summaryrefslogtreecommitdiff
path: root/smoketest/scripts/cli/test_policy.py
diff options
context:
space:
mode:
Diffstat (limited to 'smoketest/scripts/cli/test_policy.py')
-rwxr-xr-xsmoketest/scripts/cli/test_policy.py256
1 files changed, 136 insertions, 120 deletions
diff --git a/smoketest/scripts/cli/test_policy.py b/smoketest/scripts/cli/test_policy.py
index 8efbab7e5..242c013b8 100755
--- a/smoketest/scripts/cli/test_policy.py
+++ b/smoketest/scripts/cli/test_policy.py
@@ -14,26 +14,20 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
-import os
import unittest
-from vyos.util import cmd
+from base_vyostest_shim import VyOSUnitTestSHIM
+
from vyos.configsession import ConfigSession
from vyos.configsession import ConfigSessionError
+from vyos.util import cmd
base_path = ['policy']
-def getFRRconfig(section):
- return cmd(f'vtysh -c "show run" | sed -n "/^{section}/,/^!/p"')
-
-class TestPolicy(unittest.TestCase):
- def setUp(self):
- self.session = ConfigSession(os.getpid())
-
+class TestPolicy(VyOSUnitTestSHIM.TestCase):
def tearDown(self):
- self.session.delete(base_path)
- self.session.commit()
- del self.session
+ self.cli_delete(base_path)
+ self.cli_commit()
def test_access_list(self):
acls = {
@@ -51,7 +45,7 @@ class TestPolicy(unittest.TestCase):
},
'150' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'source' : { 'any' : '' },
'destination' : { 'host' : '2.2.2.2' },
@@ -65,32 +59,32 @@ class TestPolicy(unittest.TestCase):
},
'2000' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'destination' : { 'any' : '' },
'source' : { 'network' : '10.0.0.0', 'inverse-mask' : '0.255.255.255' },
},
- '20' : {
+ '10' : {
'action' : 'permit',
'destination' : { 'any' : '' },
'source' : { 'network' : '172.16.0.0', 'inverse-mask' : '0.15.255.255' },
},
- '30' : {
+ '15' : {
'action' : 'permit',
'destination' : { 'any' : '' },
'source' : { 'network' : '192.168.0.0', 'inverse-mask' : '0.0.255.255' },
},
- '50' : {
+ '20' : {
'action' : 'permit',
'destination' : { 'network' : '172.16.0.0', 'inverse-mask' : '0.15.255.255' },
'source' : { 'network' : '10.0.0.0', 'inverse-mask' : '0.255.255.255' },
},
- '60' : {
+ '25' : {
'action' : 'deny',
'destination' : { 'network' : '192.168.0.0', 'inverse-mask' : '0.0.255.255' },
'source' : { 'network' : '172.16.0.0', 'inverse-mask' : '0.15.255.255' },
},
- '70' : {
+ '30' : {
'action' : 'deny',
'destination' : { 'any' : '' },
'source' : { 'any' : '' },
@@ -101,29 +95,28 @@ class TestPolicy(unittest.TestCase):
for acl, acl_config in acls.items():
path = base_path + ['access-list', acl]
- self.session.set(path + ['description', f'VyOS-ACL-{acl}'])
+ self.cli_set(path + ['description', f'VyOS-ACL-{acl}'])
if 'rule' not in acl_config:
continue
for rule, rule_config in acl_config['rule'].items():
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
for direction in ['source', 'destination']:
if direction in rule_config:
if 'any' in rule_config[direction]:
- self.session.set(path + ['rule', rule, direction, 'any'])
+ self.cli_set(path + ['rule', rule, direction, 'any'])
if 'host' in rule_config[direction]:
- self.session.set(path + ['rule', rule, direction, 'host', rule_config[direction]['host']])
+ self.cli_set(path + ['rule', rule, direction, 'host', rule_config[direction]['host']])
if 'network' in rule_config[direction]:
- self.session.set(path + ['rule', rule, direction, 'network', rule_config[direction]['network']])
- self.session.set(path + ['rule', rule, direction, 'inverse-mask', rule_config[direction]['inverse-mask']])
+ self.cli_set(path + ['rule', rule, direction, 'network', rule_config[direction]['network']])
+ self.cli_set(path + ['rule', rule, direction, 'inverse-mask', rule_config[direction]['inverse-mask']])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('access-list')
