resources/test_data/honeycomb/plugin_acl.py

   1 # Copyright (c) 2017 Cisco and/or its affiliates.
   2 # Licensed under the Apache License, Version 2.0 (the "License");
   3 # you may not use this file except in compliance with the License.
   4 # You may obtain a copy of the License at:
   5 #
   6 #     http://www.apache.org/licenses/LICENSE-2.0
   7 #
   8 # Unless required by applicable law or agreed to in writing, software
   9 # distributed under the License is distributed on an "AS IS" BASIS,
  10 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  11 # See the License for the specific language governing permissions and
  12 # limitations under the License.
  13
  14 """Test variables for ACL-plugin test suite."""
  15
  16
  17 def get_variables(test_case, name):
  18     """Create and return a dictionary of test variables for the specified
  19     test case.
  20
  21     :param test_case: Determines which test variables to return.
  22     :param name: Name for the classify chain used in test.
  23     :type test_case: str
  24     :type name: str
  25
  26     :returns: Dictionary of test variables - settings for Honeycomb's
  27     ietf-acl node and packet fields to use in verification.
  28     :rtype: dict
  29     :raises KeyError: If the test_case parameter is incorrect.
  30     """
  31
  32     test_case = test_case.lower()
  33     variables = {
  34         # Variables for control packet
  35         "src_ip": "16.0.0.1",
  36         "dst_ip": "16.0.1.1",
  37         "src_net": "16.0.0.0",
  38         "dst_net": "16.0.1.0",
  39         "src_port": "1234",
  40         "dst_port": "1234",
  41         "src_mac": "01:02:03:04:05:06",
  42         "dst_mac": "10:20:30:40:50:60"}
  43
  44     test_vars = {
  45         "macip": {
  46             # MACs classified directly
  47             "classify_src": "12:23:34:45:56:67",
  48             "classify_dst": "89:9A:AB:BC:CD:DE",
  49             # MACs classified through mask
  50             "classify_src2": "01:02:03:04:56:67",
  51             "classify_dst2": "89:9A:AB:BC:50:60",
  52             "src_mask": "00:00:00:00:FF:FF",
  53             "dst_mask": "FF:FF:FF:FF:00:00"
  54         },
  55         "l3_ip4": {
  56             # IPs for DUT interface setup
  57             "dut_to_tg_if1_ip": "16.0.0.2",
  58             "dut_to_tg_if2_ip": "192.168.0.2",
  59             "prefix_length": 24,
  60             "gateway": "192.168.0.1",
  61             # classified networks
  62             "classify_src_net": "16.0.2.0",
  63             "classify_dst_net": "16.0.3.0",
  64             # IPs in classified networks
  65             "classify_src": "16.0.2.1",
  66             "classify_dst": "16.0.3.1",
  67         },
  68         "l3_ip6": {
  69             # Override control packet addresses with IPv6
  70             "src_ip": "10::1",
  71             "dst_ip": "11::1",
  72             "dst_net": "11::",
  73             # IPs for DUT interface setup
  74             "dut_to_tg_if1_ip": "10::2",
  75             "dut_to_tg_if2_ip": "20::2",
  76             "prefix_length": 64,
  77             "gateway": "20::1",
  78             # classified networks
  79             "classify_src_net": "12::",
  80             "classify_dst_net": "13::",
  81             # IPs in classified networks
  82             "classify_src": "12::1",
  83             "classify_dst": "13::1",
  84         },
  85         "l4": {
  86             # IPs for DUT interface and route setup
  87             "dut_to_tg_if1_ip": "16.0.0.2",
  88             "dut_to_tg_if2_ip": "192.168.0.2",
  89             "prefix_length": 24,
  90             "gateway": "192.168.0.1",
  91             "classify_dst_net": "16.0.3.0",
  92             # Ports in classified ranges
  93             "classify_src": 60000,
  94             "classify_dst": 61000,
  95         },
  96         "mixed": {
  97             # IPs for DUT interface and route setup
  98             "dut_to_tg_if1_ip": "16.0.0.2",
  99             "dut_to_tg_if2_ip": "192.168.0.2",
 100             "prefix_length": 24,
 101             "gateway": "192.168.0.1",
 102             "classify_dst_net": "16.0.3.0",
 103             # IPs in classified networks
 104             "classify_src_ip": "16.0.2.1",
 105             "classify_dst_ip": "16.0.3.1",
 106             # Ports in classified ranges
 107             "classify_src_port": 60000,
 108             "classify_dst_port": 61000,
 109         },
 110         "icmp": {
 111             # ICMP code and type for control packet
 112             "icmp_type": 0,
 113             "icmp_code": 0,
 114             # classified ICMP code and type
 115             "classify_type": 3,
 116             "classify_code": 3
 117
 118         },
 119         "icmpv6": {
 120             # Override control packet addresses with IPv6
 121             "src_ip": "10::1",
 122             "dst_ip": "11::1",
 123             "dst_net": "11::",
 124             # IPs for DUT interface setup
 125             "dut_to_tg_if1_ip": "10::2",
 126             "dut_to_tg_if2_ip": "20::2",
 127             "prefix_length": 64,
 128             "gateway": "20::1",
 129             # classified networks
 130             "classify_src_net": "12::",
 131             "classify_dst_net": "13::",
 132             # ICMP code and type for control packet
 133             "icmp_type": 1,
 134             "icmp_code": 0,
 135             # classified ICMP code and type
 136             "classify_type": 4,
 137             "classify_code": 2
 138
 139         },
 140         "reflex": {
 141             # IPs for DUT interface setup
 142             "dut_to_tg_if1_ip": "16.0.0.2",
 143             "dut_to_tg_if2_ip": "192.168.0.2",
 144             "prefix_length": 24,
 145             "gateway": "192.168.0.1",
 146             "gateway2": "192.168.0.1",
 147             # classified networks
 148             "classify_src_net": "16.0.2.0",
 149             "classify_dst_net": "16.0.3.0",
 150             # IPs in classified networks
 151             "classify_src": "16.0.2.1",
 152             "classify_dst": "16.0.3.1",
 153         },
 154         "block_all": {}
 155     }
 156     acl_data = {
 157         # ACL configuration for L2 tests
 158
 159         "macip": {
 160             "acl": [{
 161                 "name": name,
