ad_output_classify_table_by_sw_if_index; + /* MACIP (input) ACLs associated with the interfaces */ u32 *macip_acl_by_sw_if_index; diff --git a/test/test_acl_plugin_macip.py b/test/test_acl_plugin_macip.py index f10d6cc60d5..d27458d7df0 100644 --- a/test/test_acl_plugin_macip.py +++ b/test/test_acl_plugin_macip.py @@ -9,16 +9,16 @@ from socket import inet_ntop, inet_pton, AF_INET, AF_INET6 from struct import * from scapy.packet import Raw from scapy.layers.l2 import Ether -from scapy.layers.inet import IP, UDP, TCP +from scapy.layers.inet import IP, UDP from scapy.layers.inet6 import IPv6 from framework import VppTestCase, VppTestRunner, running_extended_tests from vpp_lo_interface import VppLoInterface +from vpp_papi_provider import L2_VTR_OP +from vpp_sub_interface import VppSubInterface, VppDot1QSubint, VppDot1ADSubint -class TestMACIP(VppTestCase): - """MACIP Test Case""" - +class MethodHolder(VppTestCase): DEBUG = False BRIDGED = True @@ -27,6 +27,11 @@ class TestMACIP(VppTestCase): IS_IP4 = False IS_IP6 = True + DOT1AD = "dot1ad" + DOT1Q = "dot1q" + PERMIT_TAGS = True + DENY_TAGS = False + # rule types DENY = 0 PERMIT = 1 @@ -49,19 +54,36 @@ class TestMACIP(VppTestCase): class VppTestCase) before running the test case, set test case related variables and configure VPP. """ - super(TestMACIP, cls).setUpClass() + super(MethodHolder, cls).setUpClass() cls.pg_if_packet_sizes = [64, 512, 1518, 9018] # packet sizes - cls.bd_id = 10 - cls.remote_hosts_count = 250 + cls.bd_id = 111 + cls.remote_hosts_count = 200 try: - # create 3 pg interfaces, 1 loopback interface - cls.create_pg_interfaces(range(3)) + # create 4 pg interfaces, 1 loopback interface + cls.create_pg_interfaces(range(4)) cls.create_loopback_interfaces(range(1)) + # create 2 subinterfaces + cls.subifs = [ + VppDot1QSubint(cls, cls.pg1, 10), + VppDot1ADSubint(cls, cls.pg2, 20, 300, 400), + VppDot1QSubint(cls, cls.pg3, 30), + VppDot1ADSubint(cls, cls.pg3, 40, 600, 700)] + + cls.subifs[0].set_vtr(L2_VTR_OP.L2_POP_1, + inner=10, push1q=1) + cls.subifs[1].set_vtr(L2_VTR_OP.L2_POP_2, + outer=300, inner=400, push1q=1) + cls.subifs[2].set_vtr(L2_VTR_OP.L2_POP_1, + inner=30, push1q=1) + cls.subifs[3].set_vtr(L2_VTR_OP.L2_POP_2, + outer=600, inner=700, push1q=1) + cls.interfaces = list(cls.pg_interfaces) cls.interfaces.extend(cls.lo_interfaces) + cls.interfaces.extend(cls.subifs) for i in cls.interfaces: i.admin_up() @@ -73,12 +95,18 @@ class TestMACIP(VppTestCase): cls.pg0.sw_if_index, bd_id=cls.bd_id) cls.vapi.sw_interface_set_l2_bridge( cls.pg1.sw_if_index, bd_id=cls.bd_id) + cls.vapi.sw_interface_set_l2_bridge( + cls.subifs[0].sw_if_index, bd_id=cls.bd_id) + cls.vapi.sw_interface_set_l2_bridge( + cls.subifs[1].sw_if_index, bd_id=cls.bd_id) - # Configure IPv4 addresses on loop interface and routed interface + # Configure IPv4/6 addresses on loop interface and routed interface cls.loop0.config_ip4() cls.loop0.config_ip6() cls.pg2.config_ip4() cls.pg2.config_ip6() + cls.pg3.config_ip4() + cls.pg3.config_ip6() # Configure MAC address binding to IPv4 neighbors on loop0 cls.loop0.generate_remote_hosts(cls.remote_hosts_count) @@ -90,22 +118,35 @@ class TestMACIP(VppTestCase): cls.loop0.configure_ipv4_neighbors() cls.loop0.configure_ipv6_neighbors() + + # configure MAC address on pg3 + cls.pg3.resolve_arp() + cls.pg3.resolve_ndp() + + # configure MAC address on subifs + for i in cls.subifs: + i.config_ip4() + i.resolve_arp() + i.config_ip6() + # configure MAC address on pg2 cls.pg2.resolve_arp() cls.pg2.resolve_ndp() # Loopback BVI interface has remote hosts - # one half of hosts are behind pg0 second behind pg1 - half = cls.remote_hosts_count // 2 - cls.pg0.remote_hosts = cls.loop0.remote_hosts[:half] - cls.pg1.remote_hosts = cls.loop0.remote_hosts[half:] + # one half of hosts are behind pg0 second behind pg1,pg2,pg3 subifs + cls.pg0.remote_hosts = cls.loop0.remote_hosts[:100] + cls.subifs[0].remote_hosts = cls.loop0.remote_hosts[100:125] + cls.subifs[1].remote_hosts = cls.loop0.remote_hosts[125:150] + cls.subifs[2].remote_hosts = cls.loop0.remote_hosts[150:175] + cls.subifs[3].remote_hosts = cls.loop0.remote_hosts[175:] except Exception: super(TestMACIP, cls).tearDownClass() raise def