Few coments from flake8:

'lnst.RecipeCommon.ModuleWrap.ping' imported but unused
'lnst.RecipeCommon.ModuleWrap.ping6' imported but unused
're' imported but unused

2017-11-30 10:52 GMT+01:00 Kamil Jerabek <kjerabek@redhat.com>:
This patch adds new ipsec_esp_aead test to our phase3 regression_tests. It is
similar to ipsec_esp_ah_comp test. There is difference in configuration.
In the test is configured only esp aead with algorithm rfc4106(gcm(aes)),
key length 160bit and IV length 96bit.

Signed-off-by: Kamil Jerabek <kjerabek@redhat.com>

---
changes in:
*v2:
  * add official_result handling for PerfRepo
*v3:
  * add accidentally removed result parameters
  * remove comment about compression check
---
 .../regression_tests/phase3/ipsec_esp_aead.README  |  90 +++++
 recipes/regression_tests/phase3/ipsec_esp_aead.py  | 434 +++++++++++++++++++++
 recipes/regression_tests/phase3/ipsec_esp_aead.xml |  51 +++
 3 files changed, 575 insertions(+)
 create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.README
 create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.py
 create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.xml

diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.README b/recipes/regression_tests/phase3/ipsec_esp_aead.README
new file mode 100644
index 0000000..8738da6
--- /dev/null
+++ b/recipes/regression_tests/phase3/ipsec_esp_aead.README
@@ -0,0 +1,90 @@
+Topology:
+
+                         switch
+                        +------+
+                        |      |
+                        |      |
+          +-------------+      +-------------+
+          |             |      |             |
+          |             |      |             |
+          |             +------+             |
+          |                                  |
+          |                                  |
+        +-+--+                             +-+--+
++-------|eth1|------+              +-------|eth1|------+
+|       +-+--+      |              |       +-+--+      |
+|                   |              |                   |
+|                   |              |                   |
+|                   |              |                   |
+|                   |              |                   |
+|                   |              |                   |
+|       host1       |              |       host2       |
+|                   |              |                   |
+|                   |              |                   |
+|                   |              |                   |
++-------------------+              +-------------------+
+
+Number of hosts: 2
+Host #1 description:
+  One ethernet device configured with ip addresses:
+    192.168.99.1/24
+    fc00:1::1/64
+
+Host #2 description:
+  One ethernet device configured with ip addresses:
+    192.168.100.1/24
+    fc00:2::1/64
+
+Test name:
+  ipsec_esp_aead.py
+Test description:
+  Ping:
+    + count: 10
+    + interval: 0.1s
+    + between ipsec encrypted ethernet interfaces headers check expecting PASS
+    + between ipsec encrypted ethernet interfaces compression check expecting PASS
+  Ping6:
+    + count: 10
+    + interval: 0.1s
+    + between ipsec encrypted ethernet interfaces headers check expecting PASS
+    + between ipsec encrypted ethernet interfaces compression check expecting PASS
+  Netperf:
+    + duration: 60s
+    + TCP_STREAM and UDP_STREAM
+    + ipv4 and ipv6
+    + between ipsec encrypted ethernet interfaces
+  IPsec
+    + tested with esp AEAD
+    + tested with algorithm rfc4106(gcm(aes))
+    + key length - 160bit
+    + IV length - 96bit
+
+PerfRepo integration:
+    First, preparation in PerfRepo is required - you need to create Test objects
+    through the web interface that properly describe the individual Netperf
+    tests that this recipe runs. Don't forget to also add appropriate metrics.
+    For these Netperf tests it's always:
+    * throughput
+    * throughput_min
+    * throughput_max
+    * throughput_deviation
+
+    After that, to enable support for PerfRepo you need to create the file
+    vxlan_remote.mapping and define the following id mappings:
+    tcp_ipv4_id -> to store ipv4 TCP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object
+    tcp_ipv6_id -> to store ipv6 TCP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object
+    udp_ipv4_id -> to store ipv4 UDP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object
+    udp_ipv6_id -> to store ipv4 UDP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object
+
+    To enable result comparison agains baselines you need to create a Report in
+    PerfRepo that will store the baseline. Set up the Report to only contain results
+    with the same hash tag and then add a new mapping to the mapping file, with
+    this format:
+    <some_hash> = <report_id>
+
+    The hash value is automatically generated during test execution and added
+    to each result stored in PerfRepo. To get the Report id you need to open
+    that report in our browser and find if in the URL.
