test/test_acl_plugin_macip.py

   1 #!/usr/bin/env python
   2 from __future__ import print_function
   3 """ACL plugin - MACIP tests
   4 """
   5 import binascii
   6 import ipaddress
   7 import random
   8 from socket import inet_ntop, inet_pton, AF_INET, AF_INET6
   9 from struct import pack, unpack
  10 import re
  11 import unittest
  12
  13 import scapy.compat
  14 from scapy.packet import Raw
  15 from scapy.layers.l2 import Ether
  16 from scapy.layers.inet import IP, UDP
  17 from scapy.layers.inet6 import IPv6
  18
  19 from framework import VppTestCase, VppTestRunner, running_extended_tests
  20 from vpp_lo_interface import VppLoInterface
  21 from vpp_l2 import L2_PORT_TYPE
  22 from vpp_sub_interface import L2_VTR_OP, VppSubInterface, VppDot1QSubint, \
  23     VppDot1ADSubint
  24
  25
  26 class MethodHolder(VppTestCase):
  27     DEBUG = False
  28
  29     BRIDGED = True
  30     ROUTED = False
  31
  32     IS_IP4 = False
  33     IS_IP6 = True
  34
  35     DOT1AD = "dot1ad"
  36     DOT1Q = "dot1q"
  37     PERMIT_TAGS = True
  38     DENY_TAGS = False
  39
  40     # rule types
  41     DENY = 0
  42     PERMIT = 1
  43
  44     # ACL types
  45     EXACT_IP = 1
  46     SUBNET_IP = 2
  47     WILD_IP = 3
  48
  49     EXACT_MAC = 1
  50     WILD_MAC = 2
  51     OUI_MAC = 3
  52
  53     ACLS = []
  54
  55     @classmethod
  56     def setUpClass(cls):
  57         """
  58         Perform standard class setup (defined by class method setUpClass in
  59         class VppTestCase) before running the test case, set test case related
  60         variables and configure VPP.
  61         """
  62         super(MethodHolder, cls).setUpClass()
  63
  64         cls.pg_if_packet_sizes = [64, 512, 1518, 9018]  # packet sizes
  65         cls.bd_id = 111
  66         cls.remote_hosts_count = 200
  67
  68         try:
  69             # create 4 pg interfaces, 1 loopback interface
  70             cls.create_pg_interfaces(range(4))
  71             cls.create_loopback_interfaces(1)
  72
  73             # create 2 subinterfaces
  74             cls.subifs = [
  75                  VppDot1QSubint(cls, cls.pg1, 10),
  76                  VppDot1ADSubint(cls, cls.pg2, 20, 300, 400),
  77                  VppDot1QSubint(cls, cls.pg3, 30),
  78                  VppDot1ADSubint(cls, cls.pg3, 40, 600, 700)]
  79
  80             cls.subifs[0].set_vtr(L2_VTR_OP.L2_POP_1,
  81                                   inner=10, push1q=1)
  82             cls.subifs[1].set_vtr(L2_VTR_OP.L2_POP_2,
  83                                   outer=300, inner=400, push1q=1)
  84             cls.subifs[2].set_vtr(L2_VTR_OP.L2_POP_1,
  85                                   inner=30, push1q=1)
  86             cls.subifs[3].set_vtr(L2_VTR_OP.L2_POP_2,
  87                                   outer=600, inner=700, push1q=1)
  88
  89             cls.interfaces = list(cls.pg_interfaces)
  90             cls.interfaces.extend(cls.lo_interfaces)
  91             cls.interfaces.extend(cls.subifs)
  92
  93             for i in cls.interfaces:
  94                 i.admin_up()
  95
  96             # Create BD with MAC learning enabled and put interfaces to this BD
  97             cls.vapi.sw_interface_set_l2_bridge(
  98                 rx_sw_if_index=cls.loop0.sw_if_index, bd_id=cls.bd_id,
  99                 port_type=L2_PORT_TYPE.BVI)
 100             cls.vapi.sw_interface_set_l2_bridge(
 101                 rx_sw_if_index=cls.pg0.sw_if_index, bd_id=cls.bd_id)
 102             cls.vapi.sw_interface_set_l2_bridge(
 103                 rx_sw_if_index=cls.pg1.sw_if_index, bd_id=cls.bd_id)
 104             cls.vapi.sw_interface_set_l2_bridge(
 105                 rx_sw_if_index=cls.subifs[0].sw_if_index, bd_id=cls.bd_id)
 106             cls.vapi.sw_interface_set_l2_bridge(
 107                 rx_sw_if_index=cls.subifs[1].sw_if_index, bd_id=cls.bd_id)
 108
 109             # Configure IPv4/6 addresses on loop interface and routed interface
 110             cls.loop0.config_ip4()
 111             cls.loop0.config_ip6()
 112             cls.pg2.config_ip4()
 113             cls.pg2.config_ip6()
 114             cls.pg3.config_ip4()
 115             cls.pg3.config_ip6()
 116
 117             # Configure MAC address binding to IPv4 neighbors on loop0
 118             cls.loop0.generate_remote_hosts(cls.remote_hosts_count)
 119             # Modify host mac addresses to have different OUI parts
 120             for i in range(2, cls.remote_hosts_count + 2):
 121                 mac = cls.loop0.remote_hosts[i-2]._mac.split(':')
 122                 mac[2] = format(int(mac[2], 16) + i, "02x")
 123                 cls.loop0.remote_hosts[i - 2]._mac = ":".join(mac)
 124
 125             cls.loop0.configure_ipv4_neighbors()
 126             cls.loop0.configure_ipv6_neighbors()
 127
 128             # configure MAC address on pg3
 129             cls.pg3.resolve_arp()
 130             cls.pg3.resolve_ndp()
 131
 132             # configure MAC address on subifs
 133             for i in cls.subifs:
 134                 i.config_ip4()
 135                 i.resolve_arp()
 136                 i.config_ip6()
 137
 138             # configure MAC address on pg2
 139             cls.pg2.resolve_arp()
 140             cls.pg2.resolve_ndp()
 141
 142             # Loopback BVI interface has remote hosts
 143             # one half of hosts are behind pg0 second behind pg1,pg2,pg3 subifs
 144             cls.pg0.remote_hosts = cls.loop0.remote_hosts[:100]
 145             cls.subifs[0].remote_hosts = cls.loop0.remote_hosts[100:125]
 146             cls.subifs[1].remote_hosts = cls.loop0.remote_hosts[125:150]
 147             cls.subifs[2].remote_hosts = cls.loop0.remote_hosts[150:175]
 148             cls.subifs[3].remote_hosts = cls.loop0.remote_hosts[175:]
 149
 150         except Exception:
 151             super(MethodHolder, cls).tearDownClass()
 152             raise
 153
 154     @classmethod
 155     def tearDownClass(cls):
 156         super(MethodHolder, cls).tearDownClass()
 157
 158     def setUp(self):
 159         super(MethodHolder, self).setUp()
 160         self.reset_packet_infos()
 161         del self.ACLS[:]
 162
 163     def tearDown(self):
 164         """