+ config = self.getFRRconfig('access-list', end='')
for acl, acl_config in acls.items():
- seq = '5'
for rule, rule_config in acl_config['rule'].items():
- tmp = f'access-list {acl} seq {seq}'
+ tmp = f'access-list {acl} seq {rule}'
if rule_config['action'] == 'permit':
tmp += ' permit'
else:
@@ -137,12 +130,16 @@ class TestPolicy(unittest.TestCase):
if 'any' in rule_config[direction]:
tmp += ' any'
if 'host' in rule_config[direction]:
+ # XXX: Some weird side rule from the old vyatta days
+ # possible to clean this up after the vyos-1x migration
+ if int(acl) in range(100, 200) or int(acl) in range(2000, 2700):
+ tmp += ' host'
+
tmp += ' ' + rule_config[direction]['host']
if 'network' in rule_config[direction]:
tmp += ' ' + rule_config[direction]['network'] + ' ' + rule_config[direction]['inverse-mask']
self.assertIn(tmp, config)
- seq = int(seq) + 5
def test_access_list6(self):
acls = {
@@ -156,7 +153,7 @@ class TestPolicy(unittest.TestCase):
'action' : 'deny',
'source' : { 'network' : '2001:db8:10::/48', 'exact-match' : '' },
},
- '10' : {
+ '15' : {
'action' : 'deny',
'source' : { 'network' : '2001:db8:20::/48' },
},
@@ -180,7 +177,7 @@ class TestPolicy(unittest.TestCase):
'action' : 'deny',
'source' : { 'network' : '2001:db8:40::/64', 'exact-match' : '' },
},
- '100' : {
+ '25' : {
'action' : 'deny',
'source' : { 'any' : '' },
},
@@ -190,28 +187,27 @@ class TestPolicy(unittest.TestCase):
for acl, acl_config in acls.items():
path = base_path + ['access-list6', acl]
- self.session.set(path + ['description', f'VyOS-ACL-{acl}'])
+ self.cli_set(path + ['description', f'VyOS-ACL-{acl}'])
if 'rule' not in acl_config:
continue
for rule, rule_config in acl_config['rule'].items():
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
for direction in ['source', 'destination']:
if direction in rule_config:
if 'any' in rule_config[direction]:
- self.session.set(path + ['rule', rule, direction, 'any'])
+ self.cli_set(path + ['rule', rule, direction, 'any'])
if 'network' in rule_config[direction]:
- self.session.set(path + ['rule', rule, direction, 'network', rule_config[direction]['network']])
+ self.cli_set(path + ['rule', rule, direction, 'network', rule_config[direction]['network']])
if 'exact-match' in rule_config[direction]:
- self.session.set(path + ['rule', rule, direction, 'exact-match'])
+ self.cli_set(path + ['rule', rule, direction, 'exact-match'])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('ipv6 access-list')
+ config = self.getFRRconfig('ipv6 access-list', end='')
for acl, acl_config in acls.items():
- seq = '5'
for rule, rule_config in acl_config['rule'].items():
- tmp = f'ipv6 access-list {acl} seq {seq}'
+ tmp = f'ipv6 access-list {acl} seq {rule}'
if rule_config['action'] == 'permit':
tmp += ' permit'
else:
@@ -230,22 +226,21 @@ class TestPolicy(unittest.TestCase):
tmp += ' exact-match'
self.assertIn(tmp, config)
- seq = int(seq) + 5
def test_as_path_list(self):
test_data = {
'VyOS' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'regex' : '^44501 64502$',
},
- '20' : {
+ '10' : {
'action' : 'permit',
'regex' : '44501|44502|44503',
},
- '30' : {
+ '15' : {
'action' : 'permit',
'regex' : '^44501_([0-9]+_)+',
},
@@ -253,19 +248,19 @@ class TestPolicy(unittest.TestCase):
},
'Customers' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'regex' : '_10_',
},
- '20' : {
+ '10' : {
'action' : 'permit',
'regex' : '_20_',
},
- '30' : {
+ '15' : {
'action' : 'permit',
'regex' : '_30_',
},
- '30' : {
+ '20' : {
'action' : 'deny',
'regex' : '_40_',
},
@@ -273,19 +268,19 @@ class TestPolicy(unittest.TestCase):
},
'bogons' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'regex' : '_0_',
},
- '20' : {
+ '10' : {