setUp(self): - super(TestMACIP, self).setUp() + super(MethodHolder, self).setUp() self.reset_packet_infos() del self.ACLS[:] @@ -113,13 +154,16 @@ class TestMACIP(VppTestCase): """ Show various debug prints after each test. """ - super(TestMACIP, self).tearDown() + super(MethodHolder, self).tearDown() if not self.vpp_dead: self.logger.info(self.vapi.ppcli("show interface address")) self.logger.info(self.vapi.ppcli("show hardware")) self.logger.info(self.vapi.ppcli("sh acl-plugin macip acl")) self.logger.info(self.vapi.ppcli("sh acl-plugin macip interface")) self.logger.info(self.vapi.ppcli("sh classify tables verbose")) + self.logger.info(self.vapi.ppcli("sh acl-plugin acl")) + self.logger.info(self.vapi.ppcli("sh acl-plugin interface")) + self.logger.info(self.vapi.ppcli("sh acl-plugin tables")) # print self.vapi.ppcli("show interface address") # print self.vapi.ppcli("show hardware") # print self.vapi.ppcli("sh acl-plugin macip interface") @@ -217,13 +261,13 @@ class TestMACIP(VppTestCase): src_mac += 1099511627776 return acls - def apply_rules(self, acls): + def apply_macip_rules(self, acls): for acl in acls: reply = self.vapi.macip_acl_add(acl) self.assertEqual(reply.retval, 0) self.ACLS.append(reply.acl_index) - def verify_acls(self, acl_count, rules_count, expected_count=2): + def verify_macip_acls(self, acl_count, rules_count, expected_count=2): reply = self.macip_acl_dump_debug() for acl in range(2, (acl_count+1) * 2): self.assertEqual(reply[acl - 2].count, rules_count[acl/2-1]) @@ -243,8 +287,18 @@ class TestMACIP(VppTestCase): reply = self.vapi.macip_acl_dump() self.assertEqual(len(reply), 0) + intf_acls = self.vapi.ppcli("sh acl-plugin interface").split( + "\nsw_if_index") + for i_a in intf_acls: + ia = i_a.split(":") + if len(ia) == 3: + sw_if_index = int(ia[0]) + acl_index = int(ia[2]) + self.vapi.acl_interface_add_del(sw_if_index, acl_index, 0) + self.vapi.acl_del(acl_index) + def create_stream(self, mac_type, ip_type, packet_count, - src_ip_if, dst_ip_if, bridged_routed, is_ip6): + src_if, dst_if, traffic, is_ip6, tags=PERMIT_TAGS): # exact MAC and exact IP # exact MAC and subnet of IPs # exact MAC and wildcard IP @@ -256,15 +310,16 @@ class TestMACIP(VppTestCase): # OUI restricted MAC and wildcard IP packets = [] - rules = [] + macip_rules = [] + acl_rules = [] ip_permit = "" mac_permit = "" dst_mac = "" mac_rule = "00:00:00:00:00:00" mac_mask = "00:00:00:00:00:00" for p in range(0, packet_count): - remote_dst_index = p % len(dst_ip_if.remote_hosts) - remote_dst_host = dst_ip_if.remote_hosts[remote_dst_index] + remote_dst_index = p % len(dst_if.remote_hosts) + remote_dst_host = dst_if.remote_hosts[remote_dst_index] dst_port = 1234 + p src_port = 4321 + p @@ -276,14 +331,14 @@ class TestMACIP(VppTestCase): if not is_permit and mac_type == self.WILD_MAC: denyIP = True - if bridged_routed == self.BRIDGED: + if traffic == self.BRIDGED: if is_permit: src_mac = remote_dst_host._mac dst_mac = 'de:ad:00:00:00:00' src_ip4 = remote_dst_host.ip4 - dst_ip4 = src_ip_if.remote_ip4 + dst_ip4 = src_if.remote_ip4 src_ip6 = remote_dst_host.ip6 - dst_ip6 = src_ip_if.remote_ip6 + dst_ip6 = src_if.remote_ip6 ip_permit = src_ip6 if is_ip6 else src_ip4 mac_permit = src_mac if denyMAC: @@ -298,16 +353,16 @@ class TestMACIP(VppTestCase): if ip_type != self.WILD_IP: src_mac = mac_permit src_ip4 = remote_dst_host.ip4 - dst_ip4 = src_ip_if.remote_ip4 + dst_ip4 = src_if.remote_ip4 src_ip6 = remote_dst_host.ip6 - dst_ip6 = src_ip_if.remote_ip6 + dst_ip6 = src_if.remote_ip6 else: if is_permit: src_mac = remote_dst_host._mac - dst_mac = src_ip_if.local_mac - src_ip4 = src_ip_if.remote_ip4 + dst_mac = src_if.local_mac + src_ip4 = src_if.remote_ip4 dst_ip4 = remote_dst_host.ip4 - src_ip6 = src_ip_if.remote_ip6 + src_ip6 = src_if.remote_ip6 dst_ip6 = remote_dst_host.ip6 ip_permit = src_ip6 if is_ip6 else src_ip4 mac_permit = src_mac @@ -324,12 +379,12 @@ class TestMACIP(VppTestCase): if ip_type != self.WILD_IP: src_mac = mac_permit src_ip4 = remote_dst_host.ip4 - dst_ip4 = src_ip_if.remote_ip4 + dst_ip4 = src_if.remote_ip4 src_ip6 = remote_dst_host.ip6 - dst_ip6 = src_ip_if.remote_ip6 + dst_ip6 = src_if.remote_ip6 if is_permit: - info = self.create_packet_info(src_ip_if, dst_ip_if) + info = self.create_packet_info(src_if, dst_if) payload = self.info_to_payload(info) else: payload = "to be blocked" @@ -379,10 +434,34 @@ class TestMACIP(VppTestCase): packet[Raw].load += " mac:"+src_mac size = self.pg_if_packet_sizes[p % len(self.pg_if_packet_sizes)] + if isinstance(src_if, VppSubInterface): + size = size + 4 + if isinstance(src_if, VppDot1QSubint): + if src_if is self.subifs[0]: + if tags == self.PERMIT_TAGS: + packet = src_if.add_dot1q_layer(packet, 10) + else: + packet = src_if.add_dot1q_layer(packet, 11) + else: + if tags == self.PERMIT_TAGS: + packet = src_if.add_dot1q_layer(packet, 30) + else: + packet = src_if.add_dot1q_layer(packet, 33) + elif isinstance(src_if, VppDot1ADSubint): + if src_if is self.subifs[1]: + if tags == self.PERMIT_TAGS: + packet = src_if.add_dot1ad_layer(packet, 300, 400) + else: + packet = src_if.add_dot1ad_layer(packet, 333, 444) + else: + if tags == self.PERMIT_TAGS: + packet = src_if.add_dot1ad_layer(packet, 600, 700) + else: + packet = src_if.add_dot1ad_layer(packet, 666, 777) self.extend_packet(packet, size) packets.append(packet) - # create suitable rule + # create suitable MACIP rule if mac_type == self.EXACT_MAC: mac_rule = src_mac mac_mask = "ff:ff:ff:ff:ff:ff" @@ -422,38 +501,77 @@ class TestMACIP(VppTestCase): prefix_len = 64 if is_ip6 else 16 ip_rule = inet_pton(AF_INET6 if is_ip6 else AF_INET, ip) + # create suitable ACL rule + if is_permit: + rule_l4_sport = packet[UDP].sport + rule_l4_dport = packet[UDP].dport + rule_family = AF_INET6 if packet.haslayer(IPv6) else AF_INET + rule_prefix_len = 128 if packet.haslayer(IPv6) else 32 + rule_l3_layer = IPv6 if packet.haslayer(IPv6) else IP + if packet.haslayer(IPv6): + rule_l4_proto = packet[UDP].overload_fields[IPv6]['nh'] + else: + rule_l4_proto = packet[IP].proto + + acl_rule = { + 'is_permit': is_permit, + 'is_ipv6': is_ip6, + 'src_ip_addr': inet_pton(rule_family, + packet[rule_l3_layer].src), + 'src_ip_prefix_len': rule_prefix_len, + 'dst_ip_addr': inet_pton(rule_family, + packet[rule_l3_layer].dst), + 'dst_ip_prefix_len': rule_prefix_len, + 'srcport_or_icmptype_first': rule_l4_sport, + 'srcport_or_icmptype_last': rule_l4_sport, + 'dstport_or_icmpcode_first': rule_l4_dport, + 'dstport_or_icmpcode_last': rule_l4_dport, + 'proto': rule_l4_proto} + acl_rules.append(acl_rule) + if mac_type == self.WILD_MAC and ip_type == self.WILD_IP and p > 0: continue if is_permit: - rule = ({'is_permit': is_permit, - 'is_ipv6': is_ip6, - 'src_ip_addr': ip_rule, - 'src_ip_prefix_len': prefix_len, - 'src_mac': mac_rule.replace(':', '').decode('hex'), - 'src_mac_mask': mac_mask.replace(':', '').decode( - 'hex')}) - rules.append(rule) + macip_rule = ({ + 'is_permit': is_permit, + 'is_ipv6': is_ip6, + 'src_ip_addr': ip_rule, + 'src_ip_prefix_len': prefix_len, + 'src_mac': mac_rule.replace(':', '').decode('hex'), + 'src_mac_mask': mac_mask.replace(':', '').decode('hex')}) + macip_rules.append(macip_rule) # deny all other packets if not (mac_type == self.WILD_MAC and ip_type == self.WILD_IP): - rule = ({'is_permit': 0, - 'is_ipv6': is_ip6, - 'src_ip_addr': "", - 'src_ip_prefix_len': 0, - 'src_mac': "", - 'src_mac_mask': ""}) - rules.append(rule) - - return {'stream': packets, 'rules': rules} + macip_rule = ({'is_permit': 0, + 'is_ipv6': is_ip6, + 'src_ip_addr': "", + 'src_ip_prefix_len': 0, + 'src_mac': "", + 'src_mac_mask': ""}) + macip_rules.append(macip_rule) + + acl_rule = {'is_permit': 0, + 'is_ipv6': is_ip6} + acl_rules.append(acl_rule) + return {'stream': packets, + 'macip_rules': macip_rules, + 'acl_rules': acl_rules} def verify_capture(self, stream, capture, is_ip6): - p_l3 = IPv6 if is_ip6 else IP - if self.DEBUG: - for p in stream: - print p[Ether].src, p[Ether].dst, p[p_l3].src, p[p_l3].dst - - acls = self.macip_acl_dump_debug() + """ + :param stream: + :param capture: + :param is_ip6: + :return: + """ + # p_l3 = IPv6 if is_ip6 else IP + # if self.DEBUG: + # for p in stream: + # print p[Ether].src, p[Ether].dst, p[p_l3].src, p[p_l3].dst + # + # acls = self.macip_acl_dump_debug() # TODO : verify # for acl in acls: @@ -468,64 +586,112 @@ class TestMACIP(VppTestCase): # data = p[Raw].load.split(':',1)[1] # print p[p_l3].src, data - def