resources/test_data/honeycomb/plugin_acl.py

   1 # Copyright (c) 2017 Cisco and/or its affiliates.
   2 # Licensed under the Apache License, Version 2.0 (the "License");
   3 # you may not use this file except in compliance with the License.
   4 # You may obtain a copy of the License at:
   5 #
   6 #     http://www.apache.org/licenses/LICENSE-2.0
   7 #
   8 # Unless required by applicable law or agreed to in writing, software
   9 # distributed under the License is distributed on an "AS IS" BASIS,
  10 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  11 # See the License for the specific language governing permissions and
  12 # limitations under the License.
  13
  14 """Test variables for ACL-plugin test suite."""
  15
  16
  17 def get_variables(test_case, name):
  18     """Create and return a dictionary of test variables for the specified
  19     test case.
  20
  21     :param test_case: Determines which test variables to return.
  22     :param name: Name for the classify chain used in test.
  23     :type test_case: str
  24     :type name: str
  25
  26     :returns: Dictionary of test variables - settings for Honeycomb's
  27     ietf-acl node and packet fields to use in verification.
  28     :rtype: dict
  29     :raises KeyError: If the test_case parameter is incorrect.
  30     """
  31
  32     test_case = test_case.lower()
  33     variables = {
  34         # Variables for control packet
  35         "src_ip": "16.0.0.1",
  36         "dst_ip": "16.0.1.1",
  37         "src_net": "16.0.0.0",
  38         "dst_net": "16.0.1.0",
  39         "src_port": "1234",
  40         "dst_port": "1234",
  41         "src_mac": "01:02:03:04:05:06",
  42         "dst_mac": "10:20:30:40:50:60"}
  43
  44     test_vars = {
  45         "macip": {
  46             # MACs classified directly
  47             "classify_src": "12:23:34:45:56:67",
  48             "classify_dst": "89:9A:AB:BC:CD:DE",
  49             # MACs classified through mask
  50             "classify_src2": "01:02:03:04:56:67",
  51             "classify_dst2": "89:9A:AB:BC:50:60",
  52             "src_mask": "00:00:00:00:FF:FF",
  53             "dst_mask": "FF:FF:FF:FF:00:00"
  54         },
  55         "l3_ip4": {
  56             # IPs for DUT interface setup
  57             "dut_to_tg_if1_ip": "16.0.0.2",
  58             "dut_to_tg_if2_ip": "192.168.0.2",
  59             "prefix_length": 24,
  60             "gateway": "192.168.0.1",
  61             # classified networks
  62             "classify_src_net": "16.0.2.0",
  63             "classify_dst_net": "16.0.3.0",
  64             # IPs in classified networks
  65             "classify_src": "16.0.2.1",
  66             "classify_dst": "16.0.3.1",
  67         },
  68         "l3_ip6": {
  69             # Override control packet addresses with IPv6
  70             "src_ip": "10::1",
  71             "dst_ip": "11::1",
  72             "dst_net": "11::",
  73             # IPs for DUT interface setup
  74             "dut_to_tg_if1_ip": "10::2",
  75             "dut_to_tg_if2_ip": "20::2",
  76             "prefix_length": 64,
  77             "gateway": "20::1",
  78             # classified networks
  79             "classify_src_net": "12::",
  80             "classify_dst_net": "13::",
  81             # IPs in classified networks
  82             "classify_src": "12::1",
  83             "classify_dst": "13::1",
  84         },
  85         "l4": {
  86             # IPs for DUT interface and route setup
  87             "dut_to_tg_if1_ip": "16.0.0.2",
  88             "dut_to_tg_if2_ip": "192.168.0.2",
  89             "prefix_length": 24,
  90             "gateway": "192.168.0.1",
  91             "classify_dst_net": "16.0.3.0",
  92             # Ports in classified ranges
  93             "classify_src": 60000,
  94             "classify_dst": 61000,
  95         },
  96         "mixed": {
  97             # IPs for DUT interface and route setup
  98             "dut_to_tg_if1_ip": "16.0.0.2",
  99             "dut_to_tg_if2_ip": "192.168.0.2",
 100             "prefix_length": 24,
 101             "gateway": "192.168.0.1",
 102             "classify_dst_net": "16.0.3.0",
 103             # IPs in classified networks
 104             "classify_src_ip": "16.0.2.1",
 105             "classify_dst_ip": "16.0.3.1",
 106             # Ports in classified ranges
 107             "classify_src_port": 60000,
 108             "classify_dst_port": 61000,
 109         },
 110         "icmp": {
 111             # ICMP code and type for control packet
 112             "icmp_type": 0,
 113             "icmp_code": 0,
 114             # classified ICMP code and type
 115             "classify_type": 3,
 116             "classify_code": 3
 117
 118         },
 119         "icmpv6": {
 120             # Override control packet addresses with IPv6
 121             "src_ip": "10::1",
 122             "dst_ip": "11::1",
 123             "dst_net": "11::",
 124             # IPs for DUT interface setup
 125             "dut_to_tg_if1_ip": "10::2",
 126             "dut_to_tg_if2_ip": "20::2",
 127             "prefix_length": 64,
 128             "gateway": "20::1",
 129             # ICMP code and type for control packet
 130             "icmp_type": 1,
 131             "icmp_code": 0,
 132             # classified ICMP code and type
 133             "classify_type": 4,
 134             "classify_code": 2
 135
 136         },
 137         "reflex": {
 138             # IPs for DUT interface setup
 139             "dut_to_tg_if1_ip": "16.0.0.2",
 140             "dut_to_tg_if2_ip": "192.168.0.2",
 141             "prefix_length": 24,
 142             "gateway": "192.168.0.1",
 143             "gateway2": "192.168.0.1",
 144             # classified networks
 145             "classify_src_net": "16.0.2.0",
 146             "classify_dst_net": "16.0.3.0",
 147             # IPs in classified networks
 148             "classify_src": "16.0.2.1",
 149             "classify_dst": "16.0.3.1",
 150         },
 151         "block_all": {}
 152     }
 153     acl_data = {
 154         # ACL configuration for L2 tests
 155
 156         "macip": {
 157             "acl": [{
 158                 "name": name,
 159                 "type": "vpp-acl:vpp-macip-acl",
 160                 "aces": {
 161                     "ace": [
