Skip to content

Commit 39d5223

Browse files
wangxinliat-grozovik
wangxin
authored and
liat-grozovik
committed
Add test plan for ingress and egress ACL testing (#336)
Signed-off-by: Xin Wang <[email protected]>
1 parent b7ccafd commit 39d5223

1 file changed

Lines changed: 282 additions & 0 deletions

File tree

‎doc/acl/ACL-Ingress-Egress-test-plan.md‎

Lines changed: 282 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,282 @@
1+
# ACL Ingress & Egress Test Plan
2+
3+
- [ACL Ingress & Egress Test Plan](#acl-ingress--egress-test-plan)
4+
- [The existing test plan and scripts](#the-existing-test-plan-and-scripts)
5+
- [Problems of existing ingress ACL testing](#problems-of-existing-ingress-acl-testing)
6+
- [Ingress & egress ACL testing strategy](#ingress--egress-acl-testing-strategy)
7+
- [The testing strategy](#the-testing-strategy)
8+
- [Work need to be done](#work-need-to-be-done)
9+
- [ACL tables and ACL rules](#acl-tables-and-acl-rules)
10+
- [The DATAINGRESS ACL table and its ruls](#the-dataingress-acl-table-and-its-ruls)
11+
- [The DATAEGRESS ACL table and its ruls](#the-dataegress-acl-table-and-its-ruls)
12+
- [Counters of ACL rules](#counters-of-acl-rules)
13+
- [ACL tests](#acl-tests)
14+
15+
## The existing test plan and scripts
16+
17+
The existing test plan: https://github.com/Azure/SONiC/wiki/ACL-test-plan
18+
19+
The existing acl test scripts covered ingress ACL on SONiC switch. Supported topo: t1, t1-lag, t1-64-lag
20+
21+
Below are the covered ACL rules:
22+
```
23+
$ acl-loader show rule
24+
Table Rule Priority Action Match
25+
------- ------------ ---------- -------- ----------------------------
26+
DATAACL RULE_1 9999 FORWARD SRC_IP: 10.0.0.2/32
27+
DATAACL RULE_2 9998 FORWARD DST_IP: 192.168.0.16/32
28+
DATAACL RULE_3 9997 FORWARD DST_IP: 172.16.2.0/32
29+
DATAACL RULE_4 9996 FORWARD L4_SRC_PORT: 4661
30+
DATAACL RULE_5 9995 FORWARD IP_PROTOCOL: 126
31+
DATAACL RULE_6 9994 FORWARD TCP_FLAGS: 0x12/0x12
32+
DATAACL RULE_7 9993 DROP SRC_IP: 10.0.0.3/32
33+
DATAACL RULE_8 9992 FORWARD SRC_IP: 10.0.0.3/32
34+
DATAACL RULE_9 9991 FORWARD L4_DST_PORT: 4661
35+
DATAACL RULE_10 9990 FORWARD L4_SRC_PORT_RANGE: 4656-4671
36+
DATAACL RULE_11 9989 FORWARD L4_DST_PORT_RANGE: 4640-4687
37+
DATAACL RULE_12 9988 FORWARD IP_PROTOCOL: 1
38+
SRC_IP: 10.0.0.2/32
39+
DATAACL RULE_13 9987 FORWARD IP_PROTOCOL: 17
40+
SRC_IP: 10.0.0.2/32
41+
DATAACL DEFAULT_RULE 1 DROP ETHER_TYPE: 2048
42+
```
43+
44+
The existing acl testing script inserts a set of rules into the DATAACL table of type "l3". A default rule is always added by acl-loader.
45+
Any packets that do not match higher priority rules will hit the default rule and be dropped.
46+
To verify that the ingress ACL rules are working, the PTF script send various packets matching higher priority rules. These packets should pass through the rules and be forwarded by switch. The PTF script then can verify appearance of these packets on corresponding egress ports.
47+
48+
### Problems of existing ingress ACL testing
49+
50+
* Most of the rules covered FORWARD action. Coverage of DROP action is not enough.