run_traffic(self, mac_type, ip_type, bridged_routed, is_ip6, packets, - do_not_expected_capture=False): + def run_traffic(self, mac_type, ip_type, traffic, is_ip6, packets, + do_not_expected_capture=False, tags=None, + apply_rules=True, isMACIP=True, permit_tags=PERMIT_TAGS): self.reset_packet_infos() - tx_if = self.pg0 if bridged_routed == self.BRIDGED else self.pg2 - rx_if = self.pg2 if bridged_routed == self.BRIDGED else self.pg0 + if tags is None: + tx_if = self.pg0 if traffic == self.BRIDGED else self.pg3 + rx_if = self.pg3 if traffic == self.BRIDGED else self.pg0 + src_if = self.pg3 + dst_if = self.loop0 + else: + if tags == self.DOT1Q: + if traffic == self.BRIDGED: + tx_if = self.subifs[0] + rx_if = self.pg0 + src_if = self.subifs[0] + dst_if = self.loop0 + else: + tx_if = self.subifs[2] + rx_if = self.pg0 + src_if = self.subifs[2] + dst_if = self.loop0 + elif tags == self.DOT1AD: + if traffic == self.BRIDGED: + tx_if = self.subifs[1] + rx_if = self.pg0 + src_if = self.subifs[1] + dst_if = self.loop0 + else: + tx_if = self.subifs[3] + rx_if = self.pg0 + src_if = self.subifs[3] + dst_if = self.loop0 + else: + return test_dict = self.create_stream(mac_type, ip_type, packets, - self.pg2, self.loop0, - bridged_routed, - is_ip6) - - reply = self.vapi.macip_acl_add(test_dict['rules']) - self.assertEqual(reply.retval, 0) - acl_index = reply.acl_index + src_if, dst_if, + traffic, is_ip6, + tags=permit_tags) - self.vapi.macip_acl_interface_add_del(sw_if_index=tx_if.sw_if_index, - acl_index=acl_index) - reply = self.vapi.macip_acl_interface_get() - self.assertEqual(reply.acls[tx_if.sw_if_index], acl_index) - self.ACLS.append(reply.acls[tx_if.sw_if_index]) + if apply_rules: + if isMACIP: + reply = self.vapi.macip_acl_add(test_dict['macip_rules']) + else: + reply = self.vapi.acl_add_replace(acl_index=4294967295, + r=test_dict['acl_rules']) + self.assertEqual(reply.retval, 0) + acl_index = reply.acl_index + + if isMACIP: + self.vapi.macip_acl_interface_add_del( + sw_if_index=tx_if.sw_if_index, + acl_index=acl_index) + reply = self.vapi.macip_acl_interface_get() + self.assertEqual(reply.acls[tx_if.sw_if_index], acl_index) + self.ACLS.append(reply.acls[tx_if.sw_if_index]) + else: + self.vapi.acl_interface_add_del( + sw_if_index=tx_if.sw_if_index, acl_index=acl_index) + else: + self.vapi.macip_acl_interface_add_del( + sw_if_index=tx_if.sw_if_index, + acl_index=0) - tx_if.add_stream(test_dict['stream']) + if not isinstance(src_if, VppSubInterface): + tx_if.add_stream(test_dict['stream']) + else: + tx_if.parent.add_stream(test_dict['stream']) self.pg_enable_capture(self.pg_interfaces) self.pg_start() if do_not_expected_capture: rx_if.get_capture(0) else: - packet_count = self.get_packet_count_for_if_idx( - self.loop0.sw_if_index) - if mac_type == self.WILD_MAC and ip_type == self.WILD_IP: - packet_count = packets if bridged_routed else packet_count - capture = rx_if.get_capture(packet_count) + if traffic == self.BRIDGED and mac_type == self.WILD_MAC and \ + ip_type == self.WILD_IP: + capture = rx_if.get_capture(packets) + else: + capture = rx_if.get_capture( + self.get_packet_count_for_if_idx(dst_if.sw_if_index)) self.verify_capture(test_dict['stream'], capture, is_ip6) + if not isMACIP: + self.vapi.acl_interface_add_del(sw_if_index=tx_if.sw_if_index, + acl_index=acl_index, is_add=0) + self.vapi.acl_del(acl_index) def run_test_acls(self, mac_type, ip_type, acl_count, rules_count, traffic=None, ip=None): - self.apply_rules(self.create_rules(mac_type, ip_type, acl_count, - rules_count)) - self.verify_acls(acl_count, rules_count) + self.apply_macip_rules(self.create_rules(mac_type, ip_type, acl_count, + rules_count)) + self.verify_macip_acls(acl_count, rules_count) if traffic is not None: self.run_traffic(self.EXACT_MAC, self.EXACT_IP, traffic, ip, 9) + +class TestMACIP_IP4(MethodHolder): + """MACIP with IP4 traffic""" + def test_acl_bridged_ip4_exactMAC_exactIP(self): """ IP4 MACIP exactMAC|exactIP ACL bridged traffic """ self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED, self.IS_IP4, 9) - def test_acl_bridged_ip6_exactMAC_exactIP(self): - """ IP6 MACIP exactMAC|exactIP ACL bridged traffic - """ - - self.run_traffic(self.EXACT_MAC, self.EXACT_IP, - self.BRIDGED, self.IS_IP6, 9) - def