Commit 1b2841ab authored by Lluis Gifre Renom's avatar Lluis Gifre Renom
Browse files

Tests - ACL End-to-end integration test: 

- Updated README.md
- Updated ContainerLab scenario
- Updated TFS Topology descriptor
- Updated CI/CD pipeline
- Removed unneeded files
parent f46dcc01

src/tests/acl_end2end/.gitlab-ci.yml

+20 −78
Original line number Diff line number Diff line
@@ -137,10 +137,8 @@ end2end_test acl_end2end: 
    - sleep 3

    - docker ps -a



    # Dump configuration of the routers (before any configuration)

    - containerlab exec --name acl_end2end --label clab-node-name=r1 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r2 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r3 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    # Dump configuration of the firewall (before any configuration)

    - containerlab exec --name acl_end2end --label clab-node-name=firewall --cmd "Cli --command \"enable"$'\n'$"show running-config\""



    # Configure TeraFlowSDN deployment

    # Uncomment if DEBUG log level is needed for the components
@@ -190,50 +188,6 @@ end2end_test acl_end2end: 
      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-onboarding.sh



    # Run end-to-end test: configure service TFS

    - >

      docker run -t --rm --name ${TEST_NAME} --network=host 

      --volume "$PWD/tfs_runtime_env_vars.sh:/var/teraflow/tfs_runtime_env_vars.sh"

      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-service-tfs-create.sh



    # Dump configuration of the routers (after configure TFS service)

    - containerlab exec --name acl_end2end --label clab-node-name=r1 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r2 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r3 --cmd "Cli --command \"enable"$'\n'$"show running-config\""



    # Run end-to-end test: test connectivity with ping

    - export TEST1_10=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.1.10' --format json)

    - echo $TEST1_10

    - echo $TEST1_10 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST1_1=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.1.1' --format json)

    - echo $TEST1_1

    - echo $TEST1_1 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST2_1=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.2.1' --format json)

    - echo $TEST2_1

    - echo $TEST2_1 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST2_10=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.2.10' --format json)

    - echo $TEST2_10

    - echo $TEST2_10 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST3_1=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.3.1' --format json)

    - echo $TEST3_1

    - echo $TEST3_1 | grep -E '3 packets transmitted, 0 received, 100\% packet loss'

    - export TEST3_10=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.3.10' --format json)

    - echo $TEST3_10

    - echo $TEST3_10 | grep -E '3 packets transmitted, 0 received, 100\% packet loss'



    # Run end-to-end test: deconfigure service TFS

    - >

      docker run -t --rm --name ${TEST_NAME} --network=host 

      --volume "$PWD/tfs_runtime_env_vars.sh:/var/teraflow/tfs_runtime_env_vars.sh"

      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-service-tfs-remove.sh



    # Dump configuration of the routers (after deconfigure TFS service)

    - containerlab exec --name acl_end2end --label clab-node-name=r1 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r2 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r3 --cmd "Cli --command \"enable"$'\n'$"show running-config\""



    # Run end-to-end test: configure service IETF

    - >

      docker run -t --rm --name ${TEST_NAME} --network=host
@@ -241,30 +195,22 @@ end2end_test acl_end2end: 
      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-service-ietf-create.sh



    # Dump configuration of the routers (after configure IETF service)

    - containerlab exec --name acl_end2end --label clab-node-name=r1 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r2 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r3 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    # Dump configuration of the firewall (after configure IETF service)

    - containerlab exec --name acl_end2end --label clab-node-name=firewall --cmd "Cli --command \"enable"$'\n'$"show running-config\""



    # Run end-to-end test: test connectivity with ping

    - export TEST1_10=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.1.10' --format json)

    - echo $TEST1_10

    - echo $TEST1_10 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST1_1=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.1.1' --format json)

    - echo $TEST1_1

    - echo $TEST1_1 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST2_1=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.2.1' --format json)

    - echo $TEST2_1

    - echo $TEST2_1 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST2_10=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.2.10' --format json)

    - echo $TEST2_10

    - echo $TEST2_10 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST3_1=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.3.1' --format json)

    - echo $TEST3_1

    - echo $TEST3_1 | grep -E '3 packets transmitted, 0 received, 100\% packet loss'

    - export TEST3_10=$(containerlab exec --name acl_end2end --label clab-node-name=dc1 --cmd 'ping -n -c3 172.16.3.10' --format json)

    - echo $TEST3_10

    - echo $TEST3_10 | grep -E '3 packets transmitted, 0 received, 100\% packet loss'

    - export TEST_CLIENT_FIREWALL=$(containerlab exec --name acl_end2end --label clab-node-name=client --cmd 'ping -n -c3 172.16.1.1' --format json)