 162                         {
 163                             "name": "rule1",
 164                             "matches": {
 165
 166                                 "eth": {
 167                                     "source-mac-address": test_vars["macip"]["classify_src"],
 168                                     "source-mac-address-mask": test_vars["macip"]["src_mask"]
 169                                 },
 170                                 "ipv4": {
 171
 172                                     "source-ipv4-network": "16.0.0.0/24"
 173                                 }
 174                             },
 175
 176                             "actions": {
 177                                 "forwarding": "ietf-access-control-list:drop"
 178                             }
 179                         },
 180                         {
 181                             "name": "rule_all",
 182                             "matches": {
 183
 184                                 "eth": {
 185                                     "source-mac-address": test_vars["macip"]["classify_src"],
 186                                     "source-mac-address-mask": "00:00:00:00:00:00"
 187                                 },
 188
 189                                 "ipv4": {
 190                                     "source-ipv4-network": "0.0.0.0/0"
 191                                 }
 192                             },
 193                             "actions": {
 194                                 "forwarding": "ietf-access-control-list:accept"
 195                             }
 196                         }
 197                     ]}
 198                 }
 199             ]
 200         },
 201         # ACL configuration for L3 IPv4 tests
 202         "l3_ip4": {
 203             "acl": [
 204                 {
 205                     "name": name,
 206                     "type": "vpp-acl:vpp-acl",
 207                     "aces": {
 208                         "ace": [
 209                             {
 210                                 "name": "rule1",
 211                                 "matches": {
 212                                     "ipv4": {
 213                                         "destination-ipv4-network": "{0}/{1}".format(
 214                                             test_vars["l3_ip4"]["classify_dst_net"],
 215                                             test_vars["l3_ip4"]["prefix_length"]),
 216                                         "source-ipv4-network": "{0}/{1}".format(
 217                                             test_vars["l3_ip4"]["classify_src_net"],
 218                                             test_vars["l3_ip4"]["prefix_length"])
 219                                     },
 220                                     "udp":{
 221                                         "source-port": {
 222                                             "lower-port": "0",
 223                                             "upper-port": "65535"
 224                                         },
 225                                         "destination-port": {
 226                                             "lower-port": "0",
 227                                             "upper-port": "65535"
 228                                         }
 229                                     }
 230                                 },
 231                                 "actions": {
 232                                     "forwarding": "ietf-access-control-list:drop"
 233                                 }
 234                             },
 235                             {
 236                                 "name": "rule_all",
 237                                 "matches": {
 238                                     "ipv4": {
 239                                         "destination-ipv4-network": "0.0.0.0/0",
 240                                         "source-ipv4-network": "0.0.0.0/0"
 241                                     }
 242                                 },
 243                                 "actions": {
 244                                     "forwarding": "ietf-access-control-list:accept"
 245                                 }
 246                             }
 247                         ]
 248                     }
 249                 }
 250             ]
 251         },
 252         # ACL settings for L3 IPv6 tests
 253         "l3_ip6": {
 254             "acl": [
 255                 {
 256                     "name": name,
 257                     "type": "vpp-acl:vpp-acl",
 258                     "aces": {
 259                         "ace": [
 260                             {
 261                                 "name": "rule1",
 262                                 "matches": {
 263                                     "ipv6": {
 264                                         "destination-ipv6-network": "{0}/{1}".format(
 265                                             test_vars["l3_ip6"]["classify_dst_net"],
 266                                             test_vars["l3_ip6"]["prefix_length"]),
 267                                         "source-ipv6-network": "{0}/{1}".format(
 268                                             test_vars["l3_ip6"]["classify_src_net"],
 269                                             test_vars["l3_ip6"]["prefix_length"])
 270                                     },
 271                                     "udp":{
 272                                         "source-port": {
 273                                             "lower-port": "0",
 274                                             "upper-port": "65535"
 275                                         },
 276                                         "destination-port": {
 277                                             "lower-port": "0",
 278                                             "upper-port": "65535"
 279                                         }
 280                                     }
 281                                 },
 282                                 "actions": {
 283                                     "forwarding": "ietf-access-control-list:drop"
 284                                 }
 285                             },
 286                             {
 287                                 "name": "rule_all",