test_acl_bridged_ip4_exactMAC_subnetIP(self): """ IP4 MACIP exactMAC|subnetIP ACL bridged traffic """ @@ -533,13 +699,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.EXACT_MAC, self.SUBNET_IP, self.BRIDGED, self.IS_IP4, 9) - def test_acl_bridged_ip6_exactMAC_subnetIP(self): - """ IP6 MACIP exactMAC|subnetIP ACL bridged traffic - """ - - self.run_traffic(self.EXACT_MAC, self.SUBNET_IP, - self.BRIDGED, self.IS_IP6, 9) - def test_acl_bridged_ip4_exactMAC_wildIP(self): """ IP4 MACIP exactMAC|wildIP ACL bridged traffic """ @@ -547,13 +706,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.EXACT_MAC, self.WILD_IP, self.BRIDGED, self.IS_IP4, 9) - def test_acl_bridged_ip6_exactMAC_wildIP(self): - """ IP6 MACIP exactMAC|wildIP ACL bridged traffic - """ - - self.run_traffic(self.EXACT_MAC, self.WILD_IP, - self.BRIDGED, self.IS_IP6, 9) - def test_acl_bridged_ip4_ouiMAC_exactIP(self): """ IP4 MACIP ouiMAC|exactIP ACL bridged traffic """ @@ -561,13 +713,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.OUI_MAC, self.EXACT_IP, self.BRIDGED, self.IS_IP4, 3) - def test_acl_bridged_ip6_ouiMAC_exactIP(self): - """ IP6 MACIP oui_MAC|exactIP ACL bridged traffic - """ - - self.run_traffic(self.OUI_MAC, self.EXACT_IP, - self.BRIDGED, self.IS_IP6, 9) - def test_acl_bridged_ip4_ouiMAC_subnetIP(self): """ IP4 MACIP ouiMAC|subnetIP ACL bridged traffic """ @@ -575,13 +720,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.OUI_MAC, self.SUBNET_IP, self.BRIDGED, self.IS_IP4, 9) - def test_acl_bridged_ip6_ouiMAC_subnetIP(self): - """ IP6 MACIP ouiMAC|subnetIP ACL bridged traffic - """ - - self.run_traffic(self.OUI_MAC, self.SUBNET_IP, - self.BRIDGED, self.IS_IP6, 9) - def test_acl_bridged_ip4_ouiMAC_wildIP(self): """ IP4 MACIP ouiMAC|wildIP ACL bridged traffic """ @@ -589,13 +727,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.OUI_MAC, self.WILD_IP, self.BRIDGED, self.IS_IP4, 9) - def test_acl_bridged_ip6_ouiMAC_wildIP(self): - """ IP6 MACIP ouiMAC|wildIP ACL bridged traffic - """ - - self.run_traffic(self.OUI_MAC, self.WILD_IP, - self.BRIDGED, self.IS_IP6, 9) - def test_ac_bridgedl_ip4_wildMAC_exactIP(self): """ IP4 MACIP wildcardMAC|exactIP ACL bridged traffic """ @@ -603,13 +734,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.WILD_MAC, self.EXACT_IP, self.BRIDGED, self.IS_IP4, 9) - def test_acl_bridged_ip6_wildMAC_exactIP(self): - """ IP6 MACIP wildcardMAC|exactIP ACL bridged traffic - """ - - self.run_traffic(self.WILD_MAC, self.EXACT_IP, - self.BRIDGED, self.IS_IP6, 9) - def test_acl_bridged_ip4_wildMAC_subnetIP(self): """ IP4 MACIP wildcardMAC|subnetIP ACL bridged traffic """ @@ -617,20 +741,148 @@ class TestMACIP(VppTestCase): self.run_traffic(self.WILD_MAC, self.SUBNET_IP, self.BRIDGED, self.IS_IP4, 9) - def test_acl_bridged_ip6_wildMAC_subnetIP(self): - """ IP6 MACIP wildcardMAC|subnetIP ACL bridged traffic + def test_acl_bridged_ip4_wildMAC_wildIP(self): + """ IP4 MACIP wildcardMAC|wildIP ACL bridged traffic + """ + + self.run_traffic(self.WILD_MAC, self.WILD_IP, + self.BRIDGED, self.IS_IP4, 9) + + def test_acl_routed_ip4_exactMAC_exactIP(self): + """ IP4 MACIP exactMAC|exactIP ACL routed traffic + """ + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_routed_ip4_exactMAC_subnetIP(self): + """ IP4 MACIP exactMAC|subnetIP ACL routed traffic + """ + self.run_traffic(self.EXACT_MAC, self.SUBNET_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_routed_ip4_exactMAC_wildIP(self): + """ IP4 MACIP exactMAC|wildIP ACL routed traffic + """ + self.run_traffic(self.EXACT_MAC, self.WILD_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_routed_ip4_ouiMAC_exactIP(self): + """ IP4 MACIP ouiMAC|exactIP ACL routed traffic + """ + + self.run_traffic(self.OUI_MAC, self.EXACT_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_routed_ip4_ouiMAC_subnetIP(self): + """ IP4 MACIP ouiMAC|subnetIP ACL routed traffic + """ + + self.run_traffic(self.OUI_MAC, self.SUBNET_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_routed_ip4_ouiMAC_wildIP(self): + """ IP4 MACIP ouiMAC|wildIP ACL routed traffic + """ + + self.run_traffic(self.OUI_MAC, self.WILD_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_routed_ip4_wildMAC_exactIP(self): + """ IP4 MACIP