 165         Show various debug prints after each test.
 166         """
 167         super(MethodHolder, self).tearDown()
 168
 169     def show_commands_at_teardown(self):
 170         self.logger.info(self.vapi.ppcli("show interface address"))
 171         self.logger.info(self.vapi.ppcli("show hardware"))
 172         self.logger.info(self.vapi.ppcli("sh acl-plugin macip acl"))
 173         self.logger.info(self.vapi.ppcli("sh acl-plugin macip interface"))
 174         self.logger.info(self.vapi.ppcli("sh classify tables verbose"))
 175         self.logger.info(self.vapi.ppcli("sh acl-plugin acl"))
 176         self.logger.info(self.vapi.ppcli("sh acl-plugin interface"))
 177         self.logger.info(self.vapi.ppcli("sh acl-plugin tables"))
 178         # print(self.vapi.ppcli("show interface address"))
 179         # print(self.vapi.ppcli("show hardware"))
 180         # print(self.vapi.ppcli("sh acl-plugin macip interface"))
 181         # print(self.vapi.ppcli("sh acl-plugin macip acl"))
 182         self.delete_acls()
 183
 184     def macip_acl_dump_debug(self):
 185         acls = self.vapi.macip_acl_dump()
 186         if self.DEBUG:
 187             for acl in acls:
 188                 print("ACL #"+str(acl.acl_index))
 189                 for r in acl.r:
 190                     rule = "ACTION"
 191                     if r.is_permit == 1:
 192                         rule = "PERMIT"
 193                     elif r.is_permit == 0:
 194                         rule = "DENY  "
 195                     print("    IP6" if r.is_ipv6 else "    IP4",
 196                           rule,
 197                           binascii.hexlify(r.src_mac),
 198                           binascii.hexlify(r.src_mac_mask),
 199                           unpack('<16B', r.src_ip_addr),
 200                           r.src_ip_prefix_len)
 201         return acls
 202
 203     def create_rules(self, mac_type=EXACT_MAC, ip_type=EXACT_IP,
 204                      acl_count=1, rules_count=None):
 205         acls = []
 206         if rules_count is None:
 207             rules_count = [1]
 208         src_mac = int("220000dead00", 16)
 209         for acl in range(2, (acl_count+1) * 2):
 210             rules = []
 211             host = random.choice(self.loop0.remote_hosts)
 212             is_ip6 = acl % 2
 213             ip4 = host.ip4.split('.')
 214             ip6 = list(unpack('<16B', inet_pton(AF_INET6, host.ip6)))
 215
 216             if ip_type == self.EXACT_IP:
 217                 prefix_len4 = 32
 218                 prefix_len6 = 128
 219             elif ip_type == self.WILD_IP:
 220                 ip4 = [0, 0, 0, 0]
 221                 ip6 = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
 222                 prefix_len4 = 0
 223                 prefix_len6 = 0
 224                 rules_count[(acl / 2) - 1] = 1
 225             else:
 226                 prefix_len4 = 24
 227                 prefix_len6 = 64
 228
 229             if mac_type == self.EXACT_MAC:
 230                 mask = "ff:ff:ff:ff:ff:ff"
 231             elif mac_type == self.WILD_MAC:
 232                 mask = "00:00:00:00:00:00"
 233             elif mac_type == self.OUI_MAC:
 234                 mask = "ff:ff:ff:00:00:00"
 235             else:
 236                 mask = "ff:ff:ff:ff:ff:00"
 237
 238             ip = ip6 if is_ip6 else ip4
 239             ip_len = prefix_len6 if is_ip6 else prefix_len4
 240
 241             for i in range(0, rules_count[(acl / 2) - 1]):
 242                 src_mac += 16777217
 243                 if mac_type == self.WILD_MAC:
 244                     mac = "00:00:00:00:00:00"
 245                 elif mac_type == self.OUI_MAC:
 246                     mac = ':'.join(re.findall('..', '{:02x}'.format(
 247                         src_mac))[:3])+":00:00:00"
 248                 else:
 249                     mac = ':'.join(re.findall(
 250                         '..', '{:02x}'.format(src_mac)))
 251
 252                 if ip_type == self.EXACT_IP:
 253                     ip4[3] = random.randint(100, 200)
 254                     ip6[15] = random.randint(100, 200)
 255                 elif ip_type == self.SUBNET_IP:
 256                     ip4[2] = random.randint(100, 200)
 257                     ip4[3] = 0
 258                     ip6[8] = random.randint(100, 200)
 259                     ip6[15] = 0
 260                 ip_pack = b''
 261                 for j in range(0, len(ip)):
 262                     ip_pack += pack('<B', int(ip[j]))
 263
 264                 rule = ({'is_permit': self.PERMIT,
 265                          'is_ipv6': is_ip6,
 266                          'src_ip_addr': ip_pack,
 267                          'src_ip_prefix_len': ip_len,
 268                          'src_mac': binascii.unhexlify(mac.replace(':', '')),
 269                          'src_mac_mask': binascii.unhexlify(
 270                              mask.replace(':', ''))})
 271                 rules.append(rule)
 272                 if ip_type == self.WILD_IP:
 273                     break
 274
 275             acls.append(rules)
 276             src_mac += 1099511627776
 277         return acls
 278
 279     def apply_macip_rules(self, acls):
 280         for acl in acls:
 281             reply = self.vapi.macip_acl_add(acl)
 282             self.assertEqual(reply.retval, 0)
 283             self.ACLS.append(reply.acl_index)
 284
 285     def verify_macip_acls(self, acl_count, rules_count, expected_count=2):
 286         reply = self.macip_acl_dump_debug()
 287         for acl in range(2, (acl_count+1) * 2):
 288             self.assertEqual(reply[acl - 2].count, rules_count[acl//2-1])
 289
 290         self.vapi.macip_acl_interface_get()
 291
 292         self.vapi.macip_acl_interface_add_del(sw_if_index=0, acl_index=0)
 293         self.vapi.macip_acl_interface_add_del(sw_if_index=1, acl_index=1)
 294
 295         reply = self.vapi.macip_acl_interface_get()
 296         self.assertEqual(reply.count, expected_count)
 297
 298     def delete_acls(self):
 299         for acl in range(len(self.ACLS)-1, -1, -1):
 300             self.vapi.macip_acl_del(self.ACLS[acl])
 301
 302         reply = self.vapi.macip_acl_dump()
 303         self.assertEqual(len(reply), 0)
 304
 305         intf_acls = self.vapi.acl_interface_list_dump()
 306         for i_a in intf_acls:
 307             sw_if_index = i_a.sw_if_index
 308             for acl_index in i_a.acls:
 309                 self.vapi.acl_interface_add_del(sw_if_index, acl_index, 0)
 310                 self.vapi.acl_del(acl_index)
 311
 312     def create_stream(self, mac_type, ip_type, packet_count,
 313                       src_if, dst_if, traffic, is_ip6, tags=PERMIT_TAGS):
 314         # exact MAC and exact IP
 315         # exact MAC and subnet of IPs
 316         # exact MAC and wildcard IP
 317         # wildcard MAC and exact IP
 318         # wildcard MAC and subnet of IPs
 319         # wildcard MAC and wildcard IP
 320         # OUI restricted MAC and exact IP
 321         # OUI restricted MAC and subnet of IPs
 322         # OUI restricted MAC and wildcard IP
 323
 324         packets = []
 325         macip_rules = []
 326         acl_rules = []
 327         ip_permit = ""
 328         mac_permit = ""
 329         dst_mac = ""
 330         mac_rule = "00:00:00:00:00:00"
 331         mac_mask = "00:00:00:00:00:00"
 332         for p in range(0, packet_count):
 333             remote_dst_index = p % len(dst_if.remote_hosts)
 334             remote_dst_host = dst_if.remote_hosts[remote_dst_index]
 335
 336             dst_port = 1234 + p
 337             src_port = 4321 + p
 338             is_permit = self.PERMIT if p % 3 == 0 else self.DENY
 339             denyMAC = True if not is_permit and p % 3 == 1 else False
 340             denyIP = True if not is_permit and p % 3 == 2 else False
 341             if not is_permit and ip_type == self.WILD_IP:
 342                 denyMAC = True
 343             if not is_permit and mac_type == self.WILD_MAC:
 344                 denyIP = True
 345
 346             if traffic == self.BRIDGED:
 347                 if is_permit:
 348                     src_mac = remote_dst_host._mac
 349                     dst_mac = 'de:ad:00:00:00:00'
 350                     src_ip4 = remote_dst_host.ip4
 351                     dst_ip4 = src_if.remote_ip4
 352                     src_ip6 = remote_dst_host.ip6
 353                     dst_ip6 = src_if.remote_ip6
 354                     ip_permit = src_ip6 if is_ip6 else src_ip4
 355                     mac_permit = src_mac
 356                 if denyMAC:
 357                     mac = src_mac.split(':')
 358                     mac[0] = format(int(mac[0], 16)+1, "02x")
 359                     src_mac = ":".join(mac)
 360                     if is_ip6:
 361                         src_ip6 = ip_permit
 362                     else:
 363                         src_ip4 = ip_permit
 364                 if denyIP:
 365                     if ip_type != self.WILD_IP:
 366                         src_mac = mac_permit
 367                     src_ip4 = remote_dst_host.ip4
 368                     dst_ip4 = src_if.remote_ip4
 369                     src_ip6 = remote_dst_host.ip6
 370                     dst_ip6 = src_if.remote_ip6
 371             else:
 372                 if is_permit:
 373                     src_mac = remote_dst_host._mac
 374                     dst_mac = src_if.local_mac
 375                     src_ip4 = src_if.remote_ip4
 376                     dst_ip4 = remote_dst_host.ip4
 377                     src_ip6 = src_if.remote_ip6
 378                     dst_ip6 = remote_dst_host.ip6
 379                     ip_permit = src_ip6 if is_ip6 else src_ip4
 380                     mac_permit = src_mac
 381                 if denyMAC:
 382                     mac = src_mac.split(':')
 383                     mac[0] = format(int(mac[0], 16) + 1, "02x")
 384                     src_mac = ":".join(mac)
 385                     if is_ip6:
 386                         src_ip6 = ip_permit
 387                     else:
 388                         src_ip4 = ip_permit
 389                 if denyIP:
 390                     src_mac = remote_dst_host._mac
 391                     if ip_type != self.WILD_IP:
 392                         src_mac = mac_permit
 393                     src_ip4 = remote_dst_host.ip4
 394                     dst_ip4 = src_if.remote_ip4
 395                     src_ip6 = remote_dst_host.ip6
 396                     dst_ip6 = src_if.remote_ip6
 397
 398             if is_permit:
 399                 info = self.create_packet_info(src_if, dst_if)
 400                 payload = self.info_to_payload(info)
 401             else:
 402                 payload = "to be blocked"
 403
 404             if mac_type == self.WILD_MAC:
 405                 mac = src_mac.split(':')
 406                 for i in range(1, 5):
 407                     mac[i] = format(random.randint(0, 255), "02x")
 408                 src_mac = ":".join(mac)
 409
 410             # create packet
 411             packet = Ether(src=src_mac, dst=dst_mac)
 412             ip_rule = src_ip6 if is_ip6 else src_ip4
 413             if is_ip6:
 414                 if ip_type != self.EXACT_IP:
 415                     sub_ip = list(unpack('<16B', inet_pton(AF_INET6, ip_rule)))
 416                     if ip_type == self.WILD_IP:
 417                         sub_ip[0] = random.randint(240, 254)
 418                         sub_ip[1] = random.randint(230, 239)
 419                         sub_ip[14] = random.randint(100, 199)
 420                         sub_ip[15] = random.randint(200, 255)
 421                     elif ip_type == self.SUBNET_IP:
 422                         if denyIP:
 423                             sub_ip[2] = int(sub_ip[2]) + 1
 424                         sub_ip[14] = random.randint(100, 199)
 425                         sub_ip[15] = random.randint(200, 255)
 426                     packed_src_ip6 = b''.join(
 427                         [scapy.compat.chb(x) for x in sub_ip])
 428                     src_ip6 = inet_ntop(AF_INET6, packed_src_ip6)
 429                 packet /= IPv6(src=src_ip6, dst=dst_ip6)
 430             else:
 431                 if ip_type != self.EXACT_IP:
 432                     sub_ip = ip_rule.split('.')
 433                     if ip_type == self.WILD_IP:
 434                         sub_ip[0] = random.randint(1, 49)
 435                         sub_ip[1] = random.randint(50, 99)
 436                         sub_ip[2] = random.randint(100, 199)
 437                         sub_ip[3] = random.randint(200, 255)
 438                     elif ip_type == self.SUBNET_IP:
 439                         if denyIP:
 440                             sub_ip[1] = int(sub_ip[1])+1
 441                         sub_ip[2] = random.randint(100, 199)
 442                         sub_ip[3] = random.randint(200, 255)
 443                     src_ip4 = '.'.join(['{!s}'.format(x) for x in sub_ip])
 444                 packet /= IP(src=src_ip4, dst=dst_ip4, frag=0, flags=0)
 445
 446             packet /= UDP(sport=src_port, dport=dst_port)/Raw(payload)
 447
 448             packet[Raw].load += b" mac:%s" % scapy.compat.raw(src_mac)
 449
 450             size = self.pg_if_packet_sizes[p % len(self.pg_if_packet_sizes)]
 451             if isinstance(src_if, VppSubInterface):
 452                 size = size + 4
 453             if isinstance(src_if, VppDot1QSubint):
 454                 if src_if is self.subifs[0]:
 455                     if tags == self.PERMIT_TAGS:
 456                         packet = src_if.add_dot1q_layer(packet, 10)
 457                     else:
 458                         packet = src_if.add_dot1q_layer(packet, 11)
 459                 else:
 460                     if tags == self.PERMIT_TAGS:
 461                         packet = src_if.add_dot1q_layer(packet, 30)
 462                     else:
 463                         packet = src_if.add_dot1q_layer(packet, 33)
 464             elif isinstance(src_if, VppDot1ADSubint):
 465                 if src_if is self.subifs[1]:
 466                     if tags == self.PERMIT_TAGS:
 467                         packet = src_if.add_dot1ad_layer(packet, 300, 400)
 468                     else:
 469                         packet = src_if.add_dot1ad_layer(packet, 333, 444)
 470                 else:
 471                     if tags == self.PERMIT_TAGS:
 472                         packet = src_if.add_dot1ad_layer(packet, 600, 700)
 473                     else:
 474                         packet = src_if.add_dot1ad_layer(packet, 666, 777)
 475             self.extend_packet(packet, size)
 476             packets.append(packet)
 477
 478             # create suitable MACIP rule
 479             if mac_type == self.EXACT_MAC:
 480                 mac_rule = src_mac
 481                 mac_mask = "ff:ff:ff:ff:ff:ff"
 482             elif mac_type == self.WILD_MAC:
 483                 mac_rule = "00:00:00:00:00:00"
 484                 mac_mask = "00:00:00:00:00:00"
 485             elif mac_type == self.OUI_MAC:
 486                 mac = src_mac.split(':')
 487                 mac[3] = mac[4] = mac[5] = '00'
 488                 mac_rule = ":".join(mac)
 489                 mac_mask = "ff:ff:ff:00:00:00"
 490
 491             if is_ip6:
 492                 if ip_type == self.WILD_IP:
 493                     ip = "0::0"
 494                 else:
 495                     ip = src_ip6
 496                     if ip_type == self.SUBNET_IP:
 497                         sub_ip = list(unpack('<16B', inet_pton(AF_INET6, ip)))
 498                         for i in range(8, 16):
 499                             sub_ip[i] = 0
 500                         packed_ip = b''.join(
 501                             [scapy.compat.chb(x) for x in sub_ip])
 502                         ip = inet_ntop(AF_INET6, packed_ip)
 503             else:
 504                 if ip_type == self.WILD_IP:
 505                     ip = "0.0.0.0"
 506                 else:
 507                     ip = src_ip4
 508                     if ip_type == self.SUBNET_IP:
 509                         sub_ip = ip.split('.')
