Commit 8ab42c8e authored by Lluis Gifre Renom's avatar Lluis Gifre Renom
Browse files

Tests - ACL End-to-end integration test: 

- Updated ContainerLab scenario
- Removed unneeded IETF service files
- Added IETF ACL data file
- Updated topology file
- Updated run ACL script
- Updated CI/CD pipeline descriptor
parent d393cba5

src/tests/acl_end2end/.gitlab-ci.yml

+13 −20
Original line number Diff line number Diff line
@@ -188,39 +188,32 @@ end2end_test acl_end2end: 
      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-onboarding.sh



    # Run end-to-end test: configure service IETF

    # Run end-to-end test: configure ACLs

    - >

      docker run -t --rm --name ${TEST_NAME} --network=host

      --volume "$PWD/tfs_runtime_env_vars.sh:/var/teraflow/tfs_runtime_env_vars.sh"

      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-service-ietf-create.sh



    # Dump configuration of the firewall (after configure IETF service)

    - containerlab exec --name acl_end2end --label clab-node-name=firewall --cmd "Cli --command \"enable"$'\n'$"show running-config\""

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-acl-tests.sh



    # Run end-to-end test: test connectivity with ping

    - export TEST_CLIENT_FIREWALL=$(containerlab exec --name acl_end2end --label clab-node-name=client --cmd 'ping -n -c3 172.16.1.1' --format json)

    - export TEST_CLIENT_FIREWALL=$(containerlab exec --name acl_end2end --label clab-node-name=client1 --cmd 'ping -n -c3 172.16.1.1' --format json)

    - echo $TEST_CLIENT_FIREWALL

    - echo $TEST_CLIENT_FIREWALL | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_CLIENT_DC=$(containerlab exec --name acl_end2end --label clab-node-name=client --cmd 'ping -n -c3 172.16.2.10' --format json)

    - export TEST_CLIENT_DC=$(containerlab exec --name acl_end2end --label clab-node-name=client1 --cmd 'ping -n -c3 172.16.0.10' --format json)

    - echo $TEST_CLIENT_DC

    - echo $TEST_CLIENT_DC | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_DC_FIREWALL=$(containerlab exec --name acl_end2end --label clab-node-name=dc --cmd 'ping -n -c3 172.16.2.1' --format json)

    - echo $TEST_DC_FIREWALL

    - echo $TEST_DC_FIREWALL | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_CLIENT2_FIREWALL=$(containerlab exec --name acl_end2end --label clab-node-name=client2 --cmd 'ping -n -c3 172.16.2.1' --format json)

    - echo $TEST_CLIENT2_FIREWALL

    - echo $TEST_CLIENT2_FIREWALL | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_CLIENT2_DC=$(containerlab exec --name acl_end2end --label clab-node-name=client2 --cmd 'ping -n -c3 172.16.0.10' --format json)

    - echo $TEST_CLIENT2_DC

    - echo $TEST_CLIENT2_DC | grep -E '3 packets transmitted, 3 received, 0\% packet loss'

    - export TEST_DC_CLIENT=$(containerlab exec --name acl_end2end --label clab-node-name=dc --cmd 'ping -n -c3 172.16.1.10' --format json)

    - echo $TEST_DC_CLIENT

    - echo $TEST_DC_CLIENT | grep -E '3 packets transmitted, 3 received, 0\% packet loss'



    # Run end-to-end test: deconfigure service IETF

    - >

      docker run -t --rm --name ${TEST_NAME} --network=host 

      --volume "$PWD/tfs_runtime_env_vars.sh:/var/teraflow/tfs_runtime_env_vars.sh"

      --volume "$PWD/src/tests/${TEST_NAME}:/opt/results"

      $CI_REGISTRY_IMAGE/${TEST_NAME}:latest /var/teraflow/run-service-ietf-remove.sh



    # Dump configuration of the firewall (after deconfigure IETF service)

    - containerlab exec --name acl_end2end --label clab-node-name=firewall --cmd "Cli --command \"enable"$'\n'$"show running-config\""

    - export TEST_DC_CLIENT2=$(containerlab exec --name acl_end2end --label clab-node-name=dc --cmd 'ping -n -c3 172.16.2.10' --format json)

    - echo $TEST_DC_CLIENT2

    - echo $TEST_DC_CLIENT2 | grep -E '3 packets transmitted, 3 received, 0\% packet loss'



    # Run end-to-end test: cleanup scenario

    - >

src/tests/acl_end2end/README.md

+16 −4
Original line number Diff line number Diff line
@@ -47,22 +47,31 @@ sudo rm -rf clab-acl_end2end/ .acl_end2end.clab.yml.bak 
## Access cEOS Bash/CLI

```bash

docker exec -it clab-acl_end2end-firewall bash

docker exec -it clab-acl_end2end-client bash

docker exec -it clab-acl_end2end-client1 bash

docker exec -it clab-acl_end2end-dc bash

docker exec -it clab-acl_end2end-client2 bash

docker exec -it clab-acl_end2end-firewall Cli

