resources/test_data/honeycomb/plugin_acl.py

   1 # Copyright (c) 2017 Cisco and/or its affiliates.
   2 # Licensed under the Apache License, Version 2.0 (the "License");
   3 # you may not use this file except in compliance with the License.
   4 # You may obtain a copy of the License at:
   5 #
   6 #     http://www.apache.org/licenses/LICENSE-2.0
   7 #
   8 # Unless required by applicable law or agreed to in writing, software
   9 # distributed under the License is distributed on an "AS IS" BASIS,
  10 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  11 # See the License for the specific language governing permissions and
  12 # limitations under the License.
  13
  14 """Test variables for ACL-plugin test suite."""
  15
  16
  17 def get_variables(test_case, name):
  18     """Create and return a dictionary of test variables for the specified
  19     test case.
  20
  21     :param test_case: Determines which test variables to return.
  22     :param name: Name for the classify chain used in test.
  23     :type test_case: str
  24     :type name: str
  25
  26     :returns: Dictionary of test variables - settings for Honeycomb's
  27     ietf-acl node and packet fields to use in verification.
  28     :rtype: dict
  29     :raises KeyError: If the test_case parameter is incorrect.
  30     """
  31
  32     test_case = test_case.lower()
  33     variables = {
  34         # Variables for control packet
  35         "src_ip": "16.0.0.1",
  36         "dst_ip": "16.0.1.1",
  37         "src_net": "16.0.0.0",
  38         "dst_net": "16.0.1.0",
  39         "src_port": "1234",
  40         "dst_port": "1234",
  41         "src_mac": "01:02:03:04:05:06",
  42         "dst_mac": "10:20:30:40:50:60"}
  43
  44     test_vars = {
  45         "macip": {
  46             # MACs classified directly
  47             "classify_src": "12:23:34:45:56:67",
  48             "classify_dst": "89:9A:AB:BC:CD:DE",
  49             # MACs classified through mask
  50             "classify_src2": "01:02:03:04:56:67",
  51             "classify_dst2": "89:9A:AB:BC:50:60",
  52             "src_mask": "00:00:00:00:FF:FF",
  53             "dst_mask": "FF:FF:FF:FF:00:00"
  54         },
  55         "l3_ip4": {
  56             # IPs for DUT interface setup
  57             "dut_to_tg_if1_ip": "16.0.0.2",
  58             "dut_to_tg_if2_ip": "192.168.0.2",
  59             "prefix_length": 24,
  60             "gateway": "192.168.0.1",
  61             # classified networks
  62             "classify_src_net": "16.0.2.0",
  63             "classify_dst_net": "16.0.3.0",
  64             # IPs in classified networks
  65             "classify_src": "16.0.2.1",
  66             "classify_dst": "16.0.3.1",
  67         },
  68         "l3_ip6": {
  69             # Override control packet addresses with IPv6
  70             "src_ip": "10::1",
  71             "dst_ip": "11::1",
  72             "dst_net": "11::",
  73             # IPs for DUT interface setup
  74             "dut_to_tg_if1_ip": "10::2",
  75             "dut_to_tg_if2_ip": "20::2",
  76             "prefix_length": 64,
  77             "gateway": "20::1",
  78             # classified networks
  79             "classify_src_net": "12::",
  80             "classify_dst_net": "13::",
  81             # IPs in classified networks
  82             "classify_src": "12::1",
  83             "classify_dst": "13::1",
  84         },
  85         "l4": {
  86             # IPs for DUT interface and route setup
  87             "dut_to_tg_if1_ip": "16.0.0.2",
  88             "dut_to_tg_if2_ip": "192.168.0.2",
  89             "prefix_length": 24,
  90             "gateway": "192.168.0.1",
  91             "classify_dst_net": "16.0.3.0",
  92             # Ports in classified ranges
  93             "classify_src": 60000,
  94             "classify_dst": 61000,
  95         },
  96         "mixed": {
  97             # IPs for DUT interface and route setup
  98             "dut_to_tg_if1_ip": "16.0.0.2",
  99             "dut_to_tg_if2_ip": "192.168.0.2",
 100             "prefix_length": 24,
 101             "gateway": "192.168.0.1",
 102             "classify_dst_net": "16.0.3.0",
 103             # IPs in classified networks
 104             "classify_src_ip": "16.0.2.1",
 105             "classify_dst_ip": "16.0.3.1",
 106             # Ports in classified ranges
 107             "classify_src_port": 60000,
 108             "classify_dst_port": 61000,
 109         },
 110         "icmp": {
 111             # ICMP code and type for control packet
 112             "icmp_type": 0,
 113             "icmp_code": 0,
 114             # classified ICMP code and type
 115             "classify_type": 3,
 116             "classify_code": 3
 117
 118         },
 119         "icmpv6": {
 120             # Override control packet addresses with IPv6
 121             "src_ip": "10::1",
 122             "dst_ip": "11::1",
 123             "dst_net": "11::",
 124             # IPs for DUT interface setup
 125             "dut_to_tg_if1_ip": "10::2",
 126             "dut_to_tg_if2_ip": "20::2",
 127             "prefix_length": 64,
 128             "gateway": "20::1",
 129             # ICMP code and type for control packet
 130             "icmp_type": 1,
 131             "icmp_code": 0,
 132             # classified ICMP code and type
 133             "classify_type": 4,
 134             "classify_code": 2
 135
 136         },
 137         "reflex": {
 138             # IPs for DUT interface setup
 139             "dut_to_tg_if1_ip": "16.0.0.2",
 140             "dut_to_tg_if2_ip": "192.168.0.2",
 141             "prefix_length": 24,
 142             "gateway": "192.168.0.1",
 143             "gateway2": "192.168.0.1",