 510                         sub_ip[2] = sub_ip[3] = '0'
 511                         ip = ".".join(sub_ip)
 512
 513             prefix_len = 128 if is_ip6 else 32
 514             if ip_type == self.WILD_IP:
 515                 prefix_len = 0
 516             elif ip_type == self.SUBNET_IP:
 517                 prefix_len = 64 if is_ip6 else 16
 518             ip_rule = inet_pton(AF_INET6 if is_ip6 else AF_INET, ip)
 519
 520             # create suitable ACL rule
 521             if is_permit:
 522                 rule_l4_sport = packet[UDP].sport
 523                 rule_l4_dport = packet[UDP].dport
 524                 rule_family = AF_INET6 if packet.haslayer(IPv6) else AF_INET
 525                 rule_prefix_len = 128 if packet.haslayer(IPv6) else 32
 526                 rule_l3_layer = IPv6 if packet.haslayer(IPv6) else IP
 527                 if packet.haslayer(IPv6):
 528                     rule_l4_proto = packet[UDP].overload_fields[IPv6]['nh']
 529                 else:
 530                     rule_l4_proto = packet[IP].proto
 531
 532                 acl_rule = {
 533                     'is_permit': is_permit,
 534                     'is_ipv6': is_ip6,
 535                     'src_ip_addr': inet_pton(rule_family,
 536                                              packet[rule_l3_layer].src),
 537                     'src_ip_prefix_len': rule_prefix_len,
 538                     'dst_ip_addr': inet_pton(rule_family,
 539                                              packet[rule_l3_layer].dst),
 540                     'dst_ip_prefix_len': rule_prefix_len,
 541                     'srcport_or_icmptype_first': rule_l4_sport,
 542                     'srcport_or_icmptype_last': rule_l4_sport,
 543                     'dstport_or_icmpcode_first': rule_l4_dport,
 544                     'dstport_or_icmpcode_last': rule_l4_dport,
 545                     'proto': rule_l4_proto}
 546                 acl_rules.append(acl_rule)
 547
 548             if mac_type == self.WILD_MAC and ip_type == self.WILD_IP and p > 0:
 549                 continue
 550
 551             if is_permit:
 552                 macip_rule = ({
 553                     'is_permit': is_permit,
 554                     'is_ipv6': is_ip6,
 555                     'src_ip_addr': ip_rule,
 556                     'src_ip_prefix_len': prefix_len,
 557                     'src_mac': binascii.unhexlify(mac_rule.replace(':', '')),
 558                     'src_mac_mask': binascii.unhexlify(
 559                         mac_mask.replace(':', ''))})
 560                 macip_rules.append(macip_rule)
 561
 562         # deny all other packets
 563         if not (mac_type == self.WILD_MAC and ip_type == self.WILD_IP):
 564             macip_rule = ({'is_permit': 0,
 565                            'is_ipv6': is_ip6,
 566                            'src_ip_addr': "",
 567                            'src_ip_prefix_len': 0,
 568                            'src_mac': "",
 569                            'src_mac_mask': ""})
 570             macip_rules.append(macip_rule)
 571
 572         acl_rule = {'is_permit': 0,
 573                     'is_ipv6': is_ip6}
 574         acl_rules.append(acl_rule)
 575         return {'stream': packets,
 576                 'macip_rules': macip_rules,
 577                 'acl_rules': acl_rules}
 578
 579     def verify_capture(self, stream, capture, is_ip6):
 580         """
 581         :param stream:
 582         :param capture:
 583         :param is_ip6:
 584         :return:
 585         """
 586         # p_l3 = IPv6 if is_ip6 else IP
 587         # if self.DEBUG:
 588         #     for p in stream:
 589         #         print(p[Ether].src, p[Ether].dst, p[p_l3].src, p[p_l3].dst)
 590         #
 591         # acls = self.macip_acl_dump_debug()
 592
 593         # TODO : verify
 594         # for acl in acls:
 595         #     for r in acl.r:
 596         #         print(binascii.hexlify(r.src_mac), \
 597         #               binascii.hexlify(r.src_mac_mask),\
 598         #               unpack('<16B', r.src_ip_addr), \
 599         #               r.src_ip_prefix_len)
 600         #
 601         # for p in capture:
 602         #     print(p[Ether].src, p[Ether].dst, p[p_l3].src, p[p_l3].dst
 603         #     data = p[Raw].load.split(':',1)[1])
 604         #     print(p[p_l3].src, data)
 605
 606     def run_traffic(self, mac_type, ip_type, traffic, is_ip6, packets,
 607                     do_not_expected_capture=False, tags=None,
 608                     apply_rules=True, isMACIP=True, permit_tags=PERMIT_TAGS,
 609                     try_replace=False):
 610         self.reset_packet_infos()
 611
 612         if tags is None:
 613             tx_if = self.pg0 if traffic == self.BRIDGED else self.pg3
 614             rx_if = self.pg3 if traffic == self.BRIDGED else self.pg0
 615             src_if = self.pg3
 616             dst_if = self.loop0
 617         else:
 618             if tags == self.DOT1Q:
 619                 if traffic == self.BRIDGED:
 620                     tx_if = self.subifs[0]
 621                     rx_if = self.pg0
 622                     src_if = self.subifs[0]
 623                     dst_if = self.loop0
 624                 else:
 625                     tx_if = self.subifs[2]
 626                     rx_if = self.pg0
 627                     src_if = self.subifs[2]
 628                     dst_if = self.loop0
 629             elif tags == self.DOT1AD:
 630                 if traffic == self.BRIDGED:
 631                     tx_if = self.subifs[1]
 632                     rx_if = self.pg0
 633                     src_if = self.subifs[1]
 634                     dst_if = self.loop0
 635                 else:
 636                     tx_if = self.subifs[3]
 637                     rx_if = self.pg0
 638                     src_if = self.subifs[3]
 639                     dst_if = self.loop0
 640             else:
 641                 return
 642
 643         test_dict = self.create_stream(mac_type, ip_type, packets,
 644                                        src_if, dst_if,
 645                                        traffic, is_ip6,
 646                                        tags=permit_tags)
 647
 648         if apply_rules:
 649             if isMACIP:
 650                 reply = self.vapi.macip_acl_add(test_dict['macip_rules'])
 651             else:
 652                 reply = self.vapi.acl_add_replace(acl_index=4294967295,
 653                                                   r=test_dict['acl_rules'])