 288                                 "matches": {
 289                                     "ipv6": {
 290                                         "destination-ipv6-network": "0::0/0",
 291                                         "source-ipv6-network": "0::0/0"
 292                                     }
 293                                 },
 294                                 "actions": {
 295                                     "forwarding": "ietf-access-control-list:accept"
 296                                 }
 297                             }
 298                         ]
 299                     }
 300                 }
 301             ]
 302         },
 303         # ACL configuration for L4 tests
 304         "l4": {
 305             "acl": [
 306                 {
 307                     "name": name,
 308                     "type": "vpp-acl:vpp-acl",
 309                     "aces": {
 310                         "ace": [
 311                             {
 312                                 "name": "rule1",
 313                                 "matches": {
 314                                     "ipv4": {
 315                                         "source-ipv4-network": "0.0.0.0/0"
 316                                     },
 317                                     "tcp": {
 318                                         "source-port": {
 319                                             "lower-port": test_vars["l4"]["classify_src"],
 320                                             "upper-port": test_vars["l4"]["classify_src"] + 10
 321                                         },
 322                                         "destination-port":{
 323                                             "lower-port": test_vars["l4"]["classify_dst"],
 324                                             "upper-port": test_vars["l4"]["classify_dst"] + 10
 325                                         }
 326                                     }
 327                                 },
 328                                 "actions":{
 329                                     "forwarding": "ietf-access-control-list:drop"
 330                                 }
 331                             },
 332                             {
 333                                 "name": "rule_all",
 334                                 "matches": {
 335                                     "ipv4": {
 336                                         "source-ipv4-network": "0.0.0.0/0",
 337                                         "destination-ipv4-network": "0.0.0.0/0"
 338                                     }
 339                                 },
 340                                 "actions": {
 341                                     "forwarding": "ietf-access-control-list:accept"
 342                                 }
 343                             }
 344                         ]
 345                     }
 346                 }
 347             ]
 348         },
 349         "mixed": {
 350             "acl": [
 351                 {
 352                     "name": name,
 353                     "type": "vpp-acl:vpp-acl",
 354                     "aces": {
 355                         "ace": [
 356                             {
 357                                 "name": "ports",
 358                                 "matches": {
 359                                     "ipv4": {
 360                                         "source-ipv4-network": "0.0.0.0/0"
 361                                     },
 362                                     "tcp": {
 363                                         "source-port": {
 364                                             "lower-port": test_vars["l4"]["classify_src"],
 365                                             "upper-port": test_vars["l4"]["classify_src"] + 10
 366                                         },
 367                                         "destination-port":{
 368                                             "lower-port": test_vars["l4"]["classify_dst"],
 369                                             "upper-port": test_vars["l4"]["classify_dst"] + 10
 370                                         }
 371                                     }
 372                                 },
 373                                 "actions":{
 374                                     "forwarding": "ietf-access-control-list:drop"
 375                                 }
 376                             },
 377                             {
 378                                 "name": "rule_all",
 379                                 "matches": {
 380                                     "ipv4": {
 381                                         "destination-ipv4-network": "0.0.0.0/0",
 382                                         "source-ipv4-network": "0.0.0.0/0"
 383                                     }
 384                                 },
 385                                 "actions": {
 386                                     "forwarding": "ietf-access-control-list:accept"
 387                                 }
 388                             }
 389                         ]
 390                     }
 391                 }
 392             ]
 393         },
 394         "icmp": {
 395             "acl": [
 396                 {
 397                     "name": name,
 398                     "type": "vpp-acl:vpp-acl",
 399                     "aces": {
 400                         "ace": [
 401                             {
 402                                 "name": "rule1",
 403                                 "matches": {
 404                                     "ipv4": {
 405                                         "source-ipv4-network": "0.0.0.0/0"
 406                                     },
 407                                     "icmp": {
 408                                         "vpp-acl:vpp-icmp-ace": {
 409                                             "vpp-acl:icmp-type-range": {
 410                                                 "first": "1",
 411                                                 "last": "5"
 412                                             },
 413                                             "vpp-acl:icmp-code-range": {
 414                                                 "first": "1",