 144             # classified networks
 145             "classify_src_net": "16.0.2.0",
 146             "classify_dst_net": "16.0.3.0",
 147             # IPs in classified networks
 148             "classify_src": "16.0.2.1",
 149             "classify_dst": "16.0.3.1",
 150         },
 151         "block_all": {}
 152     }
 153     acl_data = {
 154         # ACL configuration for L2 tests
 155         "macip": {
 156             "acl": [{
 157                 "acl-type":
 158                     "vpp-acl:vpp-macip-acl",
 159                 "acl-name": name,
 160                 "access-list-entries": {"ace": [
 161                     {
 162                         "rule-name": "rule1",
 163                         "matches": {
 164                             "vpp-macip-ace-nodes": {
 165                                 "source-mac-address":
 166                                     test_vars["macip"]["classify_src"],
 167                                 "source-mac-address-mask":
 168                                     test_vars["macip"]["src_mask"],
 169                                 "source-ipv4-network": "16.0.0.0/24"
 170                             }
 171                         },
 172                         "actions": {
 173                             "deny": {}
 174                         }
 175                     },
 176                     {
 177                         "rule-name": "rule_all",
 178                         "matches": {
 179                             "vpp-macip-ace-nodes": {
 180                                 "source-mac-address":
 181                                     test_vars["macip"]["classify_src"],
 182                                 "source-mac-address-mask": "00:00:00:00:00:00",
 183                                 "source-ipv4-network": "0.0.0.0/0"
 184                             }
 185                         },
 186                         "actions": {
 187                             "permit": {}
 188                         }
 189                     },
 190                 ]}
 191             }]
 192         },
 193         # ACL configuration for L3 IPv4 tests
 194         "l3_ip4": {
 195             "acl": [{
 196                 "acl-type":
 197                     "vpp-acl:vpp-acl",
 198                 "acl-name": name,
 199                 "access-list-entries": {"ace": [
 200                     {
 201                         "rule-name": "rule1",
 202                         "matches": {
 203                             "vpp-ace-nodes": {
 204                                 "source-ipv4-network":
 205                                     "{0}/{1}".format(
 206                                         test_vars["l3_ip4"]["classify_src_net"],
 207                                         test_vars["l3_ip4"]["prefix_length"]),
 208                                 "destination-ipv4-network":
 209                                     "{0}/{1}".format(
 210                                         test_vars["l3_ip4"]["classify_dst_net"],
 211                                         test_vars["l3_ip4"]["prefix_length"]),
 212                                 "udp-nodes": {
 213                                     "source-port-range": {
 214                                         "lower-port": "0",
 215                                         "upper-port": "65535"
 216                                     },
 217                                     "destination-port-range": {
 218                                         "lower-port": "0",
 219                                         "upper-port": "65535"
 220                                     }
 221                                 }
 222                             }
 223                         },
 224                         "actions": {
 225                             "deny": {}
 226                         },
 227                     },
 228                     {
 229                         "rule-name": "rule_all",
 230                         "matches": {
 231                             "vpp-ace-nodes": {
 232                                 "source-ipv4-network": "0.0.0.0/0",
 233                                 "destination-ipv4-network": "0.0.0.0/0",
 234                             }
 235                         },
 236                         "actions": {
 237                             "permit": {}
 238                         }
 239                     }
 240                 ]}
 241             }]
 242         },
 243         # ACL settings for L3 IPv6 tests
 244         "l3_ip6": {
 245             "acl": [{
 246                 "acl-type":
 247                     "vpp-acl:vpp-acl",
 248                 "acl-name": name,
 249                 "access-list-entries": {"ace": [
 250                     {
 251                         "rule-name": "rule1",
 252                         "matches": {
 253                             "vpp-ace-nodes": {
 254                                 "source-ipv6-network":
 255                                     "{0}/{1}".format(
 256                                         test_vars["l3_ip6"]["classify_src_net"],
 257                                         test_vars["l3_ip6"]["prefix_length"]),
 258                                 "destination-ipv6-network":
 259                                     "{0}/{1}".format(
 260                                         test_vars["l3_ip6"]["classify_dst_net"],
 261                                         test_vars["l3_ip6"]["prefix_length"]),
 262                                 "udp-nodes": {
 263                                     "source-port-range": {
 264                                         "lower-port": "0",