51+
* "aclshow -a" can show counters of ACL rules. Checking counters is not covered.
52+
* The packets intended for matching RULE_12 and RULE_13 are matched by RULE_1 firstly. RULE_12 and RULE_13 are never hit.
53+
* Logging of the PTF script needs improvement. If a case failed, failed case is not in ansible log. Need to check PTF log to find out exactly which case failed.
54+
55+
## Ingress & egress ACL testing strategy
56+
57+
### The testing strategy
58+
59+
In a summary, to cover egress ACL testing, we plan to:
60+
* Improve the existing ingress ACL scripts to address the current problems
61+
* Extend the scripts to cover egress ACL testing
62+
63+
To test egress ACL, we need another ACL table with `stage` property set to `egress`. When the `stage` property is not set, it takes default value `ingress`. The builtin DATAACL table could be reused. But for simplicity, two ACL tables will be added, one for ingress, one for egress:
64+
65+
ACL Table | Type | Bind to | Stage | Description
66+
----------|------|---------|-------|-------------
67+
DATAINGRESS | L3 | All ports | Ingress | For testing ingress ACL
68+
DATAEGRESS | L3 | All ports | Egress | For testing egress ACL
69+
70+
When t1 topology is used, the tables can bind to all ports. When t1-lag and t1-64-lag topologies are used, the ports connected to spine routers are all in portchannel. For these ports, the added ACL tables should not directly bind to them. Instead, the portchannels should be binded to the ACL tables.
71+
72+
A same set of improved ACL rules can be used for both ingress and egress ACL testing. While testing ingress ACL, it is always possible to hit the rules. While testing egress ACL, destination IP address of the injected packet must be routable. Otherwise, the injected packet would never get a chance to hit the egress rule.
73+
74+
For completness, both packet flow directions will be covered:
75+
* TOR ports -> SPINE ports: Inject packet into tor ports. Set destination IP address to BGP routes learnt on spine ports. Check the packet on spine ports.
76+
* SPINE ports -> TOR ports: Inject packet into spine ports. Set destination IP address to BGP routes learnt on tor ports. Check the packet on tor ports.
77+
78+
### Work need to be done
79+
80+
Work need to be done based on this strategy and existing scripts:
81+
* Update the existing acltb.yml script:
82+
* Backup config_db.
83+
* Create ACL tables and load ACL rules for testing.
84+
* Run the PTF scritp.
85+
* Restore configuration after testing.
86+
* Update the PTF script
87+
* Add more test cases for the improved set of ACL rules.
88+
* Improve logging of the PTF script. Output more detailed information of failed case in ansible log.
89+
* Improve the ACL rules
90+
* The same set of existing ACL rules could be reused. Load the same set of rules to different tables during testing.
91+
* Improve the existing ACL rules to address issue that RULE_12 and RULE_13 are not hit.
92+
* Extend the existing ACL rules to cover more DROP action. The PTF script should be extended accordingly too.
93+
