Skip to content

Validate ACL rules and routes in test_everflow_testbed before traffic… #22303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
venu-nexthop wants to merge 3 commits into from
Closed

Validate ACL rules and routes in test_everflow_testbed before traffic… #22303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
38774cc
Validate ACL rules and routes in test_everflow_testbed before traffic…
venu-nexthop Feb 9, 2026
349257d
Fix ipv6 ACL rule to use IPV6ANY instead of ANY or IP
venu-nexthop Feb 9, 2026
4483600
Pull changes from https://github.com/sonic-net/sonic-mgmt/pull/22224
venu-nexthop Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions tests/everflow/everflow_test_utilities.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -486,6 +486,15 @@ def validate_mirror_session_up(duthost, session_name):
return False


def validate_acl_rules_in_asic_db(duthost):
"""
Validate the number of ACL rules in ASIC DB is the same as the number of ACL rules in CONFIG DB.
"""
config_rules = duthost.shell("sonic-db-cli CONFIG_DB KEYS *ACL_RULE*")['stdout_lines']
asic_rules = duthost.shell("sonic-db-cli ASIC_DB KEYS *SAI_OBJECT_TYPE_ACL_ENTRY*")['stdout_lines']
return len(config_rules) == len(asic_rules)


# TODO: This should be refactored to some common area of sonic-mgmt.
def add_route(duthost, prefix, nexthop, namespace):
"""
Expand Down Expand Up @@ -997,7 +1006,7 @@ def apply_non_openconfig_acl_rule(self, duthost, extra_vars, rule_file, table_na
duthost.shell("config load -y {}".format(dest_path))

if duthost.facts['asic_type'] != 'vs':
pytest_assert(wait_until(60, 2, 0, self.check_rule_active, duthost, table_name),
pytest_assert(wait_until(240, 2, 0, self.check_rule_active, duthost, table_name),
"Acl rule counters are not ready")

def apply_ip_type_rule(self, duthost, ip_version):
Expand Down Expand Up @@ -1046,9 +1055,9 @@ def send_and_check_mirror_packets(self,
src_port_metadata_map = {}

if 't2' in setup['topo'] and 'lt2' not in setup['topo'] and 'ft2' not in setup['topo']:
src_port_set.add(src_port)
src_port_metadata_map[src_port] = (None, 1)
if valid_across_namespace is True:
src_port_set.add(src_port)
src_port_metadata_map[src_port] = (None, 1)
# Add the dest_port to src_port_set only in non MACSEC testbed scenarios
if not MACSEC_INFO:
if duthost.facts['switch_type'] == "voq":
Expand Down
4 changes: 2 additions & 2 deletions tests/everflow/files/test_rules_ip_type_v6.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,13 @@
"ACL_RULE": {
"{{ table_name }}|rule_999": {
"PRIORITY": "999",
"IP_TYPE": "ANY",
"IP_TYPE": "IPV6ANY",
"{{ action }}": "test_session_1",
"DST_IPV6": "2002:0225:7c6b:a982:d48b:230e:f271:0011"
},
"{{ table_name }}|rule_998": {
"PRIORITY": "998",
"IP_TYPE": "IP",
"IP_TYPE": "IPV6ANY",
"{{ action }}": "test_session_1",
"DST_IPV6": "2002:0225:7c6b:a982:d48b:230e:f271:0012"
},
Expand Down
67 changes: 56 additions & 11 deletions tests/everflow/test_everflow_testbed.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,6 +268,9 @@ def test_everflow_multi_binding_acl(self, setup_info, setup_mirror_session,
multi_binding_acl=True
)

everflow_utils.remove_route(remote_dut, session_prefixes[0], peer_ip,
setup_info[dest_port_type]["remote_namespace"])

def test_everflow_basic_forwarding(self, setup_info, setup_mirror_session, # noqa F811
dest_port_type, ptfadapter, tbinfo, mux_config, # noqa F811
toggle_all_simulator_ports_to_rand_selected_tor, # noqa F811
Expand Down Expand Up @@ -296,7 +299,10 @@ def test_everflow_basic_forwarding(self, setup_info, setup_mirror_session,
everflow_utils.add_route(remote_dut, session_prefixes[0], peer_ip,
setup_info[dest_port_type]["remote_namespace"])

time.sleep(15)
pytest_assert(
wait_until(120, 10, 0, everflow_utils.validate_asic_route, remote_dut, session_prefixes[0])
)
pytest_assert(wait_until(120, 10, 0, everflow_utils.validate_acl_rules_in_asic_db, everflow_dut))