 654             self.assertEqual(reply.retval, 0)
 655             acl_index = reply.acl_index
 656
 657             if isMACIP:
 658                 self.vapi.macip_acl_interface_add_del(
 659                                                  sw_if_index=tx_if.sw_if_index,
 660                                                  acl_index=acl_index)
 661                 reply = self.vapi.macip_acl_interface_get()
 662                 self.assertEqual(reply.acls[tx_if.sw_if_index], acl_index)
 663                 self.ACLS.append(reply.acls[tx_if.sw_if_index])
 664             else:
 665                 self.vapi.acl_interface_add_del(
 666                     sw_if_index=tx_if.sw_if_index, acl_index=acl_index)
 667         else:
 668             self.vapi.macip_acl_interface_add_del(
 669                 sw_if_index=tx_if.sw_if_index,
 670                 acl_index=0)
 671         if try_replace:
 672             if isMACIP:
 673                 reply = self.vapi.macip_acl_add_replace(
 674                                                    test_dict['macip_rules'],
 675                                                    acl_index)
 676             else:
 677                 reply = self.vapi.acl_add_replace(acl_index=acl_index,
 678                                                   r=test_dict['acl_rules'])
 679             self.assertEqual(reply.retval, 0)
 680
 681         if not isinstance(src_if, VppSubInterface):
 682             tx_if.add_stream(test_dict['stream'])
 683         else:
 684             tx_if.parent.add_stream(test_dict['stream'])
 685         self.pg_enable_capture(self.pg_interfaces)
 686         self.pg_start()
 687
 688         if do_not_expected_capture:
 689             rx_if.get_capture(0)
 690         else:
 691             if traffic == self.BRIDGED and mac_type == self.WILD_MAC and \
 692                     ip_type == self.WILD_IP:
 693                 capture = rx_if.get_capture(packets)
 694             else:
 695                 capture = rx_if.get_capture(
 696                     self.get_packet_count_for_if_idx(dst_if.sw_if_index))
 697             self.verify_capture(test_dict['stream'], capture, is_ip6)
 698         if not isMACIP:
 699             self.vapi.acl_interface_add_del(sw_if_index=tx_if.sw_if_index,
 700                                             acl_index=acl_index, is_add=0)
 701             self.vapi.acl_del(acl_index)
 702
 703     def run_test_acls(self, mac_type, ip_type, acl_count,
 704                       rules_count, traffic=None, ip=None):
 705         self.apply_macip_rules(self.create_rules(mac_type, ip_type, acl_count,
 706                                                  rules_count))
 707         self.verify_macip_acls(acl_count, rules_count)
 708
 709         if traffic is not None:
 710             self.run_traffic(self.EXACT_MAC, self.EXACT_IP, traffic, ip, 9)
 711
 712
 713 class TestMACIP_IP4(MethodHolder):
 714     """MACIP with IP4 traffic"""
 715
 716     @classmethod
 717     def setUpClass(cls):
 718         super(TestMACIP_IP4, cls).setUpClass()
 719
 720     @classmethod
 721     def tearDownClass(cls):
 722         super(TestMACIP_IP4, cls).tearDownClass()
 723
 724     def test_acl_bridged_ip4_exactMAC_exactIP(self):
 725         """ IP4 MACIP exactMAC|exactIP ACL bridged traffic
 726         """
 727         self.run_traffic(self.EXACT_MAC, self.EXACT_IP,
 728                          self.BRIDGED, self.IS_IP4, 9)
 729
 730     def test_acl_bridged_ip4_exactMAC_subnetIP(self):
 731         """ IP4 MACIP exactMAC|subnetIP ACL bridged traffic
 732         """
 733
 734         self.run_traffic(self.EXACT_MAC, self.SUBNET_IP,
 735                          self.BRIDGED, self.IS_IP4, 9)
 736
 737     def test_acl_bridged_ip4_exactMAC_wildIP(self):
 738         """ IP4 MACIP exactMAC|wildIP ACL bridged traffic
 739         """
 740
 741         self.run_traffic(self.EXACT_MAC, self.WILD_IP,
 742                          self.BRIDGED, self.IS_IP4, 9)
 743
 744     def test_acl_bridged_ip4_ouiMAC_exactIP(self):
 745         """ IP4 MACIP ouiMAC|exactIP ACL bridged traffic
 746         """
 747
 748         self.run_traffic(self.OUI_MAC, self.EXACT_IP,
 749                          self.BRIDGED, self.IS_IP4, 3)
 750
 751     def test_acl_bridged_ip4_ouiMAC_subnetIP(self):
 752         """ IP4 MACIP ouiMAC|subnetIP ACL bridged traffic
 753         """
 754
 755         self.run_traffic(self.OUI_MAC, self.SUBNET_IP,
 756                          self.BRIDGED, self.IS_IP4, 9)
 757
 758     def test_acl_bridged_ip4_ouiMAC_wildIP(self):
 759         """ IP4 MACIP ouiMAC|wildIP ACL bridged traffic
 760         """
 761
 762         self.run_traffic(self.OUI_MAC, self.WILD_IP,
 763                          self.BRIDGED, self.IS_IP4, 9)
 764
 765     def test_ac_bridgedl_ip4_wildMAC_exactIP(self):
 766         """ IP4 MACIP wildcardMAC|exactIP ACL bridged traffic
 767         """
 768
 769         self.run_traffic(self.WILD_MAC, self.EXACT_IP,
 770                          self.BRIDGED, self.IS_IP4, 9)
 771
 772     def test_acl_bridged_ip4_wildMAC_subnetIP(self):
 773         """ IP4 MACIP wildcardMAC|subnetIP ACL bridged traffic
 774         """
 775
 776         self.run_traffic(self.WILD_MAC, self.SUBNET_IP,
 777                          self.BRIDGED, self.IS_IP4, 9)
 778
 779     def test_acl_bridged_ip4_wildMAC_wildIP(self):
 780         """ IP4 MACIP wildcardMAC|wildIP ACL bridged traffic
 781         """
 782
 783         self.run_traffic(self.WILD_MAC, self.WILD_IP,
 784                          self.BRIDGED, self.IS_IP4, 9)
 785
 786     def test_acl_routed_ip4_exactMAC_exactIP(self):
 787         """ IP4 MACIP exactMAC|exactIP ACL routed traffic
 788         """
 789         self.run_traffic(self.EXACT_MAC, self.EXACT_IP,
 790                          self.ROUTED, self.IS_IP4, 9)
 791
 792     def test_acl_routed_ip4_exactMAC_subnetIP(self):
 793         """ IP4 MACIP exactMAC|subnetIP ACL routed traffic
 794         """
 795         self.run_traffic(self.EXACT_MAC, self.SUBNET_IP,
 796                          self.ROUTED, self.IS_IP4, 9)
 797
 798     def test_acl_routed_ip4_exactMAC_wildIP(self):
 799         """ IP4 MACIP exactMAC|wildIP ACL routed traffic
 800         """
 801         self.run_traffic(self.EXACT_MAC, self.WILD_IP,
 802                          self.ROUTED, self.IS_IP4, 9)
 803
 804     def test_acl_routed_ip4_ouiMAC_exactIP(self):
 805         """ IP4 MACIP ouiMAC|exactIP ACL routed traffic