'action' : 'permit',
'regex' : '_23456_',
},
- '30' : {
+ '15' : {
'action' : 'permit',
'regex' : '_6449[6-9]_|_65[0-4][0-9][0-9]_|_655[0-4][0-9]_|_6555[0-1]_',
},
- '30' : {
+ '20' : {
'action' : 'permit',
'regex' : '_6555[2-9]_|_655[6-9][0-9]_|_65[6-9][0-9][0-9]_|_6[6-9][0-9][0-9][0-]_|_[7-9][0-9][0-9][0-9][0-9]_|_1[0-2][0-9][0-9][0-9][0-9]_|_130[0-9][0-9][0-9]_|_1310[0-6][0-9]_|_13107[01]_',
},
@@ -295,19 +290,19 @@ class TestPolicy(unittest.TestCase):
for as_path, as_path_config in test_data.items():
path = base_path + ['as-path-list', as_path]
- self.session.set(path + ['description', f'VyOS-ASPATH-{as_path}'])
+ self.cli_set(path + ['description', f'VyOS-ASPATH-{as_path}'])
if 'rule' not in as_path_config:
continue
for rule, rule_config in as_path_config['rule'].items():
if 'action' in rule_config:
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
if 'regex' in rule_config:
- self.session.set(path + ['rule', rule, 'regex', rule_config['regex']])
+ self.cli_set(path + ['rule', rule, 'regex', rule_config['regex']])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('bgp as-path access-list')
+ config = self.getFRRconfig('bgp as-path access-list', end='')
for as_path, as_path_config in test_data.items():
if 'rule' not in as_path_config:
continue
@@ -327,7 +322,7 @@ class TestPolicy(unittest.TestCase):
test_data = {
'100' : {
'rule' : {
- '4' : {
+ '5' : {
'action' : 'permit',
'regex' : '.*',
},
@@ -335,15 +330,15 @@ class TestPolicy(unittest.TestCase):
},
'200' : {
'rule' : {
- '1' : {
+ '5' : {
'action' : 'deny',
'regex' : '^1:201$',
},
- '2' : {
+ '10' : {
'action' : 'deny',
'regex' : '1:101$',
},
- '3' : {
+ '15' : {
'action' : 'deny',
'regex' : '^1:100$',
},
@@ -353,26 +348,25 @@ class TestPolicy(unittest.TestCase):
for comm_list, comm_list_config in test_data.items():
path = base_path + ['community-list', comm_list]
- self.session.set(path + ['description', f'VyOS-COMM-{comm_list}'])
+ self.cli_set(path + ['description', f'VyOS-COMM-{comm_list}'])
if 'rule' not in comm_list_config:
continue
for rule, rule_config in comm_list_config['rule'].items():
if 'action' in rule_config:
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
if 'regex' in rule_config:
- self.session.set(path + ['rule', rule, 'regex', rule_config['regex']])
+ self.cli_set(path + ['rule', rule, 'regex', rule_config['regex']])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('bgp community-list')
+ config = self.getFRRconfig('bgp community-list', end='')
for comm_list, comm_list_config in test_data.items():
if 'rule' not in comm_list_config:
continue
- seq = '5'
for rule, rule_config in comm_list_config['rule'].items():
- tmp = f'bgp community-list {comm_list} seq {seq}'
+ tmp = f'bgp community-list {comm_list} seq {rule}'
if rule_config['action'] == 'permit':
tmp += ' permit'
else:
@@ -381,13 +375,12 @@ class TestPolicy(unittest.TestCase):
tmp += ' ' + rule_config['regex']
self.assertIn(tmp, config)
- seq = int(seq) + 5
def test_extended_community_list(self):
test_data = {
'foo' : {
'rule' : {
- '4' : {
+ '5' : {
'action' : 'permit',
'regex' : '.*',
},
@@ -395,15 +388,15 @@ class TestPolicy(unittest.TestCase):
},
'200' : {
'rule' : {
- '1' : {
+ '5' : {
'action' : 'deny',
'regex' : '^1:201$',
},
- '2' : {
+ '10' : {
'action' : 'deny',
'regex' : '1:101$',
},
- '3' : {
+ '15' : {
'action' : 'deny',
'regex' : '^1:100$',
},
@@ -413,31 +406,30 @@ class TestPolicy(unittest.TestCase):
for comm_list, comm_list_config in test_data.items():
path = base_path + ['extcommunity-list', comm_list]
- self.session.set(path + ['description', f'VyOS-EXTCOMM-{comm_list}'])
+ self.cli_set(path + ['description', f'VyOS-EXTCOMM-{comm_list}'])
if 'rule' not in comm_list_config:
continue
for rule, rule_config in comm_list_config['rule'].items():