# Verify that mirrored traffic is sent along the route we installed
rx_port_ptf_id = setup_info[dest_port_type]["src_port_ptf_id"]
Expand Down Expand Up @@ -341,7 +347,11 @@ def test_everflow_basic_forwarding(self, setup_info, setup_mirror_session,
peer_ip = everflow_utils.get_neighbor_info(remote_dut, tx_port, tbinfo, ip_version=erspan_ip_ver)
everflow_utils.add_route(remote_dut, session_prefixes[1], peer_ip,
setup_info[dest_port_type]["remote_namespace"])
time.sleep(15)
pytest_assert(
wait_until(
120, 10, 0, everflow_utils.validate_asic_route, remote_dut, session_prefixes[1]
)
)

# Verify that mirrored traffic uses the new route
tx_port_ptf_id = setup_info[dest_port_type]["dest_port_ptf_id"][1]
Expand All @@ -360,7 +370,12 @@ def test_everflow_basic_forwarding(self, setup_info, setup_mirror_session,
# Remove the better route.
everflow_utils.remove_route(remote_dut, session_prefixes[1], peer_ip,
setup_info[dest_port_type]["remote_namespace"])
time.sleep(15)
pytest_assert(
wait_until(
120, 10, 0,
lambda: not everflow_utils.validate_asic_route(remote_dut, session_prefixes[1])
)
)

# Verify that mirrored traffic switches back to the original route
tx_port_ptf_id = setup_info[dest_port_type]["dest_port_ptf_id"][0]
Expand Down Expand Up @@ -397,7 +412,10 @@ def test_everflow_neighbor_mac_change(self, setup_info, setup_mirror_session,
else setup_mirror_session["session_prefixes_ipv6"]
everflow_utils.add_route(remote_dut, session_prefixes[0], peer_ip,
setup_info[dest_port_type]["remote_namespace"])
time.sleep(15)
pytest_assert(
wait_until(120, 10, 0, everflow_utils.validate_asic_route, remote_dut, session_prefixes[0])
)
pytest_assert(wait_until(120, 10, 0, everflow_utils.validate_acl_rules_in_asic_db, everflow_dut))

# Verify that mirrored traffic is sent along the route we installed
rx_port_ptf_id = setup_info[dest_port_type]["src_port_ptf_id"]
Expand Down Expand Up @@ -476,7 +494,10 @@ def test_everflow_remove_unused_ecmp_next_hop(self, setup_info, setup_mirror_ses
else setup_mirror_session["session_prefixes_ipv6"]
everflow_utils.add_route(remote_dut, session_prefixes[0], peer_ip_0,
setup_info[dest_port_type]["remote_namespace"])
time.sleep(15)
pytest_assert(
wait_until(120, 10, 0, everflow_utils.validate_asic_route, remote_dut, session_prefixes[0])
)
pytest_assert(wait_until(120, 10, 0, everflow_utils.validate_acl_rules_in_asic_db, everflow_dut))

tx_port = setup_info[dest_port_type]["dest_port"][1]
peer_ip_1 = everflow_utils.get_neighbor_info(remote_dut, tx_port, tbinfo, ip_version=erspan_ip_ver)
Expand Down Expand Up @@ -587,7 +608,10 @@ def test_everflow_remove_used_ecmp_next_hop(self, setup_info, setup_mirror_sessi
else setup_mirror_session["session_prefixes_ipv6"]
everflow_utils.add_route(remote_dut, session_prefixes[0], peer_ip_0,
setup_info[dest_port_type]["remote_namespace"])
time.sleep(15)
pytest_assert(
wait_until(120, 10, 0, everflow_utils.validate_asic_route, remote_dut, session_prefixes[0])
)
pytest_assert(wait_until(120, 10, 0, everflow_utils.validate_acl_rules_in_asic_db, everflow_dut))

