Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion tests/acl/conftest.py
Original file line number Diff line number Diff line change
@@ -1 +0,0 @@

1 change: 0 additions & 1 deletion tests/acl/files/acl_rules_del.json
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,3 @@
}
}
}

70 changes: 43 additions & 27 deletions tests/acl/null_route/test_null_route_helper.py
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
from ptf.mask import Mask
import ptf.packet as scapy

from tests.common.fixtures.ptfhost_utils import remove_ip_addresses # lgtm[py/unused-import]
from tests.common.fixtures.ptfhost_utils import remove_ip_addresses # noqa F401
import ptf.testutils as testutils
from tests.common.plugins.loganalyzer.loganalyzer import LogAnalyzer, LogAnalyzerError

Expand Down Expand Up @@ -40,24 +40,37 @@

TEST_DATA = [
# src_ip, action, expected_result
("1.2.3.4", "", FORWARD), # Should be forwared in default
("fc03:1001::1", "", FORWARD), # Should be forwared in default

("1.2.3.4", "block {} 1.2.3.4".format(ACL_TABLE_NAME_V4), DROP), # Verify block ipv4 without prefix len
("1.2.3.4", "unblock {} 1.2.3.4/32".format(ACL_TABLE_NAME_V4), FORWARD), # Verify unblock ipv4 with prefix len
("1.2.3.4", "block {} 1.2.3.4/32".format(ACL_TABLE_NAME_V4), DROP), # Verify block ipv4 with prefix len
("1.2.3.4", "block {} 1.2.3.4/32".format(ACL_TABLE_NAME_V4), DROP), # Verify double-block dosen't cause issue
("1.2.3.4", "unblock {} 1.2.3.4/32".format(ACL_TABLE_NAME_V4), FORWARD), # Verify unblock ipv4 with prefix len
("1.2.3.4", "unblock {} 1.2.3.4/32".format(ACL_TABLE_NAME_V4), FORWARD), # Verify double-unblock doesn't cause issue

("fc03:1000::1", "block {} fc03:1000::1".format(ACL_TABLE_NAME_V6), DROP), # Verify block ipv6 without prefix len
("fc03:1000::1", "unblock {} fc03:1000::1/128".format(ACL_TABLE_NAME_V6), FORWARD), # Verify unblock ipv6 with prefix len
("fc03:1000::1", "block {} fc03:1000::1/128".format(ACL_TABLE_NAME_V6), DROP), # Verify block ipv6 with prefix len
("fc03:1000::1", "block {} fc03:1000::1/128".format(ACL_TABLE_NAME_V6), DROP), # Verify double-block dosen't cause issue
("fc03:1000::1", "unblock {} fc03:1000::1/128".format(ACL_TABLE_NAME_V6), FORWARD), # Verify unblock ipv4 with prefix len
("fc03:1000::1", "unblock {} fc03:1000::1/128".format(ACL_TABLE_NAME_V6), FORWARD), # Verify double-unblock doesn't cause issue
("1.2.3.4", "", FORWARD), # Should be forwared in default
("fc03:1001::1", "", FORWARD), # Should be forwared in default

("1.2.3.4", "block {} 1.2.3.4"
.format(ACL_TABLE_NAME_V4), DROP), # Verify block ipv4 without prefix len
("1.2.3.4", "unblock {} 1.2.3.4/32"
.format(ACL_TABLE_NAME_V4), FORWARD), # Verify unblock ipv4 with prefix len
("1.2.3.4", "block {} 1.2.3.4/32"
.format(ACL_TABLE_NAME_V4), DROP), # Verify block ipv4 with prefix len
("1.2.3.4", "block {} 1.2.3.4/32"
.format(ACL_TABLE_NAME_V4), DROP), # Verify double-block dosen't cause issue
("1.2.3.4", "unblock {} 1.2.3.4/32"
.format(ACL_TABLE_NAME_V4), FORWARD), # Verify unblock ipv4 with prefix len
("1.2.3.4", "unblock {} 1.2.3.4/32"
.format(ACL_TABLE_NAME_V4), FORWARD), # Verify double-unblock doesn't cause issue

("fc03:1000::1", "block {} fc03:1000::1"
.format(ACL_TABLE_NAME_V6), DROP), # Verify block ipv6 without prefix len
("fc03:1000::1", "unblock {} fc03:1000::1/128".
format(ACL_TABLE_NAME_V6), FORWARD), # Verify unblock ipv6 with prefix len
("fc03:1000::1", "block {} fc03:1000::1/128"
.format(ACL_TABLE_NAME_V6), DROP), # Verify block ipv6 with prefix len
("fc03:1000::1", "block {} fc03:1000::1/128"
.format(ACL_TABLE_NAME_V6), DROP), # Verify double-block dosen't cause issue
("fc03:1000::1", "unblock {} fc03:1000::1/128"
.format(ACL_TABLE_NAME_V6), FORWARD), # Verify unblock ipv4 with prefix len
("fc03:1000::1", "unblock {} fc03:1000::1/128"
.format(ACL_TABLE_NAME_V6), FORWARD), # Verify double-unblock doesn't cause issue
]