```



## Configure ContainerLab clients

```bash

docker exec -it clab-acl_end2end-client bash

docker exec -it clab-acl_end2end-client1 bash

    ip address add 172.16.1.10/24 dev eth1

    ip route add 172.16.0.0/24 via 172.16.1.1

    ip route add 172.16.2.0/24 via 172.16.1.1

    ping 172.16.2.10

    ping 172.16.0.10



docker exec -it clab-acl_end2end-dc bash

    ip address add 172.16.0.10/24 dev eth1

    ip route add 172.16.1.0/24 via 172.16.0.1

    ip route add 172.16.2.0/24 via 172.16.0.1

    ping 172.16.1.10



docker exec -it clab-acl_end2end-client2 bash

    ip address add 172.16.2.10/24 dev eth1

    ip route add 172.16.0.0/24 via 172.16.2.1

    ip route add 172.16.1.0/24 via 172.16.2.1

    ping 172.16.1.10

    ping 172.16.0.10

```



## Install gNMIc
@@ -101,6 +110,9 @@ gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --passwor 
gnmic --address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf get --path '/interfaces' > firewall-ifs.json

```



# ACL payload

`data/ietf-acl.json` contains an example ACL that blocks ICMP from client1 (172.16.1.10) to the DC (172.16.0.10) on the firewall ingress interface Ethernet10 while permitting other traffic. Post it to `/restconf/data/device=firewall/ietf-access-control-list:acls`.



# Delete elements:

```bash

--address clab-acl_end2end-firewall --port 6030 --username admin --password admin --insecure --encoding json_ietf set --delete '/network-instances/network-instance[name=b19229e8]'

src/tests/acl_end2end/clab/acl_end2end.clab.yml

+22 −10
Original line number Diff line number Diff line
@@ -41,22 +41,34 @@ topology: 
      mgmt-ipv4: 172.20.20.101

      startup-config: firewall-startup.cfg



    client:

    dc:

      kind: linux

      mgmt-ipv4: 172.20.20.201

      mgmt-ipv4: 172.20.20.200

      exec:

        - ip link set address 00:c1:ab:00:01:01 dev eth1

        - ip link set address 00:c1:ab:00:01:0a dev eth1

        - ip address add 172.16.1.10/24 dev eth1

        - ip route add 172.16.2.0/24 via 172.16.1.1

        - ip route add 172.16.11.0/24 via 172.16.1.1

        - ip route add 172.16.12.0/24 via 172.16.1.1



    dc:

    client1:

      kind: linux

      mgmt-ipv4: 172.20.20.201

      exec:

        - ip link set address 00:c1:ab:00:0b:0a dev eth1

        - ip address add 172.16.11.10/24 dev eth1

        - ip route add 172.16.1.0/24 via 172.16.11.1

        - ip route add 172.16.12.0/24 via 172.16.11.1



    client2:

      kind: linux

      mgmt-ipv4: 172.20.20.202

      exec:

        - ip link set address 00:c1:ab:00:02:01 dev eth1

        - ip address add 172.16.2.10/24 dev eth1

        - ip route add 172.16.1.0/24 via 172.16.2.1

        - ip link set address 00:c1:ab:00:0c:0a dev eth1

        - ip address add 172.16.12.10/24 dev eth1

        - ip route add 172.16.1.0/24 via 172.16.12.1

        - ip route add 172.16.11.0/24 via 172.16.12.1



  links:

    - endpoints: ["firewall:eth10", "client:eth1"]

    - endpoints: ["firewall:eth2", "dc:eth1"]
 
    - endpoints: ["firewall:eth1",  "dc:eth1"     ]

    - endpoints: ["firewall:eth11", "client1:eth1"]

    - endpoints: ["firewall:eth12", "client2:eth1"]

src/tests/acl_end2end/clab/firewall-startup.cfg

+8 −4
Original line number Diff line number Diff line
@@ -27,12 +27,16 @@ management api gnmi 
management api netconf

   transport ssh default

!

interface Ethernet2

   ip address 172.16.2.1/24

interface Ethernet1

   ip address 172.16.1.1/24

   no shutdown

!

interface Ethernet10

   ip address 172.16.1.1/24

interface Ethernet11

   ip address 172.16.11.1/24

   no shutdown

!

interface Ethernet12

   ip address 172.16.12.1/24

   no shutdown

!

interface Management0

src/tests/acl_end2end/data/ietf-acl.json

0 → 100644
+40 −0
Original line number Diff line number Diff line 
{

  "ietf-access-control-list:acls": {

    "acl": [{

      "name": "block-client1-ping-permit-other",

      "type": "ipv4-acl-type",

      "aces": {

        "ace": [{

          "name": "block-client1-ping",

          "matches": {

            "ingress-interface": "Ethernet10",

            "ipv4": {

              "protocol": 1,

              "source-ipv4-network": "172.16.1.10/32",

              "destination-ipv4-network": "172.16.0.10/32"

            },

            "icmp": {}

          },

          "actions": {"forwarding": "reject"}

        },

        {

          "name": "permit-other",

          "matches": {

            "ingress-interface": "Ethernet10"

          },

          "actions": {"forwarding": "accept"}

        }]

      }

    }],

    "attachment-points": {

      "interface": [{

        "interface-id": "Ethernet10",

        "ingress": {

          "acl-sets": {

            "acl-set": [{"name": "block-client1-ping-permit-other"}]

          }

        }

      }]

    }

  }

}