 265                                         "upper-port": "65535"
 266                                     },
 267                                     "destination-port-range": {
 268                                         "lower-port": "0",
 269                                         "upper-port": "65535"
 270                                     }
 271                                 }
 272                             }
 273                         },
 274                         "actions": {
 275                             "deny": {}
 276                         }
 277                     },
 278                     {
 279                         "rule-name": "rule_all",
 280                         "matches": {
 281                             "vpp-ace-nodes": {
 282                                 "source-ipv6-network": "0::0/0",
 283                                 "destination-ipv6-network": "0::0/0",
 284                             }
 285                         },
 286                         "actions": {
 287                             "permit": {}
 288                         }
 289                     }
 290                 ]}
 291             }]
 292         },
 293         # ACL configuration for L4 tests
 294         "l4": {
 295             "acl": [{
 296                 "acl-type":
 297                     "vpp-acl:vpp-acl",
 298                 "acl-name": name,
 299                 "access-list-entries": {"ace": [{
 300                     "rule-name": "rule1",
 301                     "matches": {
 302                         "vpp-ace-nodes": {
 303                             "source-ipv4-network": "0.0.0.0/0",
 304                             "tcp-nodes": {
 305                                 "destination-port-range": {
 306                                     "lower-port":
 307                                         test_vars["l4"]["classify_dst"],
 308                                     "upper-port":
 309                                         test_vars["l4"]["classify_dst"] + 10
 310                                 },
 311                                 "source-port-range": {
 312                                     "lower-port":
 313                                         test_vars["l4"]["classify_src"],
 314                                     "upper-port":
 315                                         test_vars["l4"]["classify_src"] + 10
 316                                 }
 317                             }
 318                         }
 319                     },
 320                     "actions": {
 321                         "deny": {}
 322                     },
 323                 },
 324                     {
 325                         "rule-name": "rule_all",
 326                         "matches": {
 327                             "vpp-ace-nodes": {
 328                                 "source-ipv4-network": "0.0.0.0/0",
 329                                 "destination-ipv4-network": "0.0.0.0/0",
 330                             }
 331                         },
 332                         "actions": {
 333                             "permit": {}
 334                         }
 335                     }
 336                 ]}
 337             }]
 338         },
 339         "mixed": {
 340             "acl": [{
 341                 "acl-type":
 342                     "vpp-acl:vpp-acl",
 343                 "acl-name": name,
 344                 "access-list-entries": {"ace": [{
 345                     "rule-name": "ports",
 346                     "matches": {
 347                         "vpp-ace-nodes": {
 348                             "source-ipv4-network": "0.0.0.0/0",
 349                             "tcp-nodes": {
 350                                 "destination-port-range": {
 351                                     "lower-port":
 352                                         test_vars["l4"]["classify_dst"],
 353                                     "upper-port":
 354                                         test_vars["l4"]["classify_dst"] + 10
 355                                 },
 356                                 "source-port-range": {
 357                                     "lower-port":
 358                                         test_vars["l4"]["classify_src"],
 359                                     "upper-port":
 360                                         test_vars["l4"]["classify_src"] + 10
 361                                 }
 362                             }
 363                         }
 364                     },
 365                     "actions": {
 366                         "deny": {}
 367                     },
 368                 },
 369                     {
 370                         "rule-name": "rule_all",
 371                         "matches": {
 372                             "vpp-ace-nodes": {
 373                                 "source-ipv4-network": "0.0.0.0/0",
 374                                 "destination-ipv4-network": "0.0.0.0/0",
 375                             }
 376                         },
 377                         "actions": {
 378                             "permit": {}
 379                         }
 380                     }
 381                 ]}
 382             }]
 383         },
 384         "icmp": {
 385             "acl": [{
 386                 "acl-type":
 387                     "vpp-acl:vpp-acl",
 388                 "acl-name": name,
 389                 "access-list-entries": {"ace": [
 390                     {
 391                         "rule-name": "rule1",
 392                         "matches": {
 393                             "vpp-ace-nodes": {
 394                                 "source-ipv4-network": "0.0.0.0/0",