# Verify that mirrored traffic is sent along the route we installed
rx_port_ptf_id = setup_info[dest_port_type]["src_port_ptf_id"]
Expand Down Expand Up @@ -781,6 +805,8 @@ def test_everflow_dscp_with_policer(
config_method,
rules=EVERFLOW_DSCP_RULES)

pytest_assert(wait_until(120, 10, 0, everflow_utils.validate_acl_rules_in_asic_db, everflow_dut))

# Run test with expected CIR/CBS in packets/sec and tolerance %
partial_ptf_runner(setup_info,
dest_port_type,
Expand Down Expand Up @@ -833,7 +859,10 @@ def test_everflow_frwd_with_bkg_trf(self,
everflow_utils.add_route(remote_dut, session_prefixes[0], peer_ip,
setup_info[dest_port_type]["remote_namespace"])

time.sleep(15)
pytest_assert(
wait_until(120, 10, 0, everflow_utils.validate_asic_route, remote_dut, session_prefixes[0])
)
pytest_assert(wait_until(120, 10, 0, everflow_utils.validate_acl_rules_in_asic_db, everflow_dut))

# Verify that mirrored traffic is sent along the route we installed
rx_port_ptf_id = setup_info[dest_port_type]["src_port_ptf_id"]
Expand Down Expand Up @@ -940,7 +969,11 @@ def background_traffic(run_count=None):
peer_ip = everflow_utils.get_neighbor_info(remote_dut, tx_port, tbinfo, ip_version=erspan_ip_ver)
everflow_utils.add_route(remote_dut, session_prefixes[1], peer_ip,
setup_info[dest_port_type]["remote_namespace"])
time.sleep(15)
pytest_assert(
wait_until(
120, 10, 0, everflow_utils.validate_asic_route, remote_dut, session_prefixes[1]
)
)
background_traffic(run_count=1)
# Verify that mirrored traffic uses the new route
tx_port_ptf_id = setup_info[dest_port_type]["dest_port_ptf_id"][1]
Expand All @@ -959,7 +992,12 @@ def background_traffic(run_count=None):
# Remove the better route.
everflow_utils.remove_route(remote_dut, session_prefixes[1], peer_ip,
setup_info[dest_port_type]["remote_namespace"])
time.sleep(15)
pytest_assert(
wait_until(
120, 10, 0,
lambda: not everflow_utils.validate_asic_route(remote_dut, session_prefixes[1])
)
)
background_traffic(run_count=1)
# Verify that mirrored traffic switches back to the original route
tx_port_ptf_id = setup_info[dest_port_type]["dest_port_ptf_id"][0]
Expand Down Expand Up @@ -1068,7 +1106,13 @@ def configure_mirror_session_with_queue(mirror_session, queue_num):
everflow_utils.add_route(remote_dut, setup_mirror_session["session_prefixes"][0], peer_ip,
setup_info[dest_port_type]["remote_namespace"])

time.sleep(15)
pytest_assert(
wait_until(
120, 10, 0,
everflow_utils.validate_asic_route, remote_dut, setup_mirror_session["session_prefixes"][0]
)
)
pytest_assert(wait_until(120, 10, 0, everflow_utils.validate_acl_rules_in_asic_db, remote_dut))

# Verify that mirrored traffic is sent along the route we installed
rx_port_ptf_id = setup_info[dest_port_type]["src_port_ptf_id"]
Expand All @@ -1095,7 +1139,8 @@ def configure_mirror_session_with_queue(mirror_session, queue_num):
dest_port_type,
queue,
asic_ns,
recircle_port
recircle_port,
valid_across_namespace=everflow_dut.is_multi_asic,
)
finally:
remote_dut.shell(remote_dut.get_vtysh_cmd_for_namespace(
Expand Down
Loading