if 'action' in rule_config:
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
if 'regex' in rule_config:
- self.session.set(path + ['rule', rule, 'regex', rule_config['regex']])
+ self.cli_set(path + ['rule', rule, 'regex', rule_config['regex']])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('bgp extcommunity-list')
+ config = self.getFRRconfig('bgp extcommunity-list', end='')
for comm_list, comm_list_config in test_data.items():
if 'rule' not in comm_list_config:
continue
- seq = '5'
for rule, rule_config in comm_list_config['rule'].items():
# if the community is not a number but a name, the expanded
# keyword is used
expanded = ''
if not comm_list.isnumeric():
expanded = ' expanded'
- tmp = f'bgp extcommunity-list{expanded} {comm_list} seq {seq}'
+ tmp = f'bgp extcommunity-list{expanded} {comm_list} seq {rule}'
if rule_config['action'] == 'permit':
tmp += ' permit'
@@ -447,14 +439,13 @@ class TestPolicy(unittest.TestCase):
tmp += ' ' + rule_config['regex']
self.assertIn(tmp, config)
- seq = int(seq) + 5
def test_large_community_list(self):
test_data = {
'foo' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'regex' : '667:123:100',
},
@@ -462,15 +453,15 @@ class TestPolicy(unittest.TestCase):
},
'bar' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'regex' : '65000:120:10',
},
- '20' : {
+ '10' : {
'action' : 'permit',
'regex' : '65000:120:20',
},
- '30' : {
+ '15' : {
'action' : 'permit',
'regex' : '65000:120:30',
},
@@ -480,26 +471,25 @@ class TestPolicy(unittest.TestCase):
for comm_list, comm_list_config in test_data.items():
path = base_path + ['large-community-list', comm_list]
- self.session.set(path + ['description', f'VyOS-LARGECOMM-{comm_list}'])
+ self.cli_set(path + ['description', f'VyOS-LARGECOMM-{comm_list}'])
if 'rule' not in comm_list_config:
continue
for rule, rule_config in comm_list_config['rule'].items():
if 'action' in rule_config:
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
if 'regex' in rule_config:
- self.session.set(path + ['rule', rule, 'regex', rule_config['regex']])
+ self.cli_set(path + ['rule', rule, 'regex', rule_config['regex']])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('bgp large-community-list')
+ config = self.getFRRconfig('bgp large-community-list', end='')
for comm_list, comm_list_config in test_data.items():
if 'rule' not in comm_list_config:
continue
- seq = '5'
for rule, rule_config in comm_list_config['rule'].items():
- tmp = f'bgp large-community-list expanded {comm_list} seq {seq}'
+ tmp = f'bgp large-community-list expanded {comm_list} seq {rule}'
if rule_config['action'] == 'permit':
tmp += ' permit'
@@ -509,25 +499,24 @@ class TestPolicy(unittest.TestCase):
tmp += ' ' + rule_config['regex']
self.assertIn(tmp, config)
- seq = int(seq) + 5
def test_prefix_list(self):
test_data = {
'foo' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'prefix' : '10.0.0.0/8',
'ge' : '16',
'le' : '24',
},
- '20' : {
+ '10' : {
'action' : 'deny',
'prefix' : '172.16.0.0/12',
'ge' : '16',
},
- '30' : {
+ '15' : {
'action' : 'permit',
'prefix' : '192.168.0.0/16',
},
@@ -535,18 +524,18 @@ class TestPolicy(unittest.TestCase):
},
'bar' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'prefix' : '10.0.10.0/24',
'ge' : '25',
'le' : '26',
},
- '20' : {
+ '10' : {
'action' : 'deny',
'prefix' : '10.0.20.0/24',
'le' : '25',
},
- '25' : {
+ '15' : {
'action' : 'permit',
'prefix' : '10.0.25.0/24',
},
@@ -556,23 +545,23 @@ class TestPolicy(unittest.TestCase):
for prefix_list, prefix_list_config in test_data.items():
path = base_path + ['prefix-list', prefix_list]
- self.session.set(path + ['description', f'VyOS-PFX-LIST-{prefix_list}'])
+ self.cli_set(path + ['description', f'VyOS-PFX-LIST-{prefix_list}'])