 806         """
 807
 808         self.run_traffic(self.OUI_MAC, self.EXACT_IP,
 809                          self.ROUTED, self.IS_IP4, 9)
 810
 811     def test_acl_routed_ip4_ouiMAC_subnetIP(self):
 812         """ IP4 MACIP ouiMAC|subnetIP ACL routed traffic
 813         """
 814
 815         self.run_traffic(self.OUI_MAC, self.SUBNET_IP,
 816                          self.ROUTED, self.IS_IP4, 9)
 817
 818     def test_acl_routed_ip4_ouiMAC_wildIP(self):
 819         """ IP4 MACIP ouiMAC|wildIP ACL routed traffic
 820         """
 821
 822         self.run_traffic(self.OUI_MAC, self.WILD_IP,
 823                          self.ROUTED, self.IS_IP4, 9)
 824
 825     def test_acl_routed_ip4_wildMAC_exactIP(self):
 826         """ IP4 MACIP wildcardMAC|exactIP ACL routed traffic
 827         """
 828
 829         self.run_traffic(self.WILD_MAC, self.EXACT_IP,
 830                          self.ROUTED, self.IS_IP4, 9)
 831
 832     def test_acl_routed_ip4_wildMAC_subnetIP(self):
 833         """ IP4 MACIP wildcardMAC|subnetIP ACL routed traffic
 834         """
 835
 836         self.run_traffic(self.WILD_MAC, self.SUBNET_IP,
 837                          self.ROUTED, self.IS_IP4, 9)
 838
 839     def test_acl_routed_ip4_wildMAC_wildIP(self):
 840         """ IP4 MACIP wildcardMAC|wildIP ACL
 841         """
 842
 843         self.run_traffic(self.WILD_MAC, self.WILD_IP,
 844                          self.ROUTED, self.IS_IP4, 9)
 845
 846     def test_acl_replace_traffic_ip4(self):
 847         """ MACIP replace ACL with IP4 traffic
 848         """
 849         self.run_traffic(self.OUI_MAC, self.SUBNET_IP,
 850                          self.BRIDGED, self.IS_IP4, 9, try_replace=True)
 851         self.run_traffic(self.EXACT_MAC, self.EXACT_IP,
 852                          self.BRIDGED, self.IS_IP4, 9, try_replace=True)
 853
 854
 855 class TestMACIP_IP6(MethodHolder):
 856     """MACIP with IP6 traffic"""
 857
 858     @classmethod
 859     def setUpClass(cls):
 860         super(TestMACIP_IP6, cls).setUpClass()
 861
 862     @classmethod
 863     def tearDownClass(cls):
 864         super(TestMACIP_IP6, cls).tearDownClass()
 865
 866     def test_acl_bridged_ip6_exactMAC_exactIP(self):
 867         """ IP6 MACIP exactMAC|exactIP ACL bridged traffic
 868         """
 869
 870         self.run_traffic(self.EXACT_MAC, self.EXACT_IP,
 871                          self.BRIDGED, self.IS_IP6, 9)
 872
 873     def test_acl_bridged_ip6_exactMAC_subnetIP(self):
 874         """ IP6 MACIP exactMAC|subnetIP ACL bridged traffic
 875         """
 876
 877         self.run_traffic(self.EXACT_MAC, self.SUBNET_IP,
 878                          self.BRIDGED, self.IS_IP6, 9)
 879
 880     def test_acl_bridged_ip6_exactMAC_wildIP(self):
 881         """ IP6 MACIP exactMAC|wildIP ACL bridged traffic
 882         """
 883
 884         self.run_traffic(self.EXACT_MAC, self.WILD_IP,
 885                          self.BRIDGED, self.IS_IP6, 9)
 886
 887     def test_acl_bridged_ip6_ouiMAC_exactIP(self):
 888         """ IP6 MACIP oui_MAC|exactIP ACL bridged traffic
 889         """
 890
 891         self.run_traffic(self.OUI_MAC, self.EXACT_IP,
 892                          self.BRIDGED, self.IS_IP6, 9)
 893
 894     def test_acl_bridged_ip6_ouiMAC_subnetIP(self):
 895         """ IP6 MACIP ouiMAC|subnetIP ACL bridged traffic
 896         """
 897
 898         self.run_traffic(self.OUI_MAC, self.SUBNET_IP,
 899                          self.BRIDGED, self.IS_IP6, 9)
 900
 901     def test_acl_bridged_ip6_ouiMAC_wildIP(self):
 902         """ IP6 MACIP ouiMAC|wildIP ACL bridged traffic
 903         """
 904
 905         self.run_traffic(self.OUI_MAC, self.WILD_IP,
 906                          self.BRIDGED, self.IS_IP6, 9)
 907
 908     def test_acl_bridged_ip6_wildMAC_exactIP(self):
 909         """ IP6 MACIP wildcardMAC|exactIP ACL bridged traffic
 910         """
 911
 912         self.run_traffic(self.WILD_MAC, self.EXACT_IP,
 913                          self.BRIDGED, self.IS_IP6, 9)
 914
 915     def test_acl_bridged_ip6_wildMAC_subnetIP(self):
 916         """ IP6 MACIP wildcardMAC|subnetIP ACL bridged traffic
 917         """
 918
 919         self.run_traffic(self.WILD_MAC, self.SUBNET_IP,
 920                          self.BRIDGED, self.IS_IP6, 9)
 921
 922     def test_acl_bridged_ip6_wildMAC_wildIP(self):
 923         """ IP6 MACIP wildcardMAC|wildIP ACL bridged traffic
 924         """
 925
 926         self.run_traffic(self.WILD_MAC, self.WILD_IP,
 927                          self.BRIDGED, self.IS_IP6, 9)
 928
 929     def test_acl_routed_ip6_exactMAC_exactIP(self):
 930         """ IP6 MACIP exactMAC|exactIP ACL routed traffic
 931         """
 932
 933         self.run_traffic(self.EXACT_MAC, self.EXACT_IP,
 934                          self.ROUTED, self.IS_IP6, 9)
 935
 936     def test_acl_routed_ip6_exactMAC_subnetIP(self):
 937         """ IP6 MACIP exactMAC|subnetIP ACL routed traffic
 938         """
 939
 940         self.run_traffic(self.EXACT_MAC, self.SUBNET_IP,
 941                          self.ROUTED, self.IS_IP6, 9)
 942
 943     def test_acl_routed_ip6_exactMAC_wildIP(self):
 944         """ IP6 MACIP exactMAC|wildIP ACL routed traffic
 945         """
 946
 947         self.run_traffic(self.EXACT_MAC, self.WILD_IP,
 948                          self.ROUTED, self.IS_IP6, 9)
 949
 950     def test_acl_routed_ip6_ouiMAC_exactIP(self):
 951         """ IP6 MACIP ouiMAC|exactIP ACL routed traffic
 952         """
 953
 954         self.run_traffic(self.OUI_MAC, self.EXACT_IP,
 955                          self.ROUTED, self.IS_IP6, 9)
 956
 957     def test_acl_routed_ip6_ouiMAC_subnetIP(self):
 958         """ IP6 MACIP ouiMAC|subnetIP ACL routed traffic
 959         """
 960
 961         self.run_traffic(self.OUI_MAC, self.SUBNET_IP,
 962                          self.ROUTED, self.IS_IP6, 9)
 963
 964     def test_acl_routed_ip6_ouiMAC_wildIP(self):
 965         """ IP6 MACIP ouiMAC|wildIP ACL routed traffic
 966         """
 967
 968         self.run_traffic(self.OUI_MAC, self.WILD_IP,
 969                          self.ROUTED, self.IS_IP6, 9)
 970
 971     def test_acl_routed_ip6_wildMAC_exactIP(self):
 972         """ IP6 MACIP wildcardMAC|exactIP ACL routed traffic
 973         """
 974
 975         self.run_traffic(self.WILD_MAC, self.EXACT_IP,
 976                          self.ROUTED, self.IS_IP6, 9)
 977
 978     def test_acl_routed_ip6_wildMAC_subnetIP(self):
 979         """ IP6 MACIP wildcardMAC|subnetIP ACL routed traffic