 162                 "type": "vpp-acl:vpp-macip-acl",
 163                 "aces": {
 164                     "ace": [
 165                         {
 166                             "name": "rule1",
 167                             "matches": {
 168
 169                                 "eth": {
 170                                     "source-mac-address": test_vars["macip"]["classify_src"],
 171                                     "source-mac-address-mask": test_vars["macip"]["src_mask"]
 172                                 },
 173                                 "ipv4": {
 174
 175                                     "source-ipv4-network": "16.0.0.0/24"
 176                                 }
 177                             },
 178
 179                             "actions": {
 180                                 "forwarding": "ietf-access-control-list:drop"
 181                             }
 182                         },
 183                         {
 184                             "name": "rule_all",
 185                             "matches": {
 186
 187                                 "eth": {
 188                                     "source-mac-address": test_vars["macip"]["classify_src"],
 189                                     "source-mac-address-mask": "00:00:00:00:00:00"
 190                                 },
 191
 192                                 "ipv4": {
 193                                     "source-ipv4-network": "0.0.0.0/0"
 194                                 }
 195                             },
 196                             "actions": {
 197                                 "forwarding": "ietf-access-control-list:accept"
 198                             }
 199                         }
 200                     ]}
 201                 }
 202             ]
 203         },
 204         # ACL configuration for L3 IPv4 tests
 205         "l3_ip4": {
 206             "acl": [
 207                 {
 208                     "name": name,
 209                     "type": "vpp-acl:vpp-acl",
 210                     "aces": {
 211                         "ace": [
 212                             {
 213                                 "name": "rule1",
 214                                 "matches": {
 215                                     "ipv4": {
 216                                         "destination-ipv4-network": "{0}/{1}".format(
 217                                             test_vars["l3_ip4"]["classify_dst_net"],
 218                                             test_vars["l3_ip4"]["prefix_length"]),
 219                                         "source-ipv4-network": "{0}/{1}".format(
 220                                             test_vars["l3_ip4"]["classify_src_net"],
 221                                             test_vars["l3_ip4"]["prefix_length"])
 222                                     },
 223                                     "udp":{
 224                                         "source-port": {
 225                                             "lower-port": "0",
 226                                             "upper-port": "65535"
 227                                         },
 228                                         "destination-port": {
 229                                             "lower-port": "0",
 230                                             "upper-port": "65535"
 231                                         }
 232                                     }
 233                                 },
 234                                 "actions": {
 235                                     "forwarding": "ietf-access-control-list:drop"
 236                                 }
 237                             },
 238                             {
 239                                 "name": "rule_all",
 240                                 "matches": {
 241                                     "ipv4": {
 242                                         "destination-ipv4-network": "0.0.0.0/0",
 243                                         "source-ipv4-network": "0.0.0.0/0"
 244                                     }
 245                                 },
 246                                 "actions": {
 247                                     "forwarding": "ietf-access-control-list:accept"
 248                                 }
 249                             }
 250                         ]
 251                     }
 252                 }
 253             ]
 254         },
 255         # ACL settings for L3 IPv6 tests
 256         "l3_ip6": {
 257             "acl": [
 258                 {
 259                     "name": name,
 260                     "type": "vpp-acl:vpp-acl",
 261                     "aces": {
 262                         "ace": [
 263                             {
 264                                 "name": "rule1",
 265                                 "matches": {
 266                                     "ipv6": {
 267                                         "destination-ipv6-network": "{0}/{1}".format(
 268                                             test_vars["l3_ip6"]["classify_dst_net"],
 269                                             test_vars["l3_ip6"]["prefix_length"]),
 270                                         "source-ipv6-network": "{0}/{1}".format(
 271                                             test_vars["l3_ip6"]["classify_src_net"],
 272                                             test_vars["l3_ip6"]["prefix_length"])
 273                                     },
 274                                     "udp":{
 275                                         "source-port": {
 276                                             "lower-port": "0",
 277                                             "upper-port": "65535"
 278                                         },
 279                                         "destination-port": {
 280                                             "lower-port": "0",
 281                                             "upper-port": "65535"
 282                                         }
 283                                     }
 284                                 },
 285                                 "actions": {
 286                                     "forwarding": "ietf-access-control-list:drop"
 287                                 }
 288                             },