+
+    When running this recipe you should also define the 'product_name' alias
+    (e.g. RHEL7) in order to tag the result object in PerfRepo.
diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.py b/recipes/regression_tests/phase3/ipsec_esp_aead.py
new file mode 100644
index 0000000..5094a09
--- /dev/null
+++ b/recipes/regression_tests/phase3/ipsec_esp_aead.py
@@ -0,0 +1,434 @@
+from lnst.Common.Utils import bool_it
+from lnst.Controller.Task import ctl
+from lnst.Controller.PerfRepoUtils import perfrepo_baseline_to_dict
+from lnst.Controller.PerfRepoUtils import netperf_result_template
+
+from lnst.RecipeCommon.ModuleWrap import ping, ping6, netperf
+from lnst.RecipeCommon.IRQ import pin_dev_irqs
+from lnst.RecipeCommon.PerfRepo import generate_perfrepo_comment
+import re
+
+# ---------------------------
+# ALGORITHM AND CIPHER CONFIG
+# ---------------------------
+
+#lenth param is in bits
+def generate_key(length):
+    key = "0x"
+    key = key + (length/8) * "0b"
+    return key
+
+algorithm = []
+
+algorithm.append(('rfc4106(gcm(aes))', 160, 96))
+
+# ------
+# SETUP
+# ------
+
+mapping_file = ctl.get_alias("mapping_file")
+perf_api = ctl.connect_PerfRepo(mapping_file)
+
+product_name = ctl.get_alias("product_name")
+
+m1 = ctl.get_host("machine1")
+m2 = ctl.get_host("machine2")
+
+m1.sync_resources(modules=["IcmpPing", "Icmp6Ping", "Netperf", "Custom"])
+m2.sync_resources(modules=["PacketAssert", "IcmpPing", "Icmp6Ping", "Netperf"])
+
+# ------
+# TESTS
+# ------
+
+ipv = ctl.get_alias("ipv")
+mtu = ctl.get_alias("mtu")
+netperf_duration = int(ctl.get_alias("netperf_duration"))
+nperf_reserve = int(ctl.get_alias("nperf_reserve"))
+nperf_confidence = ctl.get_alias("nperf_confidence")
+nperf_max_runs = int(ctl.get_alias("nperf_max_runs"))
+nperf_cpupin = ctl.get_alias("nperf_cpupin")
+nperf_cpu_util = ctl.get_alias("nperf_cpu_util")
+nperf_num_parallel = int(ctl.get_alias("nperf_num_parallel"))
+nperf_debug = ctl.get_alias("nperf_debug")
+nperf_max_dev = ctl.get_alias("nperf_max_dev")
+nperf_msg_size = ctl.get_alias("nperf_msg_size")
+pr_user_comment = ctl.get_alias("perfrepo_comment")
+ipsec_mode = ctl.get_alias("ipsec_mode")
+official_result = bool_it(ctl.get_alias("official_result"))
+
+pr_comment = generate_perfrepo_comment([m1, m2], pr_user_comment)
+
+m1_if = m1.get_interface("eth")
+m2_if = m2.get_interface("eth")
+
+m1_if.set_mtu(mtu)
+m2_if.set_mtu(mtu)
+
+m1_if_name = m1_if.get_devname()
+m2_if_name = m2_if.get_devname()
+
+m1_if_addr = m1_if.get_ip()
+m2_if_addr = m2_if.get_ip()
+
+m1_if_addr6 = m1_if.get_ip(1)
+m2_if_addr6 = m2_if.get_ip(1)
+
+
+# add routing rulez ipv4
+# so the host knows where to send traffic destined to remote site
+m1.run("ip route add %s dev %s" % (m2_if_addr, m1_if_name))
+
+# so the host knows where to send traffic destined to remote site
+m2.run("ip route add %s dev %s" % (m1_if_addr, m2_if_name))
+
+# add routing rulez ipv6
+# so the host knows where to send traffic destined to remote site
+m1.run("ip route add %s dev %s" % (m2_if_addr6, m1_if_name))
+
+# so the host knows where to send traffic destined to remote site
+m2.run("ip route add %s dev %s" % (m1_if_addr6, m2_if_name))
+
+if nperf_msg_size is None:
+    nperf_msg_size = 16000
+
+if ipsec_mode is None:
+    ipsec_mode = "transport"
+
+res = m1.run("rpm -qa iproute", save_output=True)
+if (res.get_result()["res_data"]["stdout"].find("iproute-2") != -1):
+    m1_key="0x"
+else:
+    m1_key=""
+
+res = m2.run("rpm -qa iproute", save_output=True)
+if (res.get_result()["res_data"]["stdout"].find("iproute-2") != -1):
+    m2_key="0x"
+else:
+    m2_key=""
+
+if nperf_cpupin:
+    m1.run("service irqbalance stop")
+    m2.run("service irqbalance stop")
+
+    dev_list = [(m1, m1_if), (m2, m2_if)]
+
+    # this will pin devices irqs to cpu #0
+    for m, d in dev_list:
+        pin_dev_irqs(m, d, 0)
+
+nperf_opts = ""
+if nperf_cpupin and nperf_num_parallel == 1:
+    nperf_opts = " -T%s,%s" % (nperf_cpupin, nperf_cpupin)
+
+ctl.wait(15)
+
+def configure_ipsec(algo, algo_key, icv_len, ip_version):
+    if ip_version == "ipv4":
+        m1_addr = m1_if_addr
+        m2_addr = m2_if_addr
+    else:
+        m1_addr = m1_if_addr6
+        m2_addr = m2_if_addr6
+
+    # configure policy and state
+    m1.run("ip xfrm policy flush")
+    m1.run("ip xfrm state flush")
+    m2.run("ip xfrm policy flush")
+    m2.run("ip xfrm state flush")
+
+    m1.run("ip xfrm state add src %s dst %s proto esp spi 0x1001 "\
+           "aead '%s' %s %s mode %s "\
+           "sel src %s dst %s"\
+           % (m2_addr, m1_addr,
+              algo, algo_key, icv_len, ipsec_mode,
+              m2_addr, m1_addr))
+
+    m1.run("ip xfrm policy add src %s dst %s dir in tmpl "\
+           "src %s dst %s proto esp mode %s action allow"\
+           % (m2_addr, m1_addr,
+              m2_addr, m1_addr, ipsec_mode))
+
+    m1.run("ip xfrm state add src %s dst %s proto esp spi 0x1000 "\
+           "aead '%s' %s %s mode %s "\
+           "sel src %s dst %s"\
+           % (m1_addr, m2_addr,
+              algo, algo_key, icv_len, ipsec_mode,
+              m1_addr, m2_addr))
+
+    m1.run("ip xfrm policy add src %s dst %s dir out tmpl "\
+           "src %s dst %s proto esp mode %s action allow"\
+           % (m1_addr, m2_addr,
+              m1_addr, m2_addr, ipsec_mode))
+
+
+
+
+    m2.run("ip xfrm state add src %s dst %s proto esp spi 0x1000 "\
+           "aead '%s' %s %s mode %s "\
+           "sel src %s dst %s"\
+           % (m1_addr, m2_addr,
+              algo, algo_key, icv_len, ipsec_mode,
+              m1_addr, m2_addr))
+
+    m2.run("ip xfrm policy add src %s dst %s dir in tmpl "\
+           "src %s dst %s proto esp mode %s action allow"\
+           % (m1_addr, m2_addr,
+              m1_addr, m2_addr, ipsec_mode))
+
+    m2.run("ip xfrm state add src %s dst %s proto esp spi 0x1001 "\
+           "aead '%s' %s %s mode %s sel "\
+           "src %s dst %s"\
+           % (m2_addr, m1_addr,
+              algo, algo_key, icv_len, ipsec_mode,
+              m2_addr, m1_addr))
+
+    m2.run("ip xfrm policy add src %s dst %s dir out tmpl "\
+           "src %s dst %s proto esp mode %s action allow"\
+           % (m2_addr, m1_addr,
+              m2_addr, m1_addr, ipsec_mode))
+
+
+
+for algo, key_len, icv_len in algorithm:
+    # test: TCP netperf, UDP netperf
+    if ipv in [ 'ipv4', 'both']:
+        configure_ipsec(algo,
+                        generate_key(key_len),
+                        icv_len,
+                        "ipv4")
+
+        dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True)
+
+        # ping + PacketAssert
+        assert_mod = ctl.get_module("PacketAssert",
+                                 options={
+                                     "interface": m2_if_name,
+                                     "filter": "esp",
+                                     "grep_for": [ "ESP\(spi=0x00001001" ],
+                                     "min": 10
+                                 })
+
+        assert_proc = m2.run(assert_mod, bg=True)
+
+        ping_mod = ctl.get_module("IcmpPing",
+                                options={
+                                    "addr": m2_if_addr,
+                                    "count": 10,
+                                    "interval": 0.1})
+
+        ctl.wait(2)
+
+        m1.run(ping_mod)
+
+        ctl.wait(2)
+
+        assert_proc.intr()
+
+        dump.intr()
+
+        # prepare PerfRepo result for tcp
+        result_tcp = perf_api.new_result("tcp_ipv4_id",
+                                         "tcp_ipv4_result",
+                                         hash_ignore=[
+                                             r'kernel_release',
+                                             r'redhat_release'])
+        result_tcp.add_tag(product_name)
+
+        if nperf_num_parallel > 1:
+            result_tcp.add_tag("multithreaded")
+            result_tcp.set_parameter('num_parallel', nperf_num_parallel)
+
+        result_tcp.set_parameter('ipsec_algorithm', algo)
+        result_tcp.set_parameter('key_length', key_len)
+        result_tcp.set_parameter('iv_length', icv_len)
+        result_tcp.set_parameter('msg_size', nperf_msg_size)
+        result_tcp.set_parameter('ipsec_mode', ipsec_mode)
+
+        baseline = perf_api.get_baseline_of_result(result_tcp)
+        baseline = perfrepo_baseline_to_dict(baseline)
+
+
+        tcp_res_data = netperf((m1, m1_if, 0, {"scope": 0}),
+                               (m2, m2_if, 0, {"scope": 0}),
+                               client_opts={"duration" : netperf_duration,
+                                           "testname" : "TCP_STREAM",
+                                           "confidence" : nperf_confidence,
+                                           "num_parallel" : nperf_num_parallel,
+                                           "cpu_util" : nperf_cpu_util,
+                                           "runs": nperf_max_runs,
+                                           "debug": nperf_debug,
+                                           "max_deviation": nperf_max_dev,
+                                           "msg_size" : nperf_msg_size,
+                                           "netperf_opts": nperf_opts},
+                              baseline = baseline,
+                              timeout = (netperf_duration + nperf_reserve)*nperf_max_runs)
+
+        netperf_result_template(result_tcp, tcp_res_data)
+        result_tcp.set_comment(pr_comment)
+        perf_api.save_result(result_tcp, official_result)
+
+        # prepare PerfRepo result for udp
+        result_udp = perf_api.new_result("udp_ipv4_id",
+                                         "udp_ipv4_result",
+                                         hash_ignore=[
+                                             r'kernel_release',
+                                             r'redhat_release'])
+        result_udp.add_tag(product_name)
+
+        if nperf_num_parallel > 1:
+            result_udp.add_tag("multithreaded")
+            result_udp.set_parameter('num_parallel', nperf_num_parallel)
+
+        result_udp.set_parameter('ipsec_algorithm', algo)
+        result_udp.set_parameter('key_length', key_len)
+        result_udp.set_parameter('iv_length', icv_len)
+        result_udp.set_parameter('msg_size', nperf_msg_size)
+        result_udp.set_parameter('ipsec_mode', ipsec_mode)
+
+        baseline = perf_api.get_baseline_of_result(result_udp)
+        baseline = perfrepo_baseline_to_dict(baseline)
+
+        udp_res_data = netperf((m1, m1_if, 0, {"scope": 0}),
+                               (m2, m2_if, 0, {"scope": 0}),
+                               client_opts={"duration" : netperf_duration,
+                                            "testname" : "UDP_STREAM",
+                                            "confidence" : nperf_confidence,
+                                            "num_parallel" : nperf_num_parallel,
+                                            "cpu_util" : nperf_cpu_util,
+                                            "runs": nperf_max_runs,
+                                            "debug": nperf_debug,
+                                            "max_deviation": nperf_max_dev,
+                                            "msg_size" : nperf_msg_size,
+                                            "netperf_opts": nperf_opts},
+                               baseline = baseline,
+                               timeout = (netperf_duration + nperf_reserve)*nperf_max_runs)
+
+        netperf_result_template(result_udp, udp_res_data)
+        result_udp.set_comment(pr_comment)
+        perf_api.save_result(result_udp, official_result)
+
+    if ipv in [ 'ipv6', 'both']:
+        configure_ipsec(algo,
+                        generate_key(key_len),