    - echo $TEST_CLIENT_FIREWALL

    - echo $TEST_CLIENT_FIREWALL | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_CLIENT_DC=$(containerlab exec --name acl_end2end --label clab-node-name=client --cmd 'ping -n -c3 172.16.2.10' --format json)

    - echo $TEST_CLIENT_DC

    - echo $TEST_CLIENT_DC | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_DC_FIREWALL=$(containerlab exec --name acl_end2end --label clab-node-name=dc --cmd 'ping -n -c3 172.16.2.1' --format json)

    - echo $TEST_DC_FIREWALL

    - echo $TEST_DC_FIREWALL | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_DC_CLIENT=$(containerlab exec --name acl_end2end --label clab-node-name=dc --cmd 'ping -n -c3 172.16.1.10' --format json)

    - echo $TEST_DC_CLIENT

    - echo $TEST_DC_CLIENT | grep -E '3 packets transmitted, 3 received, 0\% packet loss'



    # Run end-to-end test: deconfigure service IETF

    - >
@@ -273,10 +219,8 @@ end2end_test acl_end2end: 
      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-service-ietf-remove.sh



    # Dump configuration of the routers (after deconfigure IETF service)

    - containerlab exec --name acl_end2end --label clab-node-name=r1 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r2 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r3 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    # Dump configuration of the firewall (after deconfigure IETF service)

    - containerlab exec --name acl_end2end --label clab-node-name=firewall --cmd "Cli --command \"enable"$'\n'$"show running-config\""



    # Run end-to-end test: cleanup scenario

    - >
@@ -286,10 +230,8 @@ end2end_test acl_end2end: 
      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-cleanup.sh



  after_script:

    # Dump configuration of the routers (on after_script)

    - containerlab exec --name acl_end2end --label clab-node-name=r1 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r2 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - containerlab exec --name acl_end2end --label clab-node-name=r3 --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    # Dump configuration of the firewall (on after_script)

    - containerlab exec --name acl_end2end --label clab-node-name=firewall --cmd "Cli --command \"enable"$'\n'$"show running-config\""



    # Dump TeraFlowSDN component logs

    - source src/tests/${TEST_NAME}/deploy_specs.sh

src/tests/acl_end2end/README.md

+19 −21
Original line number Diff line number Diff line 
# DataPlane-in-a-Box - Control an Emulated DataPlane through TeraFlowSDN

# Control an Arista Firewall through TeraFlowSDN



## Emulated DataPlane Deployment

- ContainerLab
@@ -46,22 +46,20 @@ sudo rm -rf clab-acl_end2end/ .acl_end2end.clab.yml.bak 


## Access cEOS Bash/CLI

```bash

docker exec -it clab-acl_end2end-r1 bash

docker exec -it clab-acl_end2end-r2 bash

docker exec -it clab-acl_end2end-r3 bash

docker exec -it clab-acl_end2end-r1 Cli

docker exec -it clab-acl_end2end-r2 Cli

docker exec -it clab-acl_end2end-r3 Cli

docker exec -it clab-acl_end2end-firewall bash

docker exec -it clab-acl_end2end-client bash

docker exec -it clab-acl_end2end-dc bash

docker exec -it clab-acl_end2end-firewall Cli

```



## Configure ContainerLab clients

```bash

docker exec -it clab-acl_end2end-dc1 bash

docker exec -it clab-acl_end2end-client bash

    ip address add 172.16.1.10/24 dev eth1

    ip route add 172.16.2.0/24 via 172.16.1.1

    ping 172.16.2.10



docker exec -it clab-acl_end2end-dc2 bash

docker exec -it clab-acl_end2end-dc bash

    ip address add 172.16.2.10/24 dev eth1

    ip route add 172.16.1.0/24 via 172.16.2.1

    ping 172.16.1.10
@@ -74,38 +72,38 @@ sudo bash -c "$(curl -sL https://get-gnmic.kmrd.dev)" 


## gNMI Capabilities request

```bash

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure capabilities

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure capabilities

```



## gNMI Get request

```bash

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path / > r1.json

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path /interfaces/interface > r1-ifaces.json

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path / > firewall.json

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path /interfaces/interface > firewall-ifaces.json

```



## gNMI Set request

```bash

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf set --update-path /system/config/hostname --update-value srl11

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path /system/config/hostname

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf set --update-path /system/config/hostname --update-value srl11

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path /system/config/hostname

```



## Subscribe request

```bash

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf subscribe --path /interfaces/interface[name=Management0]/state/

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf subscribe --path /interfaces/interface[name=Management0]/state/



# In another terminal, you can generate traffic opening SSH connection

ssh admin@clab-acl_end2end-r1

ssh admin@clab-acl_end2end-firewall

```



# Check configurations done:

```bash

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path '/network-instances' > r1-nis.json

gnmic --address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path '/interfaces' > r1-ifs.json

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path '/network-instances' > firewall-nis.json

gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path '/interfaces' > firewall-ifs.json

```



# Delete elements:

```bash

--address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf set --delete '/network-instances/network-instance[name=b19229e8]'

--address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf set --delete '/interfaces/interface[name=ethernet-1/1]/subinterfaces/subinterface[index=0]'

--address clab-acl_end2end-r1 --port 6030 --username admin --password admin --insecure --encoding json_ietf set --delete '/interfaces/interface[name=ethernet-1/2]/subinterfaces/subinterface[index=0]'

--address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf set --delete '/network-instances/network-instance[name=b19229e8]'

--address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf set --delete '/interfaces/interface[name=ethernet-1/1]/subinterfaces/subinterface[index=0]'

--address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf set --delete '/interfaces/interface[name=ethernet-1/2]/subinterfaces/subinterface[index=0]'

```

src/tests/acl_end2end/clab/acl_end2end.clab.yml

+6 −18
Original line number Diff line number Diff line
@@ -36,22 +36,12 @@ topology: 
      image: ghcr.io/hellt/network-multitool:latest



  nodes:

    r1:

    firewall:

      kind: arista_ceos

      mgmt-ipv4: 172.20.20.101

      startup-config: r1-startup.cfg

      startup-config: firewall-startup.cfg



    r2:

      kind: arista_ceos

      mgmt-ipv4: 172.20.20.102

      startup-config: r2-startup.cfg



    r3:

      kind: arista_ceos

      mgmt-ipv4: 172.20.20.103

      startup-config: r3-startup.cfg



    dc1:

    client:

      kind: linux

      mgmt-ipv4: 172.20.20.201

      exec:
@@ -59,7 +49,7 @@ topology: 
        - ip address add 172.16.1.10/24 dev eth1

        - ip route add 172.16.2.0/24 via 172.16.1.1



    dc2:

    dc:

      kind: linux

      mgmt-ipv4: 172.20.20.202

      exec:
@@ -68,7 +58,5 @@ topology: 
        - ip route add 172.16.1.0/24 via 172.16.2.1



  links:

    - endpoints: ["r1:eth2", "r2:eth1"]

    - endpoints: ["r2:eth3", "r3:eth2"]

    - endpoints: ["r1:eth10", "dc1:eth1"]

    - endpoints: ["r3:eth10", "dc2:eth1"]
 
    - endpoints: ["firewall:eth10", "client:eth1"]

    - endpoints: ["firewall:eth2", "dc:eth1"]

src/tests/acl_end2end/clab/r1-startup.cfg→src/tests/acl_end2end/clab/firewall-startup.cfg

+6 −2
Original line number Diff line number Diff line 
! device: r1 (cEOSLab, EOS-4.32.2F-38195967.4322F (engineering build))

! device: firewall (cEOSLab, EOS-4.32.2F-38195967.4322F (engineering build))

!

no aaa root

!
@@ -13,7 +13,7 @@ transceiver qsfp default-mode 4x10G 
!

service routing protocols model multi-agent

!

hostname r1

hostname firewall

!

spanning-tree mode mstp

!
@@ -28,8 +28,12 @@ management api netconf 
   transport ssh default

!

interface Ethernet2

   ip address 172.16.2.1/24

   no shutdown

!

interface Ethernet10

   ip address 172.16.1.1/24

   no shutdown

!

interface Management0

   ip address 172.20.20.101/24

src/tests/acl_end2end/clab/r2-startup.cfg

deleted100644 → 0
+0 −48
Original line number Diff line number Diff line 
! device: r2 (cEOSLab, EOS-4.32.2F-38195967.4322F (engineering build))

!

no aaa root

!

username admin privilege 15 role network-admin secret sha512 $6$OmfaAwJRg/r44r5U$9Fca1O1G6Bgsd4NKwSyvdRJcHHk71jHAR3apDWAgSTN/t/j1iroEhz5J36HjWjOF/jEVC/R8Wa60VmbX6.cr70

!

management api http-commands

   no shutdown

!

no service interface inactive port-id allocation disabled

!

transceiver qsfp default-mode 4x10G

!

service routing protocols model multi-agent

!

hostname r2

!

spanning-tree mode mstp

!

system l1

   unsupported speed action error

   unsupported error-correction action error

!

management api gnmi

   transport grpc default

!

management api netconf

   transport ssh default

!

interface Ethernet1

!

interface Ethernet3

!

interface Management0

   ip address 172.20.20.102/24

!

ip routing

!

ip route 0.0.0.0/0 172.20.20.1

!

router multicast

   ipv4

      software-forwarding kernel

   !

   ipv6

      software-forwarding kernel

!

end