 289                             {
 290                                 "name": "rule_all",
 291                                 "matches": {
 292                                     "ipv6": {
 293                                         "destination-ipv6-network": "0::0/0",
 294                                         "source-ipv6-network": "0::0/0"
 295                                     }
 296                                 },
 297                                 "actions": {
 298                                     "forwarding": "ietf-access-control-list:accept"
 299                                 }
 300                             }
 301                         ]
 302                     }
 303                 }
 304             ]
 305         },
 306         # ACL configuration for L4 tests
 307         "l4": {
 308             "acl": [
 309                 {
 310                     "name": name,
 311                     "type": "vpp-acl:vpp-acl",
 312                     "aces": {
 313                         "ace": [
 314                             {
 315                                 "name": "rule1",
 316                                 "matches": {
 317                                     "ipv4": {
 318                                         "source-ipv4-network": "0.0.0.0/0"
 319                                     },
 320                                     "tcp": {
 321                                         "source-port": {
 322                                             "lower-port": test_vars["l4"]["classify_src"],
 323                                             "upper-port": test_vars["l4"]["classify_src"] + 10
 324                                         },
 325                                         "destination-port":{
 326                                             "lower-port": test_vars["l4"]["classify_dst"],
 327                                             "upper-port": test_vars["l4"]["classify_dst"] + 10
 328                                         }
 329                                     }
 330                                 },
 331                                 "actions":{
 332                                     "forwarding": "ietf-access-control-list:drop"
 333                                 }
 334                             },
 335                             {
 336                                 "name": "rule_all",
 337                                 "matches": {
 338                                     "ipv4": {
 339                                         "source-ipv4-network": "0.0.0.0/0",
 340                                         "destination-ipv4-network": "0.0.0.0/0"
 341                                     }
 342                                 },
 343                                 "actions": {
 344                                     "forwarding": "ietf-access-control-list:accept"
 345                                 }
 346                             }
 347                         ]
 348                     }
 349                 }
 350             ]
 351         },
 352         "mixed": {
 353             "acl": [
 354                 {
 355                     "name": name,
 356                     "type": "vpp-acl:vpp-acl",
 357                     "aces": {
 358                         "ace": [
 359                             {
 360                                 "name": "ports",
 361                                 "matches": {
 362                                     "ipv4": {
 363                                         "source-ipv4-network": "0.0.0.0/0"
 364                                     },
 365                                     "tcp": {
 366                                         "source-port": {
 367                                             "lower-port": test_vars["l4"]["classify_src"],
 368                                             "upper-port": test_vars["l4"]["classify_src"] + 10
 369                                         },
 370                                         "destination-port":{
 371                                             "lower-port": test_vars["l4"]["classify_dst"],
 372                                             "upper-port": test_vars["l4"]["classify_dst"] + 10
 373                                         }
 374                                     }
 375                                 },
 376                                 "actions":{
 377                                     "forwarding": "ietf-access-control-list:drop"
 378                                 }
 379                             },
 380                             {
 381                                 "name": "rule_all",
 382                                 "matches": {
 383                                     "ipv4": {
 384                                         "destination-ipv4-network": "0.0.0.0/0",
 385                                         "source-ipv4-network": "0.0.0.0/0"
 386                                     }
 387                                 },
 388                                 "actions": {
 389                                     "forwarding": "ietf-access-control-list:accept"
 390                                 }
 391                             }
 392                         ]
 393                     }
 394                 }
 395             ]
 396         },
 397         "icmp": {
 398             "acl": [
 399                 {
 400                     "name": name,
 401                     "type": "vpp-acl:vpp-acl",
 402                     "aces": {
 403                         "ace": [
 404                             {
 405                                 "name": "rule1",
 406                                 "matches": {
 407                                     "ipv4": {
 408                                         "source-ipv4-network": "0.0.0.0/0"
 409                                     },
 410                                     "icmp": {
 411                                         "vpp-acl:vpp-icmp-ace": {
 412                                             "vpp-acl:icmp-type-range": {
 413                                                 "first": "1",
 414                                                 "last": "5"
 415                                             },
 416                                             "vpp-acl:icmp-code-range": {