 395                                 "icmp-nodes": {
 396                                     "icmp-type-range": {
 397                                         "first": "1",
 398                                         "last": "5"
 399                                     },
 400                                     "icmp-code-range": {
 401                                         "first": "1",
 402                                         "last": "5"
 403                                     }
 404                                 }
 405                             }
 406                         },
 407                         "actions": {
 408                             "deny": {}
 409                         },
 410                     },
 411                     {
 412                         "rule-name": "rule_all",
 413                         "matches": {
 414                             "vpp-ace-nodes": {
 415                                 "source-ipv4-network": "0.0.0.0/0",
 416                                 "destination-ipv4-network": "0.0.0.0/0",
 417                             }
 418                         },
 419                         "actions": {
 420                             "permit": {}
 421                         }
 422                     }
 423                 ]}
 424             }]
 425         },
 426         "icmpv6": {
 427             "acl": [{
 428                 "acl-type":
 429                     "vpp-acl:vpp-acl",
 430                 "acl-name": name,
 431                 "access-list-entries": {"ace": [
 432                     {
 433                         "rule-name": "rule1",
 434                         "matches": {
 435                             "vpp-ace-nodes": {
 436                                 "source-ipv6-network": "::/0",
 437                                 "icmp-v6-nodes": {
 438                                     "icmp-type-range": {
 439                                         "first": "1",
 440                                         "last": "5"
 441                                     },
 442                                     "icmp-code-range": {
 443                                         "first": "1",
 444                                         "last": "5"
 445                                     }
 446                                 }
 447                             }
 448                         },
 449                         "actions": {
 450                             "deny": {}
 451                         },
 452                     },
 453                     {
 454                         "rule-name": "rule_all",
 455                         "matches": {
 456                             "vpp-ace-nodes": {
 457                                 "source-ipv6-network": "0::0/0",
 458                                 "destination-ipv6-network": "0::0/0",
 459                             }
 460                         },
 461                         "actions": {
 462                             "permit": {}
 463                         }
 464                     }
 465                 ]}
 466             }]
 467         },
 468         "reflex": {
 469             "acl": [{
 470                 "acl-type":
 471                     "vpp-acl:vpp-acl",
 472                 "acl-name": name,
 473                 "access-list-entries": {"ace": [
 474                     {
 475                         "rule-name": "rule1",
 476                         "matches": {
 477                             "vpp-ace-nodes": {
 478                                 "source-ipv4-network":
 479                                     "{0}/{1}".format(
 480                                         test_vars["reflex"]["classify_dst_net"],
 481                                         test_vars["reflex"]["prefix_length"]),
 482                                 "destination-ipv4-network":
 483                                     "{0}/{1}".format(
 484                                         test_vars["reflex"]["classify_src_net"],
 485                                         test_vars["reflex"]["prefix_length"]),
 486                             }
 487                         },
 488                         "actions": {
 489                             # TODO: will be renamed in HC2VPP-57
 490                             "vpp-acl:permit": {}
 491                         },
 492                     },
 493                 ]}
 494             }]
 495         },
 496         "block_all": {
 497             "acl": [{
 498                 "acl-type":
 499                     "vpp-acl:vpp-acl",
 500                 "acl-name": name,
 501                 "access-list-entries": {"ace": [
 502                     {
 503                         "rule-name": "rule_all",
 504                         "matches": {
 505                             "vpp-ace-nodes": {
 506                                 "source-ipv4-network": "0.0.0.0/0",
 507                                 "destination-ipv4-network": "0.0.0.0/0",
 508                             }
 509                         },
 510                         "actions": {
 511                             "deny": {}
 512                         }
 513                     }
 514                 ]}
 515             }]
 516         },
 517     }
 518
 519     try:
 520         ret_vars = {}
 521         ret_vars.update(variables)
 522         ret_vars.update(test_vars[test_case])
 523         ret_vars.update(
 524             {"acl_settings": acl_data[test_case]}
 525         )
 526     except KeyError:
 527         raise KeyError(
 528             "Unrecognized test case {0}. Valid options are: {1}".format(
 529                 test_case, acl_data.keys()))
 530     return ret_vars