 980         """
 981
 982         self.run_traffic(self.WILD_MAC, self.SUBNET_IP,
 983                          self.ROUTED, self.IS_IP6, 9)
 984
 985     def test_acl_routed_ip6_wildMAC_wildIP(self):
 986         """ IP6 MACIP wildcardMAC|wildIP ACL
 987         """
 988
 989         self.run_traffic(self.WILD_MAC, self.WILD_IP,
 990                          self.ROUTED, self.IS_IP6, 9)
 991
 992     def test_acl_replace_traffic_ip6(self):
 993         """ MACIP replace ACL with IP6 traffic
 994         """
 995         self.run_traffic(self.OUI_MAC, self.SUBNET_IP,
 996                          self.BRIDGED, self.IS_IP6, 9, try_replace=True)
 997         self.run_traffic(self.EXACT_MAC, self.EXACT_IP,
 998                          self.BRIDGED, self.IS_IP6, 9, try_replace=True)
 999
1000
1001 class TestMACIP(MethodHolder):
1002     """MACIP Tests"""
1003
1004     @classmethod
1005     def setUpClass(cls):
1006         super(TestMACIP, cls).setUpClass()
1007
1008     @classmethod
1009     def tearDownClass(cls):
1010         super(TestMACIP, cls).tearDownClass()
1011
1012     def test_acl_1_2(self):
1013         """ MACIP ACL with 2 entries
1014         """
1015
1016         self.run_test_acls(self.EXACT_MAC, self.WILD_IP, 1, [2])
1017
1018     def test_acl_1_5(self):
1019         """ MACIP ACL with 5 entries
1020         """
1021
1022         self.run_test_acls(self.EXACT_MAC, self.SUBNET_IP, 1, [5])
1023
1024     def test_acl_1_10(self):
1025         """ MACIP ACL with 10 entries
1026         """
1027
1028         self.run_test_acls(self.EXACT_MAC, self.EXACT_IP, 1, [10])
1029
1030     def test_acl_1_20(self):
1031         """ MACIP ACL with 20 entries
1032         """
1033
1034         self.run_test_acls(self.OUI_MAC, self.WILD_IP, 1, [20])
1035
1036     def test_acl_1_50(self):
1037         """ MACIP ACL with 50 entries
1038         """
1039
1040         self.run_test_acls(self.OUI_MAC, self.SUBNET_IP, 1, [50])
1041
1042     def test_acl_1_100(self):
1043         """ MACIP ACL with 100 entries
1044         """
1045
1046         self.run_test_acls(self.OUI_MAC, self.EXACT_IP, 1, [100])
1047
1048     def test_acl_2_X(self):
1049         """ MACIP 2 ACLs each with 100+ entries
1050         """
1051
1052         self.run_test_acls(self.OUI_MAC, self.SUBNET_IP, 2, [100, 200])
1053
1054     def test_acl_10_X(self):
1055         """ MACIP 10 ACLs each with 100+ entries
1056         """
1057
1058         self.run_test_acls(self.EXACT_MAC, self.EXACT_IP, 10,
1059                            [100, 120, 140, 160, 180, 200, 210, 220, 230, 240])
1060
1061     def test_acl_10_X_traffic_ip4(self):
1062         """ MACIP 10 ACLs each with 100+ entries with IP4 traffic
1063         """
1064
1065         self.run_test_acls(self.EXACT_MAC, self.EXACT_IP, 10,
1066                            [100, 120, 140, 160, 180, 200, 210, 220, 230, 240],
1067                            self.BRIDGED, self.IS_IP4)
1068
1069     def test_acl_10_X_traffic_ip6(self):
1070         """ MACIP 10 ACLs each with 100+ entries with IP6 traffic
1071         """
1072
1073         self.run_test_acls(self.EXACT_MAC, self.EXACT_IP, 10,
1074                            [100, 120, 140, 160, 180, 200, 210, 220, 230, 240],
1075                            self.BRIDGED, self.IS_IP6)
1076
1077     def test_acl_replace(self):
1078         """ MACIP replace ACL
1079         """
1080
1081         r1 = self.create_rules(acl_count=3, rules_count=[2, 2, 2])
1082         r2 = self.create_rules(mac_type=self.OUI_MAC, ip_type=self.SUBNET_IP)
1083         self.apply_macip_rules(r1)
1084
1085         acls_before = self.macip_acl_dump_debug()
1086
1087         # replace acls #2, #3 with new
1088         reply = self.vapi.macip_acl_add_replace(r2[0], 2)
1089         self.assertEqual(reply.retval, 0)
1090         self.assertEqual(reply.acl_index, 2)
1091         reply = self.vapi.macip_acl_add_replace(r2[1], 3)
1092         self.assertEqual(reply.retval, 0)
1093         self.assertEqual(reply.acl_index, 3)
1094
1095         acls_after = self.macip_acl_dump_debug()
1096
1097         # verify changes
1098         self.assertEqual(len(acls_before), len(acls_after))
1099         for acl1, acl2 in zip(
1100                 acls_before[:2]+acls_before[4:],
1101                 acls_after[:2]+acls_after[4:]):
1102             self.assertEqual(len(acl1), len(acl2))
1103
1104             self.assertEqual(len(acl1.r), len(acl2.r))
1105             for r1, r2 in zip(acl1.r, acl2.r):
1106                 self.assertEqual(len(acl1.r), len(acl2.r))
1107                 self.assertEqual(acl1.r, acl2.r)
1108         for acl1, acl2 in zip(
1109                 acls_before[2:4],
1110                 acls_after[2:4]):
1111             self.assertEqual(len(acl1), len(acl2))
1112
1113             self.assertNotEqual(len(acl1.r), len(acl2.r))
1114             for r1, r2 in zip(acl1.r, acl2.r):
1115                 self.assertNotEqual(len(acl1.r), len(acl2.r))
1116                 self.assertNotEqual(acl1.r, acl2.r)
1117
1118     def test_delete_intf(self):
1119         """ MACIP ACL delete intf with acl
1120         """
1121
1122         intf_count = len(self.interfaces)+1
1123         intf = []
1124         self.apply_macip_rules(self.create_rules(acl_count=3,
1125                                                  rules_count=[3, 5, 4]))
1126
1127         intf.append(VppLoInterface(self))
1128         intf.append(VppLoInterface(self))
1129
1130         sw_if_index0 = intf[0].sw_if_index
1131         self.vapi.macip_acl_interface_add_del(sw_if_index0, 1)
1132
1133         reply = self.vapi.macip_acl_interface_get()
1134         self.assertEqual(reply.count, intf_count+1)
1135         self.assertEqual(reply.acls[sw_if_index0], 1)
1136
1137         sw_if_index1 = intf[1].sw_if_index
1138         self.vapi.macip_acl_interface_add_del(sw_if_index1, 0)
1139
1140         reply = self.vapi.macip_acl_interface_get()
1141         self.assertEqual(reply.count, intf_count+2)
1142         self.assertEqual(reply.acls[sw_if_index1], 0)
1143
1144         intf[0].remove_vpp_config()
1145         reply = self.vapi.macip_acl_interface_get()
1146         self.assertEqual(reply.count, intf_count+2)
1147         self.assertEqual(reply.acls[sw_if_index0], 4294967295)
1148         self.assertEqual(reply.acls[sw_if_index1], 0)
1149
1150         intf.append(VppLoInterface(self))
1151         intf.append(VppLoInterface(self))
1152         sw_if_index2 = intf[2].sw_if_index
1153         sw_if_index3 = intf[3].sw_if_index