+                        icv_len,
+                        "ipv6")
+
+        dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True)
+
+        # ping + PacketAssert
+        assert_mod = ctl.get_module("PacketAssert",
+                                 options={
+                                     "interface": m2_if_name,
+                                     "filter": "esp",
+                                     "grep_for": [ "ESP\(spi=0x00001001" ],
+                                     "min": 10
+                                 })
+
+        assert_proc = m2.run(assert_mod, bg=True)
+
+        ping_mod = ctl.get_module("Icmp6Ping",
+                                options={
+                                    "addr": m2_if_addr6,
+                                    "count": 10,
+                                    "interval": 0.1})
+
+        ctl.wait(2)
+
+        m1.run(ping_mod)
+
+        ctl.wait(2)
+
+        assert_proc.intr()
+
+        dump.intr()
+
+        # prepare PerfRepo result for tcp
+        result_tcp = perf_api.new_result("tcp_ipv6_id",
+                                         "tcp_ipv6_result",
+                                         hash_ignore=[
+                                             r'kernel_release',
+                                             r'redhat_release'])
+        result_tcp.add_tag(product_name)
+
+        if nperf_num_parallel > 1:
+            result_tcp.add_tag("multithreaded")
+            result_tcp.set_parameter('num_parallel', nperf_num_parallel)
+
+        result_tcp.set_parameter('ipsec_algorithm', algo)
+        result_tcp.set_parameter('key_length', key_len)
+        result_tcp.set_parameter('iv_length', icv_len)
+        result_tcp.set_parameter('msg_size', nperf_msg_size)
+        result_tcp.set_parameter('ipsec_mode', ipsec_mode)
+
+        baseline = perf_api.get_baseline_of_result(result_tcp)
+        baseline = perfrepo_baseline_to_dict(baseline)
+
+
+        tcp_res_data = netperf((m1, m1_if, 1, {"scope": 0}),
+                               (m2, m2_if, 1, {"scope": 0}),
+                               client_opts={"duration" : netperf_duration,
+                                            "testname" : "TCP_STREAM",
+                                            "confidence" : nperf_confidence,
+                                            "num_parallel" : nperf_num_parallel,
+                                            "cpu_util" : nperf_cpu_util,
+                                            "runs": nperf_max_runs,
+                                            "debug": nperf_debug,
+                                            "max_deviation": nperf_max_dev,
+                                            "msg_size" : nperf_msg_size,
+                                            "netperf_opts" : nperf_opts + " -6"},
+                               baseline = baseline,
+                               timeout = (netperf_duration + nperf_reserve)*nperf_max_runs)
+
+        netperf_result_template(result_tcp, tcp_res_data)
+        result_tcp.set_comment(pr_comment)
+        perf_api.save_result(result_tcp, official_result)
+
+        # prepare PerfRepo result for udp
+        result_udp = perf_api.new_result("udp_ipv6_id",
+                                         "udp_ipv6_result",
+                                         hash_ignore=[
+                                             r'kernel_release',
+                                             r'redhat_release'])
+        result_udp.add_tag(product_name)
+
+        if nperf_num_parallel > 1:
+            result_udp.add_tag("multithreaded")
+            result_udp.set_parameter('num_parallel', nperf_num_parallel)
+
+        result_udp.set_parameter('ipsec_algorithm', algo)
+        result_udp.set_parameter('key_length', key_len)
+        result_udp.set_parameter('iv_length', icv_len)
+        result_udp.set_parameter('msg_size', nperf_msg_size)