@pytest.fixture(scope="module", autouse=True)
def remove_dataacl_table(rand_selected_dut):
"""
Expand All @@ -82,8 +95,8 @@ def remove_dataacl_table(rand_selected_dut):
output = rand_selected_dut.shell("sonic-cfggen -j {} --var-json \"ACL_TABLE\"".format(config_db_json))['stdout']
try:
entry = json.loads(output)[TABLE_NAME]
cmd_create_table = "config acl add table {} {} -p {} -s {}".format(TABLE_NAME, entry['type'], \
",".join(entry['ports']), entry['stage'])
cmd_create_table = "config acl add table {} {} -p {} -s {}"\
.format(TABLE_NAME, entry['type'], ",".join(entry['ports']), entry['stage'])
logger.info("Restoring ACL table {}".format(TABLE_NAME))
rand_selected_dut.shell(cmd_create_table)
except Exception as e:
Expand All @@ -94,7 +107,7 @@ def remove_acl_table(duthost):
"""
A helper function to remove ACL table for testing
"""
cmds= [
cmds = [
"config acl remove table {}".format(ACL_TABLE_NAME_V4),
"config acl remove table {}".format(ACL_TABLE_NAME_V6)
]
Expand Down Expand Up @@ -144,8 +157,10 @@ def apply_pre_defined_rules(rand_selected_dut, create_acl_table):
time.sleep(5)
yield
# Clear ACL rules
rand_selected_dut.shell('sonic-db-cli CONFIG_DB keys "ACL_RULE|{}*" | xargs sonic-db-cli CONFIG_DB del'.format(ACL_TABLE_NAME_V4))
rand_selected_dut.shell('sonic-db-cli CONFIG_DB keys "ACL_RULE|{}*" | xargs sonic-db-cli CONFIG_DB del'.format(ACL_TABLE_NAME_V6))
rand_selected_dut.shell('sonic-db-cli CONFIG_DB keys "ACL_RULE|{}*" | xargs sonic-db-cli CONFIG_DB del'
.format(ACL_TABLE_NAME_V4))
rand_selected_dut.shell('sonic-db-cli CONFIG_DB keys "ACL_RULE|{}*" | xargs sonic-db-cli CONFIG_DB del'
.format(ACL_TABLE_NAME_V6))


@pytest.fixture(scope="module")
Expand All @@ -157,7 +172,7 @@ def setup_ptf(rand_selected_dut, ptfhost, tbinfo):
vlan_name = ""
mg_facts = rand_selected_dut.get_extended_minigraph_facts(tbinfo)
for vlan_info in mg_facts["minigraph_vlan_interfaces"]:
ip_ver = ipaddress.ip_network(vlan_info['addr'], False).version
ip_ver = ipaddress.ip_network(vlan_info['addr'], False).version
dst_ports[ip_ver] = str(ipaddress.ip_address(vlan_info['addr']) + 1) + '/' + str(vlan_info['prefixlen'])
vlan_name = vlan_info['attachto']

Expand All @@ -177,7 +192,7 @@ def generate_packet(src_ip, dst_ip, dst_mac):
"""
Build ipv4 and ipv6 packets/expected_packets for testing.
"""
if ipaddress.ip_network(unicode(src_ip), False).version == 4:
if ipaddress.ip_network(str(src_ip), False).version == 4:
pkt = testutils.simple_ip_packet(eth_dst=dst_mac, ip_src=src_ip, ip_dst=dst_ip)
exp_pkt = Mask(pkt)
exp_pkt.set_do_not_care_scapy(scapy.Ether, "dst")
Expand Down Expand Up @@ -209,7 +224,8 @@ def send_and_verify_packet(ptfadapter, pkt, exp_pkt, tx_port, rx_port, expected_
def test_null_route_helper(rand_selected_dut, tbinfo, ptfadapter, apply_pre_defined_rules, setup_ptf):
"""
Test case to verify script null_route_helper.
Some packets are generated as defined in TEST_DATA and sent to DUT, and verify if packet is forwarded or dropped as expected.
Some packets are generated as defined in TEST_DATA and sent to DUT,
and verify if packet is forwarded or dropped as expected.
"""
ptf_port_info = setup_ptf
rx_port = ptf_port_info['port']
Expand All @@ -228,9 +244,9 @@ def test_null_route_helper(rand_selected_dut, tbinfo, ptfadapter, apply_pre_defi
src_ip = test_item[0]
action = test_item[1]
expected_result = test_item[2]
ip_ver = ipaddress.ip_network(unicode(src_ip), False).version
ip_ver = ipaddress.ip_network(str(src_ip), False).version
logger.info("Testing with src_ip = {} action = {} expected_result = {}"
.format(src_ip, action, expected_result))
.format(src_ip, action, expected_result))
pkt, exp_pkt = generate_packet(src_ip, DST_IP[ip_ver], router_mac)
if action != "":
rand_selected_dut.shell(NULL_ROUTE_HELPER + " " + action)
Expand Down
Loading