1154         self.vapi.macip_acl_interface_add_del(sw_if_index2, 1)
1155         self.vapi.macip_acl_interface_add_del(sw_if_index3, 1)
1156
1157         reply = self.vapi.macip_acl_interface_get()
1158         self.assertEqual(reply.count, intf_count+3)
1159         self.assertEqual(reply.acls[sw_if_index1], 0)
1160         self.assertEqual(reply.acls[sw_if_index2], 1)
1161         self.assertEqual(reply.acls[sw_if_index3], 1)
1162         self.logger.info("MACIP ACL on multiple interfaces:")
1163         self.logger.info(self.vapi.ppcli("sh acl-plugin macip acl"))
1164         self.logger.info(self.vapi.ppcli("sh acl-plugin macip acl index 1234"))
1165         self.logger.info(self.vapi.ppcli("sh acl-plugin macip acl index 1"))
1166         self.logger.info(self.vapi.ppcli("sh acl-plugin macip acl index 0"))
1167         self.logger.info(self.vapi.ppcli("sh acl-plugin macip interface"))
1168
1169         intf[2].remove_vpp_config()
1170         intf[1].remove_vpp_config()
1171
1172         reply = self.vapi.macip_acl_interface_get()
1173         self.assertEqual(reply.count, intf_count+3)
1174         self.assertEqual(reply.acls[sw_if_index0], 4294967295)
1175         self.assertEqual(reply.acls[sw_if_index1], 4294967295)
1176         self.assertEqual(reply.acls[sw_if_index2], 4294967295)
1177         self.assertEqual(reply.acls[sw_if_index3], 1)
1178
1179         intf[3].remove_vpp_config()
1180         reply = self.vapi.macip_acl_interface_get()
1181
1182         self.assertEqual(len([x for x in reply.acls if x != 4294967295]), 0)
1183
1184
1185 class TestACL_dot1q_bridged(MethodHolder):
1186     """ACL on dot1q bridged subinterfaces Tests"""
1187
1188     @classmethod
1189     def setUpClass(cls):
1190         super(TestACL_dot1q_bridged, cls).setUpClass()
1191
1192     @classmethod
1193     def tearDownClass(cls):
1194         super(TestACL_dot1q_bridged, cls).tearDownClass()
1195
1196     def test_acl_bridged_ip4_subif_dot1q(self):
1197         """ IP4 ACL SubIf Dot1Q bridged traffic"""
1198         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED,
1199                          self.IS_IP4, 9, tags=self.DOT1Q, isMACIP=False)
1200
1201     def test_acl_bridged_ip6_subif_dot1q(self):
1202         """ IP6 ACL SubIf Dot1Q bridged traffic"""
1203         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED,
1204                          self.IS_IP6, 9, tags=self.DOT1Q, isMACIP=False)
1205
1206
1207 class TestACL_dot1ad_bridged(MethodHolder):
1208     """ACL on dot1ad bridged subinterfaces Tests"""
1209
1210     @classmethod
1211     def setUpClass(cls):
1212         super(TestACL_dot1ad_bridged, cls).setUpClass()
1213
1214     @classmethod
1215     def tearDownClass(cls):
1216         super(TestACL_dot1ad_bridged, cls).tearDownClass()
1217
1218     def test_acl_bridged_ip4_subif_dot1ad(self):
1219         """ IP4 ACL SubIf Dot1AD bridged traffic"""
1220         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED,
1221                          self.IS_IP4, 9, tags=self.DOT1AD, isMACIP=False)
1222
1223     def test_acl_bridged_ip6_subif_dot1ad(self):
1224         """ IP6 ACL SubIf Dot1AD bridged traffic"""
1225         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.BRIDGED,
1226                          self.IS_IP6, 9, tags=self.DOT1AD, isMACIP=False)
1227
1228
1229 class TestACL_dot1q_routed(MethodHolder):
1230     """ACL on dot1q routed subinterfaces Tests"""
1231
1232     @classmethod
1233     def setUpClass(cls):
1234         super(TestACL_dot1q_routed, cls).setUpClass()
1235
1236     @classmethod
1237     def tearDownClass(cls):
1238         super(TestACL_dot1q_routed, cls).tearDownClass()
1239
1240     def test_acl_routed_ip4_subif_dot1q(self):
1241         """ IP4 ACL SubIf Dot1Q routed traffic"""
1242         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1243                          self.IS_IP4, 9, tags=self.DOT1Q, isMACIP=False)
1244
1245     def test_acl_routed_ip6_subif_dot1q(self):
1246         """ IP6 ACL SubIf Dot1Q routed traffic"""
1247         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1248                          self.IS_IP6, 9, tags=self.DOT1Q, isMACIP=False)
1249
1250     def test_acl_routed_ip4_subif_dot1q_deny_by_tags(self):
1251         """ IP4 ACL SubIf wrong tags Dot1Q routed traffic"""
1252         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1253                          self.IS_IP4, 9, True, tags=self.DOT1Q, isMACIP=False,
1254                          permit_tags=self.DENY_TAGS)
1255
1256     def test_acl_routed_ip6_subif_dot1q_deny_by_tags(self):
1257         """ IP6 ACL SubIf wrong tags Dot1Q routed traffic"""
1258         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1259                          self.IS_IP6, 9, True, tags=self.DOT1Q, isMACIP=False,
1260                          permit_tags=self.DENY_TAGS)
1261
1262
1263 class TestACL_dot1ad_routed(MethodHolder):
1264     """ACL on dot1ad routed subinterfaces Tests"""
1265
1266     @classmethod
1267     def setUpClass(cls):
1268         super(TestACL_dot1ad_routed, cls).setUpClass()
1269
1270     @classmethod
1271     def tearDownClass(cls):
1272         super(TestACL_dot1ad_routed, cls).tearDownClass()
1273
1274     def test_acl_routed_ip6_subif_dot1ad(self):
1275         """ IP6 ACL SubIf Dot1AD routed traffic"""
1276         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1277                          self.IS_IP6, 9, tags=self.DOT1AD, isMACIP=False)
1278
1279     def test_acl_routed_ip4_subif_dot1ad(self):
1280         """ IP4 ACL SubIf Dot1AD routed traffic"""
1281         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1282                          self.IS_IP4, 9, tags=self.DOT1AD, isMACIP=False)
1283
1284     def test_acl_routed_ip6_subif_dot1ad_deny_by_tags(self):
1285         """ IP6 ACL SubIf wrong tags Dot1AD routed traffic"""
1286         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1287                          self.IS_IP6, 9, True, tags=self.DOT1AD, isMACIP=False,
1288                          permit_tags=self.DENY_TAGS)
1289
1290     def test_acl_routed_ip4_subif_dot1ad_deny_by_tags(self):
1291         """ IP4 ACL SubIf wrong tags Dot1AD routed traffic"""
1292         self.run_traffic(self.EXACT_MAC, self.EXACT_IP, self.ROUTED,
1293                          self.IS_IP4, 9, True, tags=self.DOT1AD, isMACIP=False,
1294                          permit_tags=self.DENY_TAGS)
1295
1296
1297 if __name__ == '__main__':
1298     unittest.main(testRunner=VppTestRunner)