+        result_udp.set_parameter('ipsec_mode', ipsec_mode)
+
+        baseline = perf_api.get_baseline_of_result(result_udp)
+        baseline = perfrepo_baseline_to_dict(baseline)
+
+        udp_res_data = netperf((m1, m1_if, 1, {"scope": 0}),
+                               (m2, m2_if, 1, {"scope": 0}),
+                               client_opts={"duration" : netperf_duration,
+                                            "testname" : "UDP_STREAM",
+                                            "confidence" : nperf_confidence,
+                                            "num_parallel" : nperf_num_parallel,
+                                            "cpu_util" : nperf_cpu_util,
+                                            "runs": nperf_max_runs,
+                                            "debug": nperf_debug,
+                                            "max_deviation": nperf_max_dev,
+                                            "msg_size" : nperf_msg_size,
+                                            "netperf_opts" : nperf_opts + " -6"},
+                               baseline = baseline,
+                               timeout = (netperf_duration + nperf_reserve)*nperf_max_runs)
+
+        netperf_result_template(result_udp, udp_res_data)
+        result_udp.set_comment(pr_comment)
+        perf_api.save_result(result_udp, official_result)
+
+m1.run("ip xfrm policy flush")
+m1.run("ip xfrm state flush")
+m2.run("ip xfrm policy flush")
+m2.run("ip xfrm state flush")
+
+if nperf_cpupin:
+    m1.run("service irqbalance start")
+    m2.run("service irqbalance start")
diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.xml b/recipes/regression_tests/phase3/ipsec_esp_aead.xml
new file mode 100644
index 0000000..c37010e
--- /dev/null
+++ b/recipes/regression_tests/phase3/ipsec_esp_aead.xml
@@ -0,0 +1,51 @@
+<lnstrecipe>
+    <define>
+        <alias name="ipv" value="both" />
+        <alias name="mtu" value="1500" />
+        <alias name="netperf_duration" value="60" />
+        <alias name="nperf_reserve" value="20" />
+        <alias name="nperf_confidence" value="99,5" />
+        <alias name="nperf_max_runs" value="5"/>
+        <alias name="nperf_num_parallel" value="1"/>
+        <alias name="nperf_debug" value="0"/>
+        <alias name="nperf_max_dev" value="20%"/>
+        <alias name="mapping_file" value="ipsec_esp_aead.mapping"/>
+        <alias name="net_1" value="192.168.99"/>
+        <alias name="net6_1" value="fc00:1::"/>
+        <alias name="net_2" value="192.168.100"/>
+        <alias name="net6_2" value="fc00:2::"/>
+        <alias name="driver" value=""/>
+        <alias name="official_result" value="no" />
+    </define>
+    <network>
+        <host id="machine1">
+            <interfaces>
+                <eth id="eth" label="localnet">
+                    <params>
+                        <param name="driver" value="{$driver}"/>
+                    </params>
+                    <addresses>
+                        <address value="{$net_1}.1/24"/>
+                        <address value="{$net6_1}1/64"/>
+                    </addresses>
+                </eth>
+            </interfaces>
+        </host>
+        <host id="machine2">
+            <interfaces>
+                <eth id="eth" label="localnet">
+                    <params>
+                        <param name="driver" value="{$driver}"/>
+                    </params>
+                    <addresses>
+                        <address value="{$net_2}.1/24"/>
+                        <address value="{$net6_2}1/64"/>
+                    </addresses>
+                </eth>
+            </interfaces>
+        </host>
+    </network>
+
+    <task python="ipsec_esp_aead.py"/>
+
+</lnstrecipe>
--
2.5.5
_______________________________________________
LNST-developers mailing list -- lnst-developers@lists.fedorahosted.org
To unsubscribe send an email to lnst-developers-leave@lists.fedorahosted.org