* Change source IP to addresses that are not used by other devices in current topologies
94+
* Add two rules to always allow BGP packets. Othewise, BGP routes will be lost.
95+
* Add a new ansible module for gathering ACL counters in DUT switch.
96+
* Check counters of ACL rules after each PTF script execution.
97+
98+
### ACL tables and ACL rules
99+
The builtin ACL tables DATAACL will not be used. Will add 2 new L3 ACL tables for testing:
100+
101+
ACL Table | Type | Bind to | Stage | Description
102+
----------|------|---------|-------|-------------
103+
DATAINGRESS | L3 | All ports | Ingress | For testing ingress ACL
104+
DATAEGRESS | L3 | All ports | Egress | For testing egress ACL
105+
106+
The ACL rules will be improved too:
107+
* Add a new set of rules RULE_14 to RULE_26 for testing DROP action.
108+
* RULE_12 and RULE_13 should use source IP address different with RULE_1, for example 20.0.0.4/32. Otherwise packets with source IP 20.0.0.2/32 would always match RULE_1 and never hit RULE_12 and RULE_13. The PTF script testing case 10 and 11 need to use this new source IP address for the injected packets.
109+
* RULE_25 and RULE_26 should use source IP address different with: RULE_1, RULE_12, RULE_13 and RULE_14. Otherwise, RULE_25 and RULE_26 will never be hit.
110+
* RULE_27 and RULE_28 are added to always alow BGP traffic. Otherwise, BGP traffic would be blocked by the DEFAULT_RULE.
111+
112+
The ACL rules should not be all loaded at the same time.
113+
114+
Example of updated ACL tables and rules:
115+
116+
#### The DATAINGRESS ACL table and its ruls
117+
The ACL rules for DATAINGRESS ACL table should only be loaded when testing ingress ACL.
118+
```
119+
$ acl-loader show rule
120+
Table Rule Priority Action Match
121+
----------- ------------ ---------- -------- ----------------------------
122+
DATAINGRESS RULE_1 9999 FORWARD SRC_IP: 20.0.0.2/32
123+
DATAINGRESS RULE_2 9998 FORWARD DST_IP: 192.168.0.16/32
124+
DATAINGRESS RULE_3 9997 FORWARD DST_IP: 172.16.2.0/32
125+
DATAINGRESS RULE_4 9996 FORWARD L4_SRC_PORT: 4621
126+
DATAINGRESS RULE_5 9995 FORWARD IP_PROTOCOL: 126
127+
DATAINGRESS RULE_6 9994 FORWARD TCP_FLAGS: 0x1b/0x1b
128+
DATAINGRESS RULE_7 9993 DROP SRC_IP: 20.0.0.3/32
129+
DATAINGRESS RULE_8 9992 FORWARD SRC_IP: 20.0.0.3/32
130+
DATAINGRESS RULE_9 9991 FORWARD L4_DST_PORT: 4631
131+
DATAINGRESS RULE_10 9990 FORWARD L4_SRC_PORT_RANGE: 4656-4671
132+
DATAINGRESS RULE_11 9989 FORWARD L4_DST_PORT_RANGE: 4640-4687
133+
DATAINGRESS RULE_12 9988 FORWARD IP_PROTOCOL: 1
134+
SRC_IP: 20.0.0.4/32
135+
DATAINGRESS RULE_13 9987 FORWARD IP_PROTOCOL: 17
136+
SRC_IP: 20.0.0.4/32
137+
DATAINGRESS RULE_14 9986 DROP SRC_IP: 20.0.0.6/32
138+
DATAINGRESS RULE_15 9985 DROP DST_IP: 192.168.0.17/32
139+
DATAINGRESS RULE_16 9984 DROP DST_IP: 172.16.3.0/32
140+
DATAINGRESS RULE_17 9983 DROP L4_SRC_PORT: 4721
141+
DATAINGRESS RULE_18 9982 DROP IP_PROTOCOL: 127
142+
DATAINGRESS RULE_19 9981 DROP TCP_FLAGS: 0x24/0x24
143+
DATAINGRESS RULE_20 9980 FORWARD SRC_IP: 20.0.0.7/32
144+
DATAINGRESS RULE_21 9979 DROP SRC_IP: 20.0.0.7/32
145+
DATAINGRESS RULE_22 9978 DROP L4_DST_PORT: 4731