if 'rule' not in prefix_list_config:
continue
for rule, rule_config in prefix_list_config['rule'].items():
if 'action' in rule_config:
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
if 'prefix' in rule_config:
- self.session.set(path + ['rule', rule, 'prefix', rule_config['prefix']])
+ self.cli_set(path + ['rule', rule, 'prefix', rule_config['prefix']])
if 'ge' in rule_config:
- self.session.set(path + ['rule', rule, 'ge', rule_config['ge']])
+ self.cli_set(path + ['rule', rule, 'ge', rule_config['ge']])
if 'le' in rule_config:
- self.session.set(path + ['rule', rule, 'le', rule_config['le']])
+ self.cli_set(path + ['rule', rule, 'le', rule_config['le']])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('ip prefix-list')
+ config = self.getFRRconfig('ip prefix-list', end='')
for prefix_list, prefix_list_config in test_data.items():
if 'rule' not in prefix_list_config:
continue
@@ -599,18 +588,18 @@ class TestPolicy(unittest.TestCase):
test_data = {
'foo' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'prefix' : '2001:db8::/32',
'ge' : '40',
'le' : '48',
},
- '20' : {
+ '10' : {
'action' : 'deny',
'prefix' : '2001:db8::/32',
'ge' : '48',
},
- '30' : {
+ '15' : {
'action' : 'permit',
'prefix' : '2001:db8:1000::/64',
},
@@ -618,17 +607,17 @@ class TestPolicy(unittest.TestCase):
},
'bar' : {
'rule' : {
- '10' : {
+ '5' : {
'action' : 'permit',
'prefix' : '2001:db8:100::/40',
'ge' : '48',
},
- '20' : {
+ '10' : {
'action' : 'permit',
'prefix' : '2001:db8:200::/40',
'ge' : '48',
},
- '25' : {
+ '15' : {
'action' : 'deny',
'prefix' : '2001:db8:300::/40',
'le' : '64',
@@ -639,23 +628,23 @@ class TestPolicy(unittest.TestCase):
for prefix_list, prefix_list_config in test_data.items():
path = base_path + ['prefix-list6', prefix_list]
- self.session.set(path + ['description', f'VyOS-PFX-LIST-{prefix_list}'])
+ self.cli_set(path + ['description', f'VyOS-PFX-LIST-{prefix_list}'])
if 'rule' not in prefix_list_config:
continue
for rule, rule_config in prefix_list_config['rule'].items():
if 'action' in rule_config:
- self.session.set(path + ['rule', rule, 'action', rule_config['action']])
+ self.cli_set(path + ['rule', rule, 'action', rule_config['action']])
if 'prefix' in rule_config:
- self.session.set(path + ['rule', rule, 'prefix', rule_config['prefix']])
+ self.cli_set(path + ['rule', rule, 'prefix', rule_config['prefix']])
if 'ge' in rule_config:
- self.session.set(path + ['rule', rule, 'ge', rule_config['ge']])
+ self.cli_set(path + ['rule', rule, 'ge', rule_config['ge']])
if 'le' in rule_config:
- self.session.set(path + ['rule', rule, 'le', rule_config['le']])
+ self.cli_set(path + ['rule', rule, 'le', rule_config['le']])
- self.session.commit()
+ self.cli_commit()
- config = getFRRconfig('ipv6 prefix-list')
+ config = self.getFRRconfig('ipv6 prefix-list', end='')
for prefix_list, prefix_list_config in test_data.items():
if 'rule' not in prefix_list_config:
continue
@@ -677,5 +666,32 @@ class TestPolicy(unittest.TestCase):
self.assertIn(tmp, config)
+
+ # Test set table for some sources
+ def test_table_id(self):
+ path = base_path + ['local-route']
+
+ sources = ['203.0.113.1', '203.0.113.2']
+ rule = '50'
+ table = '23'
+ for src in sources:
+ self.cli_set(path + ['rule', rule, 'set', 'table', table])
+ self.cli_set(path + ['rule', rule, 'source', src])
+
+ self.cli_commit()
+
+ # Check generated configuration
+
+ # Expected values
+ original = """
+ 50: from 203.0.113.1 lookup 23
+ 50: from 203.0.113.2 lookup 23
+ """
+ tmp = cmd('ip rule show prio 50')
+ original = original.split()
+ tmp = tmp.split()
+
+ self.assertEqual(tmp, original)
+
if __name__ == '__main__':
unittest.main(verbosity=2)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-11 18:28:56 +0000