8800f732f8
- Make framework.py classes a subset of asfframework.py classes - Remove all packet related code from asfframework.py - Add test class and test case set up debug output to log - Repatriate packet tests from asf to test directory - Remove non-packet related code from framework.py and inherit them from asfframework.py classes - Clean up unused import variables - Re-enable BFD tests on Ubuntu 22.04 and fix intermittent test failures in echo_looped_back testcases (where # control packets verified but not guaranteed to be received during test) - Re-enable Wireguard tests on Ubuntu 22.04 and fix intermittent test failures in handshake ratelimiting testcases and event testcase - Run Wiregard testcase suites solo - Improve debug output in log.txt - Increase VCL/LDP post sleep timeout to allow iperf server to finish cleanly. - Fix pcap history files to be sorted by suite and testcase and ensure order/timestamp is correct based on creation in the testcase. - Decode pcap files for each suite and testcase for all errors or if configured via comandline option / env var - Improve vpp corefile detection to allow complete corefile generation - Disable vm vpp interfaces testcases on debian11 - Clean up failed unittest dir when retrying failed testcases and unify testname directory and failed linknames into framwork functions Type: test Change-Id: I0764f79ea5bb639d278bf635ed2408d4d5220e1e Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
323 lines
11 KiB
Python
323 lines
11 KiB
Python
#!/usr/bin/env python3
|
|
|
|
import unittest
|
|
|
|
from framework import VppTestCase
|
|
from asfframework import VppTestRunner
|
|
|
|
from scapy.packet import Raw
|
|
from scapy.layers.l2 import Ether
|
|
from scapy.layers.inet import IP, UDP
|
|
from scapy.layers.inet6 import IPv6
|
|
|
|
from vpp_papi import VppEnum
|
|
|
|
N_PKTS = 63
|
|
|
|
|
|
class TestURPF(VppTestCase):
|
|
"""Unicast Reverse Path Forwarding Test Case"""
|
|
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
super(TestURPF, cls).setUpClass()
|
|
|
|
@classmethod
|
|
def tearDownClass(cls):
|
|
super(TestURPF, cls).tearDownClass()
|
|
|
|
def setUp(self):
|
|
super(TestURPF, self).setUp()
|
|
|
|
# create 4 pg interfaces so there are a few addresses
|
|
# in the FIB
|
|
self.create_pg_interfaces(range(4))
|
|
|
|
for i in self.pg_interfaces:
|
|
i.admin_up()
|
|
i.config_ip4()
|
|
i.resolve_arp()
|
|
i.config_ip6()
|
|
i.resolve_ndp()
|
|
|
|
def tearDown(self):
|
|
for i in self.pg_interfaces:
|
|
i.unconfig_ip4()
|
|
i.unconfig_ip6()
|
|
i.admin_down()
|
|
super(TestURPF, self).tearDown()
|
|
|
|
def test_urpf4(self):
|
|
"""uRPF IP4"""
|
|
|
|
e = VppEnum
|
|
p_spoof_loose = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IP(src="3.3.3.3", dst=self.pg1.remote_ip4)
|
|
/ UDP(sport=1234, dport=1234)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
p_spoof_strict = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IP(src=self.pg2.remote_ip4, dst=self.pg1.remote_ip4)
|
|
/ UDP(sport=1234, dport=1234)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
p_good = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4)
|
|
/ UDP(sport=1234, dport=1234)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
|
|
#
|
|
# before adding the uRPF, ensure all packets are forwarded
|
|
#
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
|
|
|
|
#
|
|
# apply loose uRPF check on pg0 rx
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=True,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP4,
|
|
sw_if_index=self.pg0.sw_if_index,
|
|
)
|
|
|
|
# good packets still pass
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
# packets from address for which there is a route are forwarded
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
# packets from address to which there is no route are dropped
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip4-rx-urpf-loose/uRPF Drop", N_PKTS)
|
|
|
|
#
|
|
# crank it up to strict mode
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=True,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP4,
|
|
sw_if_index=self.pg0.sw_if_index,
|
|
)
|
|
|
|
# good packets still pass
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
# packets that would not be routed back thru pg0 are dropped
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip4-rx-urpf-strict/uRPF Drop", 2 * N_PKTS)
|
|
|
|
#
|
|
# disable uRPF, all traffic should pass
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=True,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP4,
|
|
sw_if_index=self.pg0.sw_if_index,
|
|
)