146+
DATAINGRESS RULE_23 9977 DROP L4_SRC_PORT_RANGE: 4756-4771
147+
DATAINGRESS RULE_24 9976 DROP L4_DST_PORT_RANGE: 4740-4787
148+
DATAINGRESS RULE_25 9975 DROP IP_PROTOCOL: 1
149+
SRC_IP: 20.0.0.8/32
150+
DATAINGRESS RULE_26 9974 DROP IP_PROTOCOL: 17
151+
SRC_IP: 20.0.0.8/32
152+
DATAINGRESS RULE_27 9973 FORWARD L4_SRC_PORT: 179
153+
DATAINGRESS RULE_28 9972 FORWARD L4_DST_PORT: 179
154+
DATAINGRESS DEFAULT_RULE 1 DROP ETHER_TYPE: 2048
155+
```
156+
157+
#### The DATAEGRESS ACL table and its ruls
158+
The ACL rules for DATAEGRESS ACL table should only be loaded when testing egress ACL.
159+
```
160+
$ acl-loader show rule
161+
Table Rule Priority Action Match
162+
---------- ------------ ---------- -------- ----------------------------
163+
DATAEGRESS RULE_1 9999 FORWARD SRC_IP: 20.0.0.2/32
164+
DATAEGRESS RULE_2 9998 FORWARD DST_IP: 192.168.0.16/32
165+
DATAEGRESS RULE_3 9997 FORWARD DST_IP: 172.16.2.0/32
166+
DATAEGRESS RULE_4 9996 FORWARD L4_SRC_PORT: 4621
167+
DATAEGRESS RULE_5 9995 FORWARD IP_PROTOCOL: 126
168+
DATAEGRESS RULE_6 9994 FORWARD TCP_FLAGS: 0x1b/0x1b
169+
DATAEGRESS RULE_7 9993 DROP SRC_IP: 20.0.0.3/32
170+
DATAEGRESS RULE_8 9992 FORWARD SRC_IP: 20.0.0.3/32
171+
DATAEGRESS RULE_9 9991 FORWARD L4_DST_PORT: 4631
172+
DATAEGRESS RULE_10 9990 FORWARD L4_SRC_PORT_RANGE: 4656-4671
173+
DATAEGRESS RULE_11 9989 FORWARD L4_DST_PORT_RANGE: 4640-4687
174+
DATAEGRESS RULE_12 9988 FORWARD IP_PROTOCOL: 1
175+
SRC_IP: 20.0.0.4/32
176+
DATAEGRESS RULE_13 9987 FORWARD IP_PROTOCOL: 17
177+
SRC_IP: 20.0.0.4/32
178+
DATAEGRESS RULE_14 9986 DROP SRC_IP: 20.0.0.6/32
179+
DATAEGRESS RULE_15 9985 DROP DST_IP: 192.168.0.17/32
180+
DATAEGRESS RULE_16 9984 DROP DST_IP: 172.16.3.0/32
181+
DATAEGRESS RULE_17 9983 DROP L4_SRC_PORT: 4721
182+
DATAEGRESS RULE_18 9982 DROP IP_PROTOCOL: 127
183+
DATAEGRESS RULE_19 9981 DROP TCP_FLAGS: 0x24/0x24
184+
DATAEGRESS RULE_20 9980 FORWARD SRC_IP: 20.0.0.7/32
185+
DATAEGRESS RULE_21 9979 DROP SRC_IP: 20.0.0.7/32
186+
DATAEGRESS RULE_22 9978 DROP L4_DST_PORT: 4731
187+
DATAEGRESS RULE_23 9977 DROP L4_SRC_PORT_RANGE: 4756-4771
188+
DATAEGRESS RULE_24 9976 DROP L4_DST_PORT_RANGE: 4740-4787
189+
DATAEGRESS RULE_25 9975 DROP IP_PROTOCOL: 1
190+
SRC_IP: 20.0.0.8/32
191+
DATAEGRESS RULE_26 9974 DROP IP_PROTOCOL: 17
192+
SRC_IP: 20.0.0.8/32
193+
DATAEGRESS RULE_27 9973 FORWARD L4_SRC_PORT: 179
194+
DATAEGRESS RULE_28 9972 FORWARD L4_DST_PORT: 179
195+
DATAEGRESS DEFAULT_RULE 1 DROP ETHER_TYPE: 2048
196+
```
197+
198+
#### Counters of ACL rules
199+
Use the `aclshow` command can check counters of ACL rules.
200+
```
201+
$ aclshow -a
202+
RULE NAME TABLE NAME TYPE PRIO ACTION PACKETS COUNT BYTES COUNT
203+
------------ ------------ ------ ------ -------- --------------- -------------
204+
RULE_1 DATAINGRESS L3 9999 FORWARD 0 0
205+
RULE_2 DATAINGRESS L3 9998 FORWARD 0 0
206+
RULE_3 DATAINGRESS L3 9997 FORWARD 0 0
207+
RULE_4 DATAINGRESS L3 9996 FORWARD 0 0
208+
RULE_5 DATAINGRESS L3 9995 FORWARD 0 0
209+
RULE_6 DATAINGRESS L3 9994 FORWARD 0 0
210+
RULE_7 DATAINGRESS L3 9993 DROP 0 0
211+