 417                                                 "first": "1",
 418                                                 "last": "5"
 419                                             }
 420                                         }
 421                                     }
 422                                 },
 423                                 "actions": {
 424                                     "forwarding": "ietf-access-control-list:drop"
 425                                 }
 426                             },
 427                             {
 428                                 "name": "rule_all",
 429                                 "matches": {
 430                                     "ipv4": {
 431                                         "source-ipv4-network": "0.0.0.0/0",
 432                                         "destination-ipv4-network": "0.0.0.0/0"
 433                                     }
 434                                 },
 435                                 "actions": {
 436                                     "forwarding": "ietf-access-control-list:accept"
 437                                 }
 438                             }
 439                         ]
 440                     }
 441                 }
 442             ]
 443         },
 444         "icmpv6": {
 445             "acl": [
 446                 {
 447                     "name": name,
 448                     "type": "vpp-acl:vpp-acl",
 449                     "aces": {
 450                         "ace": [
 451                             {
 452                                 "name": "rule1",
 453                                 "matches": {
 454                                     "ipv6": {
 455                                         "source-ipv6-network": "::/0",
 456                                     },
 457                                     "icmp": {
 458                                         "vpp-acl:vpp-icmp-ace": {
 459                                             "vpp-acl:icmp-type-range": {
 460                                                 "first": "1",
 461                                                 "last": "5"
 462                                             },
 463                                             "vpp-acl:icmp-code-range": {
 464                                                 "first": "1",
 465                                                 "last": "5"
 466                                             }
 467                                         }
 468                                     }
 469                                 },
 470                                 "actions": {
 471                                     "forwarding": "ietf-access-control-list:drop"
 472                                 }
 473                             },
 474                             {
 475                                 "name": "rule_all",
 476                                 "matches": {
 477                                     "ipv6": {
 478                                         "destination-ipv6-network": "0::0/0",
 479                                         "source-ipv6-network": "::/0",
 480                                     }
 481                                 },
 482                                 "actions": {
 483                                     "forwarding": "ietf-access-control-list:accept"
 484                                 }
 485                             }
 486                         ]
 487                     }
 488                 }
 489             ]
 490         },
 491         "reflex": {
 492             "acl": [
 493                 {
 494                     "name": name,
 495                     "type": "vpp-acl:vpp-acl",
 496                     "aces": {
 497                         "ace": [
 498                             {
 499                                 "name": "rule1",
 500                                 "matches": {
 501                                     "ipv4": {
 502                                         "destination-ipv4-network": "{0}/{1}".format(
 503                                             test_vars["reflex"]["classify_src_net"],
 504                                             test_vars["reflex"]["prefix_length"]),
 505                                         "source-ipv4-network": "{0}/{1}".format(
 506                                             test_vars["reflex"]["classify_dst_net"],
 507                                             test_vars["reflex"]["prefix_length"])
 508                                     }
 509                                 },
 510                                 "actions": {
 511                                     "forwarding": "vpp-acl:accept-and-reflect"
 512                                 }
 513                             }
 514                         ]
 515                     }
 516                 }
 517             ]
 518         },
 519         "block_all": {
 520             "acl": [
 521                 {
 522                     "name": name,
 523                     "type": "vpp-acl:vpp-acl",
 524                     "aces": {
 525                         "ace": [
 526                             {
 527                                 "name": "rule_all",
 528                                 "matches": {
 529                                     "ipv4": {
 530                                         "destination-ipv4-network": "0.0.0.0/0",
 531                                         "source-ipv4-network": "0.0.0.0/0"
 532                                     }
 533                                 },
 534                                 "actions": {
 535                                     "forwarding": "ietf-access-control-list:drop"
 536                                 }
 537                             }
 538                         ]
 539                     }
 540                 }
 541             ]
 542         },
 543     }
 544
 545     try:
 546         ret_vars = {}
 547         ret_vars.update(variables)
 548         ret_vars.update(test_vars[test_case])
 549         ret_vars.update(
 550             {"acl_settings": acl_data[test_case]}
 551         )
 552     except KeyError:
 553         raise KeyError(
 554             "Unrecognized test case {0}. Valid options are: {1}".format(
 555                 test_case, acl_data.keys()))
 556     return ret_vars