return rule
def apply_rules(self, rules, tag=''):
- reply = self.api_acl_add_replace(acl_index=4294967295, r=rules,
- count=len(rules),
- tag=tag)
+ reply = self.vapi.acl_add_replace(acl_index=4294967295, r=rules,
+ tag=tag)
self.logger.info("Dumped ACL: " + str(
- self.api_acl_dump(reply.acl_index)))
+ self.vapi.acl_dump(reply.acl_index)))
# Apply a ACL on the interface as inbound
for i in self.pg_interfaces:
- self.api_acl_interface_set_acl_list(sw_if_index=i.sw_if_index,
- count=1, n_input=1,
- acls=[reply.acl_index])
+ self.vapi.acl_interface_set_acl_list(sw_if_index=i.sw_if_index,
+ n_input=1,
+ acls=[reply.acl_index])
return
def create_upper_layer(self, packet_index, proto, ports=0):
capture = dst_if.get_capture(0)
self.assertEqual(len(capture), 0)
- def api_acl_add_replace(self, acl_index, r, count, tag='',
- expected_retval=0):
- """Add/replace an ACL
-
- :param int acl_index: ACL index to replace,
- 4294967295 to create new ACL.
- :param acl_rule r: ACL rules array.
- :param str tag: symbolic tag (description) for this ACL.
- :param int count: number of rules.
- """
- return self.vapi.api(self.vapi.papi.acl_add_replace,
- {'acl_index': acl_index,
- 'r': r,
- 'count': count,
- 'tag': tag},
- expected_retval=expected_retval)
-
- def api_acl_interface_set_acl_list(self, sw_if_index, count, n_input, acls,
- expected_retval=0):
- return self.vapi.api(self.vapi.papi.acl_interface_set_acl_list,
- {'sw_if_index': sw_if_index,
- 'count': count,
- 'n_input': n_input,
- 'acls': acls},
- expected_retval=expected_retval)
-
- def api_acl_dump(self, acl_index, expected_retval=0):
- return self.vapi.api(self.vapi.papi.acl_dump,
- {'acl_index': acl_index},
- expected_retval=expected_retval)
-
def test_0000_warmup_test(self):
""" ACL plugin version check; learn MACs
"""
# self.assertEqual(reply.minor, 0)
def test_0001_acl_create(self):
- """ ACL create test
+ """ ACL create/delete test
"""
self.logger.info("ACLP_TEST_START_0001")
'dst_ip_addr': '\x00\x00\x00\x00',
'dst_ip_prefix_len': 0}]
# Test 1: add a new ACL
- reply = self.api_acl_add_replace(acl_index=4294967295, r=r,
- count=len(r), tag="permit 1234")
+ reply = self.vapi.acl_add_replace(acl_index=4294967295, r=r,
+ tag="permit 1234")
self.assertEqual(reply.retval, 0)
# The very first ACL gets #0
self.assertEqual(reply.acl_index, 0)
- rr = self.api_acl_dump(reply.acl_index)
+ first_acl = reply.acl_index
+ rr = self.vapi.acl_dump(reply.acl_index)
self.logger.info("Dumped ACL: " + str(rr))
self.assertEqual(len(rr), 1)
# We should have the same number of ACL entries as we had asked
'dst_ip_addr': '\x00\x00\x00\x00',
'dst_ip_prefix_len': 0})
- reply = self.api_acl_add_replace(acl_index=4294967295, r=r_deny,
- count=len(r_deny),
- tag="deny 1234;permit all")
+ reply = self.vapi.acl_add_replace(acl_index=4294967295, r=r_deny,
+ tag="deny 1234;permit all")
self.assertEqual(reply.retval, 0)
# The second ACL gets #1
self.assertEqual(reply.acl_index, 1)
+ second_acl = reply.acl_index
# Test 2: try to modify a nonexistent ACL
- reply = self.api_acl_add_replace(acl_index=432, r=r, count=len(r),
- tag="FFFF:FFFF", expected_retval=-1)
+ reply = self.vapi.acl_add_replace(acl_index=432, r=r,
+ tag="FFFF:FFFF", expected_retval=-1)
self.assertEqual(reply.retval, -1)
# The ACL number should pass through
self.assertEqual(reply.acl_index, 432)
+ # apply an ACL on an interface inbound, try to delete ACL, must fail
+ self.vapi.acl_interface_set_acl_list(sw_if_index=self.pg0.sw_if_index,
+ n_input=1,
+ acls=[first_acl])
+ reply = self.vapi.acl_del(acl_index=first_acl, expected_retval=-1)
+ # Unapply an ACL and then try to delete it - must be ok
+ self.vapi.acl_interface_set_acl_list(sw_if_index=self.pg0.sw_if_index,
+ n_input=0,
+ acls=[])
+ reply = self.vapi.acl_del(acl_index=first_acl, expected_retval=0)
+
+ # apply an ACL on an interface outbound, try to delete ACL, must fail
+ self.vapi.acl_interface_set_acl_list(sw_if_index=self.pg0.sw_if_index,
+ n_input=0,
+ acls=[second_acl])
+ reply = self.vapi.acl_del(acl_index=second_acl, expected_retval=-1)
+ # Unapply the ACL and then try to delete it - must be ok
+ self.vapi.acl_interface_set_acl_list(sw_if_index=self.pg0.sw_if_index,
+ n_input=0,
+ acls=[])
+ reply = self.vapi.acl_del(acl_index=second_acl, expected_retval=0)
+
+ # try to apply a nonexistent ACL - must fail
+ self.vapi.acl_interface_set_acl_list(sw_if_index=self.pg0.sw_if_index,
+ n_input=1,
+ acls=[first_acl],
+ expected_retval=-1)
self.logger.info("ACLP_TEST_FINISH_0001")
for i in range(len(r)):
rules.append(self.create_rule(r[i][0], r[i][1], r[i][2], r[i][3]))
- reply = self.api_acl_add_replace(acl_index=4294967295, r=rules,
- count=len(rules))
- result = self.api_acl_dump(reply.acl_index)
+ reply = self.vapi.acl_add_replace(acl_index=4294967295, r=rules)
+ result = self.vapi.acl_dump(reply.acl_index)
i = 0
for drules in result:
Code Review / vpp.git / blobdiff