RULE_8 DATAINGRESS L3 9992 FORWARD 0 0
212+
RULE_9 DATAINGRESS L3 9991 FORWARD 0 0
213+
RULE_10 DATAINGRESS L3 9990 FORWARD 0 0
214+
RULE_11 DATAINGRESS L3 9989 FORWARD 0 0
215+
RULE_12 DATAINGRESS L3 9988 FORWARD 0 0
216+
RULE_13 DATAINGRESS L3 9987 FORWARD 0 0
217+
RULE_14 DATAINGRESS L3 9986 DROP 0 0
218+
RULE_15 DATAINGRESS L3 9985 DROP 0 0
219+
RULE_16 DATAINGRESS L3 9984 DROP 0 0
220+
RULE_17 DATAINGRESS L3 9983 DROP 0 0
221+
RULE_18 DATAINGRESS L3 9982 DROP 0 0
222+
RULE_19 DATAINGRESS L3 9981 DROP 0 0
223+
RULE_20 DATAINGRESS L3 9980 FORWARD 0 0
224+
RULE_21 DATAINGRESS L3 9979 DROP 0 0
225+
RULE_22 DATAINGRESS L3 9978 DROP 0 0
226+
RULE_23 DATAINGRESS L3 9977 DROP 0 0
227+
RULE_24 DATAINGRESS L3 9976 DROP 0 0
228+
RULE_25 DATAINGRESS L3 9975 DROP 0 0
229+
RULE_26 DATAINGRESS L3 9974 DROP 0 0
230+
RULE_27 DATAINGRESS L3 9973 FORWARD 256 19584
231+
RULE_28 DATAINGRESS L3 9972 FORWARD 283 28219
232+
DEFAULT_RULE DATAINGRESS L3 1 DROP 6 420
233+
```
234+
235+
### ACL tests
236+
237+
Overall steps of automation script:
238+
* Backup config_db.
239+
* Create ACL tables before testing.
240+
* Load ACL rules to DATAINGRESS for ingress ACL testing.
241+
* Run the PTF script to cover different packet injection directions.
242+
* Test other scenarios and run the PTF script:
243+
* Toggle all the switch ports.
244+
* Use incremental update to load the ACL rules.
245+
* Save config and reboot.
246+
* Remove the ACL from DATAINGRESS.
247+
* Load ACL rules to DATAEGRESS for egress ACL testing.
248+
* Run the PTF script to cover different packet injection directions.
249+
* Test other scenarios and run the PTF script:
250+
* Toggle all the switch ports.
251+
* Use incremental update to load the ACL rules.
252+
* Save config and reboot.
253+
* Remove the ACL from DATAEGRESS.
254+
* Restore configuration after testing.
255+
256+
For each packet direction of ingress and egress testing, all of these tests must be executed in the PTF script:
257+
258+
* Test 0 - unmatched packet - dropped
259+
260+
* Test 1 - source IP match - forwarded
261+
* Test 2 - destination IP match - forwarded
262+
* Test 3 - L4 source port match - forwarded
263+
* Test 4 - L4 destination port match - forwarded
264+
* Test 5 - IP protocol match - forwarded
265+
* Test 6 - TCP flags match - forwarded
266+
* Test 7 - source port range match - forwarded
267+
* Test 8 - destination port range match - forwarded
268+
* Test 9 - rules priority - dropped
269+
* Test 10 - ICMP source IP match - forwarded
270+
* Test 11 - UDP source IP match - forwarded
271+
272+
* Test 12 - source IP match - dropped
273+
* Test 13 - destination IP match - dropped
274+
* Test 14 - L4 source port match - dropped
275+
* Test 15 - L4 destination port match - dropped
276+
* Test 16 - IP protocol match - dropped
277+
* Test 17 - TCP flags match - dropped
278+
* Test 18 - source port range match - dropped
279+
* Test 19 - destination port range match - dropped
280+
* Test 20 - rules priority - forwarded
281+
* Test 21 - ICMP source IP match - dropped
282+
* Test 22 - UDP source IP match - dropped

0 commit comments

Comments
 (0)