 415                                                 "last": "5"
 416                                             }
 417                                         }
 418                                     }
 419                                 },
 420                                 "actions": {
 421                                     "forwarding": "ietf-access-control-list:drop"
 422                                 }
 423                             },
 424                             {
 425                                 "name": "rule_all",
 426                                 "matches": {
 427                                     "ipv4": {
 428                                         "source-ipv4-network": "0.0.0.0/0",
 429                                         "destination-ipv4-network": "0.0.0.0/0"
 430                                     }
 431                                 },
 432                                 "actions": {
 433                                     "forwarding": "ietf-access-control-list:accept"
 434                                 }
 435                             }
 436                         ]
 437                     }
 438                 }
 439             ]
 440         },
 441         "icmpv6": {
 442             "acl": [
 443                 {
 444                     "name": name,
 445                     "type": "vpp-acl:vpp-acl",
 446                     "aces": {
 447                         "ace": [
 448                             {
 449                                 "name": "rule1",
 450                                 "matches": {
 451                                     "ipv6": {
 452                                         "source-ipv6-network": "::/0",
 453                                     },
 454                                     "icmp": {
 455                                         "vpp-acl:vpp-icmp-ace": {
 456                                             "vpp-acl:icmp-type-range": {
 457                                                 "first": "1",
 458                                                 "last": "5"
 459                                             },
 460                                             "vpp-acl:icmp-code-range": {
 461                                                 "first": "1",
 462                                                 "last": "5"
 463                                             }
 464                                         }
 465                                     }
 466                                 },
 467                                 "actions": {
 468                                     "forwarding": "ietf-access-control-list:drop"
 469                                 }
 470                             },
 471                             {
 472                                 "name": "rule_all",
 473                                 "matches": {
 474                                     "ipv6": {
 475                                         "destination-ipv6-network": "0::0/0",
 476                                         "source-ipv6-network": "::/0",
 477                                     }
 478                                 },
 479                                 "actions": {
 480                                     "forwarding": "ietf-access-control-list:accept"
 481                                 }
 482                             }
 483                         ]
 484                     }
 485                 }
 486             ]
 487         },
 488         "reflex": {
 489             "acl": [
 490                 {
 491                     "name": name,
 492                     "type": "vpp-acl:vpp-acl",
 493                     "aces": {
 494                         "ace": [
 495                             {
 496                                 "name": "rule1",
 497                                 "matches": {
 498                                     "ipv4": {
 499                                         "destination-ipv4-network": "{0}/{1}".format(
 500                                             test_vars["reflex"]["classify_src_net"],
 501                                             test_vars["reflex"]["prefix_length"]),
 502                                         "source-ipv4-network": "{0}/{1}".format(
 503                                             test_vars["reflex"]["classify_dst_net"],
 504                                             test_vars["reflex"]["prefix_length"])
 505                                     }
 506                                 },
 507                                 "actions": {
 508                                     "forwarding": "vpp-acl:accept-and-reflect"
 509                                 }
 510                             }
 511                         ]
 512                     }
 513                 }
 514             ]
 515         },
 516         "block_all": {
 517             "acl": [
 518                 {
 519                     "name": name,
 520                     "type": "vpp-acl:vpp-acl",
 521                     "aces": {
 522                         "ace": [
 523                             {
 524                                 "name": "rule_all",
 525                                 "matches": {
 526                                     "ipv4": {
 527                                         "destination-ipv4-network": "0.0.0.0/0",
 528                                         "source-ipv4-network": "0.0.0.0/0"
 529                                     }
 530                                 },
 531                                 "actions": {
 532                                     "forwarding": "ietf-access-control-list:drop"
 533                                 }
 534                             }
 535                         ]
 536                     }
 537                 }
 538             ]
 539         },
 540     }
 541
 542     try:
 543         ret_vars = {}
 544         ret_vars.update(variables)
 545         ret_vars.update(test_vars[test_case])
 546         ret_vars.update(
 547             {"acl_settings": acl_data[test_case]}
 548         )
 549     except KeyError:
 550         raise KeyError(
 551             "Unrecognized test case {0}. Valid options are: {1}".format(
 552                 test_case, acl_data.keys()))
 553     return ret_vars