wildcardMAC|exactIP ACL routed traffic + """ + + self.run_traffic(self.WILD_MAC, self.EXACT_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_routed_ip4_wildMAC_subnetIP(self): + """ IP4 MACIP wildcardMAC|subnetIP ACL routed traffic """ self.run_traffic(self.WILD_MAC, self.SUBNET_IP, - self.BRIDGED, self.IS_IP6, 9) + self.ROUTED, self.IS_IP4, 9) - def test_acl_bridged_ip4_wildMAC_wildIP(self): - """ IP4 MACIP wildcardMAC|wildIP ACL bridged traffic + def test_acl_routed_ip4_wildMAC_wildIP(self): + """ IP4 MACIP wildcardMAC|wildIP ACL """ self.run_traffic(self.WILD_MAC, self.WILD_IP, + self.ROUTED, self.IS_IP4, 9) + + def test_acl_replace_traffic_ip4(self): + """ MACIP replace ACL with IP4 traffic + """ + self.run_traffic(self.OUI_MAC, self.SUBNET_IP, self.BRIDGED, self.IS_IP4, 9) + r = self.create_rules() + # replace acls #2, #3 with new + reply = self.vapi.macip_acl_add_replace(r[0], 0) + self.assertEqual(reply.retval, 0) + self.assertEqual(reply.acl_index, 0) + + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, + self.BRIDGED, self.IS_IP4, 9, True) + + +class TestMACIP_IP6(MethodHolder): + """MACIP with IP6 traffic""" + + def test_acl_bridged_ip6_exactMAC_exactIP(self): + """ IP6 MACIP exactMAC|exactIP ACL bridged traffic + """ + + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, + self.BRIDGED, self.IS_IP6, 9) + + def test_acl_bridged_ip6_exactMAC_subnetIP(self): + """ IP6 MACIP exactMAC|subnetIP ACL bridged traffic + """ + + self.run_traffic(self.EXACT_MAC, self.SUBNET_IP, + self.BRIDGED, self.IS_IP6, 9) + + def test_acl_bridged_ip6_exactMAC_wildIP(self): + """ IP6 MACIP exactMAC|wildIP ACL bridged traffic + """ + + self.run_traffic(self.EXACT_MAC, self.WILD_IP, + self.BRIDGED, self.IS_IP6, 9) + + def test_acl_bridged_ip6_ouiMAC_exactIP(self): + """ IP6 MACIP oui_MAC|exactIP ACL bridged traffic + """ + + self.run_traffic(self.OUI_MAC, self.EXACT_IP, + self.BRIDGED, self.IS_IP6, 9) + + def test_acl_bridged_ip6_ouiMAC_subnetIP(self): + """ IP6 MACIP ouiMAC|subnetIP ACL bridged traffic + """ + + self.run_traffic(self.OUI_MAC, self.SUBNET_IP, + self.BRIDGED, self.IS_IP6, 9) + + def test_acl_bridged_ip6_ouiMAC_wildIP(self): + """ IP6 MACIP ouiMAC|wildIP ACL bridged traffic + """ + + self.run_traffic(self.OUI_MAC, self.WILD_IP, + self.BRIDGED, self.IS_IP6, 9) + + def test_acl_bridged_ip6_wildMAC_exactIP(self): + """ IP6 MACIP wildcardMAC|exactIP ACL bridged traffic + """ + + self.run_traffic(self.WILD_MAC, self.EXACT_IP, + self.BRIDGED, self.IS_IP6, 9) + + def test_acl_bridged_ip6_wildMAC_subnetIP(self): + """ IP6 MACIP wildcardMAC|subnetIP ACL bridged traffic + """ + + self.run_traffic(self.WILD_MAC, self.SUBNET_IP, + self.BRIDGED, self.IS_IP6, 9) + def test_acl_bridged_ip6_wildMAC_wildIP(self): """ IP6 MACIP wildcardMAC|wildIP ACL bridged traffic """ @@ -638,12 +890,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.WILD_MAC, self.WILD_IP, self.BRIDGED, self.IS_IP6, 9) - def test_acl_routed_ip4_exactMAC_exactIP(self): - """ IP4 MACIP exactMAC|exactIP ACL routed traffic - """ - self.run_traffic(self.EXACT_MAC, self.EXACT_IP, - self.ROUTED, self.IS_IP4, 9) - def test_acl_routed_ip6_exactMAC_exactIP(self): """ IP6 MACIP exactMAC|exactIP ACL routed traffic """ @@ -651,12 +897,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip4_exactMAC_subnetIP(self): - """ IP4 MACIP exactMAC|subnetIP ACL routed traffic - """ - self.run_traffic(self.EXACT_MAC, self.SUBNET_IP, - self.ROUTED, self.IS_IP4, 9) - def test_acl_routed_ip6_exactMAC_subnetIP(self): """ IP6 MACIP exactMAC|subnetIP ACL routed traffic """ @@ -664,12 +904,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.EXACT_MAC, self.SUBNET_IP, self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip4_exactMAC_wildIP(self): - """ IP4 MACIP exactMAC|wildIP ACL routed traffic - """ - self.run_traffic(self.EXACT_MAC, self.WILD_IP, - self.ROUTED, self.IS_IP4, 9) - def test_acl_routed_ip6_exactMAC_wildIP(self): """ IP6 MACIP exactMAC|wildIP ACL routed traffic """ @@ -677,13 +911,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.EXACT_MAC, self.WILD_IP, self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip4_ouiMAC_exactIP(self): - """ IP4 MACIP ouiMAC|exactIP ACL routed traffic - """ - - self.run_traffic(self.OUI_MAC, self.EXACT_IP, - self.ROUTED, self.IS_IP4, 9) - def test_acl_routed_ip6_ouiMAC_exactIP(self): """ IP6 MACIP ouiMAC|exactIP ACL routed traffic """ @@ -691,13 +918,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.OUI_MAC, self.EXACT_IP, self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip4_ouiMAC_subnetIP(self): - """ IP4 MACIP ouiMAC|subnetIP ACL routed traffic - """ - - self.run_traffic(self.OUI_MAC, self.SUBNET_IP, - self.ROUTED, self.IS_IP4, 9) - def test_acl_routed_ip6_ouiMAC_subnetIP(self): """ IP6 MACIP ouiMAC|subnetIP ACL routed traffic """ @@ -705,13 +925,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.OUI_MAC, self.SUBNET_IP, self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip4_ouiMAC_wildIP(self): - """ IP4 MACIP ouiMAC|wildIP ACL routed traffic - """ - - self.run_traffic(self.OUI_MAC, self.WILD_IP, - self.ROUTED, self.IS_IP4, 9) - def test_acl_routed_ip6_ouiMAC_wildIP(self): """ IP6 MACIP ouiMAC|wildIP ACL routed traffic """ @@ -719,13 +932,6 @@ class TestMACIP(VppTestCase): self.run_traffic(self.OUI_MAC, self.WILD_IP, self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip4_wildMAC_exactIP(self): - """ IP4 MACIP wildcardMAC|exactIP ACL routed traffic - """ - - self.run_traffic(self.WILD_MAC, self.EXACT_IP, - self.ROUTED, self.IS_IP4, 9) - def test_acl_routed_ip6_wildMAC_exactIP(self): """ IP6 MACIP wildcardMAC|exactIP ACL routed traffic """ @@ -733,20 +939,39 @@ class TestMACIP(VppTestCase): self.run_traffic(self.WILD_MAC, self.EXACT_IP, self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip4_wildMAC_subnetIP(self): - """ IP4 MACIP wildcardMAC|subnetIP ACL routed traffic + def test_acl_routed_ip6_wildMAC_subnetIP(self): + """ IP6 MACIP wildcardMAC|subnetIP ACL routed traffic """ self.run_traffic(self.WILD_MAC, self.SUBNET_IP, - self.ROUTED, self.IS_IP4, 9) + self.ROUTED, self.IS_IP6, 9) - def test_acl_routed_ip6_wildMAC_subnetIP(self): - """ IP6 MACIP wildcardMAC|subnetIP ACL routed traffic + def test_acl_routed_ip6_wildMAC_wildIP(self): + """ IP6 MACIP wildcardMAC|wildIP ACL """ - self.run_traffic(self.WILD_MAC, self.SUBNET_IP, + self.run_traffic(self.WILD_MAC, self.WILD_IP, self.ROUTED, self.IS_IP6, 9) + def test_acl_replace_traffic_ip6(self): + """ MACIP replace ACL with IP6 traffic + """ + self.run_traffic(self.OUI_MAC, self.SUBNET_IP, + self.BRIDGED, self.IS_IP6, 9) + + r = self.create_rules() + # replace acls #2, #3 with new + reply = self.vapi.macip_acl_add_replace(r[0], 0) + self.assertEqual(reply.retval, 0) + self.assertEqual(reply.acl_index, 0) + + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, + self.BRIDGED, self.IS_IP6, 9, True) + + +class TestMACIP(MethodHolder): + """MACIP Tests""" + def test_acl_1_2(self): """ MACIP ACL with 2 entries """ @@ -818,7 +1043,7 @@ class TestMACIP(VppTestCase): r1 = self.create_rules(acl_count=3, rules_count=[2, 2, 2]) r2 = self.create_rules(mac_type=self.OUI_MAC, ip_type=self.SUBNET_IP) - self.apply_rules(r1) + self.apply_macip_rules(r1) acls_before = self.macip_acl_dump_debug() @@ -853,43 +1078,14 @@ class TestMACIP(VppTestCase): self.assertNotEqual(len(acl1.r), len(acl2.r)) self.assertNotEqual(acl1.r, acl2.r) - def test_acl_replace_traffic_ip4(self): - """ MACIP replace ACL with IP4 traffic - """ - self.run_traffic(self.OUI_MAC, self.SUBNET_IP, - self.BRIDGED, self.IS_IP4, 9) - - r = self.create_rules() - # replace acls #2, #3 with new - reply = self.vapi.macip_acl_add_replace(r[0], 0) - self.assertEqual(reply.retval, 0) - self.assertEqual(reply.acl_index, 0) - - self.run_traffic(self.EXACT_MAC, self.EXACT_IP, - self.BRIDGED, self.IS_IP4, 9, True) - - def test_acl_replace_traffic_ip6(self): - """ MACIP replace ACL with IP6 traffic - """ - self.run_traffic(self.OUI_MAC, self.SUBNET_IP, - self.BRIDGED, self.IS_IP6, 9) - - r = self.create_rules() - # replace acls #2, #3 with new - reply = self.vapi.macip_acl_add_replace(r[0], 0) - self.assertEqual(reply.retval, 0) - self.assertEqual(reply.acl_index, 0) - - self.run_traffic(self.EXACT_MAC, self.EXACT_IP, - self.BRIDGED, self.IS_IP6, 9, True) - def test_delete_intf(self): """ MACIP ACL delete intf with acl """ intf_count = len(self.interfaces)+1 intf = [] - self.apply_rules(self.create_rules(acl_count=3, rules_count=[3, 5, 4])) + self.apply_macip_rules(self.create_rules(acl_count=3, + rules_count=[3, 5, 4])) intf.append(VppLoInterface(self, 0)) intf.append(VppLoInterface(self, 1)) @@ -942,19 +1138,85 @@ class TestMACIP(VppTestCase): self.assertEqual(len([x for x in reply.acls if x != 4294967295]), 0) - def test_acl_routed_ip4_wildMAC_wildIP(self): - """ IP4 MACIP wildcardMAC|wildIP ACL - """ - self.run_traffic(self.WILD_MAC, self.WILD_IP, - self.ROUTED, self.IS_IP4, 9) +class TestACL_dot1q_bridged(MethodHolder): + """ACL on dot1q bridged subinterfaces Tests""" - def test_acl_routed_ip6_wildMAC_wildIP(self): - """ IP6 MACIP wildcardMAC|wildIP ACL - """ + def test_acl_bridged_ip4_subif_dot1q(self): + """ IP4 ACL SubIf Dot1Q bridged traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED, + self.IS_IP4, 9, tags=self.DOT1Q, isMACIP=False) - self.run_traffic(self.WILD_MAC, self.WILD_IP, - self.ROUTED, self.IS_IP6, 9) + def test_acl_bridged_ip6_subif_dot1q(self): + """ IP6 ACL SubIf Dot1Q bridged traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED, + self.IS_IP6, 9, tags=self.DOT1Q, isMACIP=False) + + +class TestACL_dot1ad_bridged(MethodHolder): + """ACL on dot1ad bridged subinterfaces Tests""" + + def test_acl_bridged_ip4_subif_dot1ad(self): + """ IP4 ACL SubIf Dot1AD bridged traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED, + self.IS_IP4, 9, tags=self.DOT1AD, isMACIP=False) + + def test_acl_bridged_ip6_subif_dot1ad(self): + """ IP6 ACL SubIf Dot1AD bridged traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED, + self.IS_IP6, 9, tags=self.DOT1AD, isMACIP=False) + + +class TestACL_dot1q_routed(MethodHolder): + """ACL on dot1q routed subinterfaces Tests""" + + def test_acl_routed_ip4_subif_dot1q(self): + """ IP4 ACL SubIf Dot1Q routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP4, 9, tags=self.DOT1Q, isMACIP=False) + + def test_acl_routed_ip6_subif_dot1q(self): + """ IP6 ACL SubIf Dot1Q routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP6, 9, tags=self.DOT1Q, isMACIP=False) + + def test_acl_routed_ip4_subif_dot1q_deny_by_tags(self): + """ IP4 ACL SubIf wrong tags Dot1Q routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP4, 9, True, tags=self.DOT1Q, isMACIP=False, + permit_tags=self.DENY_TAGS) + + def test_acl_routed_ip6_subif_dot1q_deny_by_tags(self): + """ IP6 ACL SubIf wrong tags Dot1Q routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP6, 9, True, tags=self.DOT1Q, isMACIP=False, + permit_tags=self.DENY_TAGS) + + +class TestACL_dot1ad_routed(MethodHolder): + """ACL on dot1ad routed subinterfaces Tests""" + + def test_acl_routed_ip6_subif_dot1ad(self): + """ IP6 ACL SubIf Dot1AD routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP6, 9, tags=self.DOT1AD, isMACIP=False) + + def test_acl_routed_ip4_subif_dot1ad(self): + """ IP4 ACL SubIf Dot1AD routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP4, 9, tags=self.DOT1AD, isMACIP=False) + + def test_acl_routed_ip6_subif_dot1ad_deny_by_tags(self): + """ IP6 ACL SubIf wrong tags Dot1AD routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP6, 9, True, tags=self.DOT1AD, isMACIP=False, + permit_tags=self.DENY_TAGS) + + def test_acl_routed_ip4_subif_dot1ad_deny_by_tags(self): + """ IP4 ACL SubIf wrong tags Dot1AD routed traffic""" + self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED, + self.IS_IP4, 9, True, tags=self.DOT1AD, isMACIP=False, + permit_tags=self.DENY_TAGS) if __name__ == '__main__': diff --git a/test/vpp_papi_provider.py b/test/vpp_papi_provider.py index 495db95052e..5085ff2801e 100644 --- a/test/vpp_papi_provider.py +++ b/test/vpp_papi_provider.py @@ -2493,6 +2493,23 @@ class VppPapiProvider(object): 'acls': acls}, expected_retval=expected_retval) + def acl_interface_add_del(self, + sw_if_index, + acl_index, + is_add=1): + """ Add/Delete ACL to/from interface + + :param sw_if_index: + :param acl_index: + :param is_add: (Default value = 1) + """ + + return self.api(self.papi.acl_interface_add_del, + {'is_add': is_add, + 'is_input': 1, + 'sw_if_index': sw_if_index, + 'acl_index': acl_index}) + def acl_dump(self, acl_index, expected_retval=0): return self.api(self.papi.acl_dump, {'acl_index': acl_index}, |