|
|
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
|
|
|
|
#
|
|
# Now apply in the TX direction
|
|
# for loose it is the same deal, they should not be forwarded
|
|
# if there's no route
|
|
# for strict they should not be forwarded if they would be
|
|
# forwarded thru that interface.
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=False,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP4,
|
|
sw_if_index=self.pg1.sw_if_index,
|
|
)
|
|
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip4-tx-urpf-loose/uRPF Drop", N_PKTS)
|
|
|
|
self.vapi.urpf_update(
|
|
is_input=False,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP4,
|
|
sw_if_index=self.pg1.sw_if_index,
|
|
)
|
|
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
# the strict packet, from a peer is allowed, since it does
|
|
# not forward via pg1
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip4-tx-urpf-strict/uRPF Drop", N_PKTS)
|
|
|
|
# change the strict packet so that it would forward through pg1
|
|
p_spoof_strict = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IP(src=self.pg1.remote_ip4, dst=self.pg1.remote_ip4)
|
|
/ UDP(sport=1234, dport=1234)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
|
|
self.assert_error_counter_equal("/err/ip4-tx-urpf-strict/uRPF Drop", 2 * N_PKTS)
|
|
|
|
# cleanup
|
|
self.vapi.urpf_update(
|
|
is_input=False,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP4,
|
|
sw_if_index=self.pg1.sw_if_index,
|
|
)
|
|
|
|
def test_urpf6(self):
|
|
"""uRPF IP6"""
|
|
|
|
e = VppEnum
|
|
p_spoof_loose = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IPv6(src="3::3", dst=self.pg1.remote_ip6)
|
|
/ UDP(sport=1236, dport=1236)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
p_spoof_strict = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IPv6(src=self.pg2.remote_ip6, dst=self.pg1.remote_ip6)
|
|
/ UDP(sport=1236, dport=1236)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
p_good = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IPv6(src=self.pg0.remote_ip6, dst=self.pg1.remote_ip6)
|
|
/ UDP(sport=1236, dport=1236)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
|
|
#
|
|
# before adding the uRPF, ensure all packets are forwarded
|
|
#
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
|
|
|
|
#
|
|
# apply loose uRPF check on pg0 rx
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=True,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP6,
|
|
sw_if_index=self.pg0.sw_if_index,
|
|
)
|
|
|
|
# good packets still pass
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
# packets from address for which there is a route are forwarded
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
# packets from address to which there is no route are dropped
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip6-rx-urpf-loose/uRPF Drop", N_PKTS)
|
|
|
|
#
|
|
# crank it up to strict mode
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=True,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP6,
|
|
sw_if_index=self.pg0.sw_if_index,
|
|
)
|
|
|
|
# good packets still pass
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
# packets that would not be routed back thru pg0 are dropped
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip6-rx-urpf-strict/uRPF Drop", 2 * N_PKTS)
|
|
|
|
#
|
|
# disable uRPF, all traffic should pass
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=True,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP6,
|
|
sw_if_index=self.pg0.sw_if_index,
|
|
)
|
|
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
|
|
|
|
#
|
|
# Now apply in the TX direction
|
|
# for loose it is the same deal, they should not be forwarded
|
|
# if there's no route
|
|
# for strict they should not be forwarded if they would be
|
|
# forwarded thru that interface.
|
|
#
|
|
self.vapi.urpf_update(
|
|
is_input=False,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP6,
|
|
sw_if_index=self.pg1.sw_if_index,
|
|
)
|
|
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip6-tx-urpf-loose/uRPF Drop", N_PKTS)
|
|
|
|
self.vapi.urpf_update(
|
|
is_input=False,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP6,
|
|
sw_if_index=self.pg1.sw_if_index,
|
|
)
|
|
|
|
self.send_and_expect(self.pg0, p_good, self.pg1)
|
|
# the strict packet, from a peer is allowed, since it does
|
|
# not forward via pg1
|
|
self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
|
|
|
|
self.assert_error_counter_equal("/err/ip6-tx-urpf-strict/uRPF Drop", N_PKTS)
|
|
|
|
# change the strict packet so that it would forward through pg1
|
|
p_spoof_strict = (
|
|
Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
|
|
/ IPv6(src=self.pg1.remote_ip6, dst=self.pg1.remote_ip6)
|
|
/ UDP(sport=1236, dport=1236)
|
|
/ Raw(b"\xa5" * 100)
|
|
) * N_PKTS
|
|
|
|
self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
|
|
self.assert_error_counter_equal("/err/ip6-tx-urpf-strict/uRPF Drop", 2 * N_PKTS)
|
|
|
|
# cleanup
|
|
self.vapi.urpf_update(
|
|
is_input=False,
|
|
mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
|
|
af=e.vl_api_address_family_t.ADDRESS_IP6,
|
|
sw_if_index=self.pg1.sw_if_index,
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main(testRunner=VppTestRunner)
|