This patch adds new ipsec_esp_aead test to our phase3 regression_tests. It is similar to ipsec_esp_ah_comp test. There is difference in configuration. In the test is configured only esp aead with algorithm rfc4106(gcm(aes)), key length 160bit and IV length 96bit.
Signed-off-by: Kamil Jerabek kjerabek@redhat.com
--- changes in: *v2: * add official_result handling for PerfRepo *v3: * add accidentally removed result parameters * remove comment about compression check --- .../regression_tests/phase3/ipsec_esp_aead.README | 90 +++++ recipes/regression_tests/phase3/ipsec_esp_aead.py | 434 +++++++++++++++++++++ recipes/regression_tests/phase3/ipsec_esp_aead.xml | 51 +++ 3 files changed, 575 insertions(+) create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.README create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.py create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.xml
diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.README b/recipes/regression_tests/phase3/ipsec_esp_aead.README new file mode 100644 index 0000000..8738da6 --- /dev/null +++ b/recipes/regression_tests/phase3/ipsec_esp_aead.README @@ -0,0 +1,90 @@ +Topology: + + switch + +------+ + | | + | | + +-------------+ +-------------+ + | | | | + | | | | + | +------+ | + | | + | | + +-+--+ +-+--+ ++-------|eth1|------+ +-------|eth1|------+ +| +-+--+ | | +-+--+ | +| | | | +| | | | +| | | | +| | | | +| | | | +| host1 | | host2 | +| | | | +| | | | +| | | | ++-------------------+ +-------------------+ + +Number of hosts: 2 +Host #1 description: + One ethernet device configured with ip addresses: + 192.168.99.1/24 + fc00:1::1/64 + +Host #2 description: + One ethernet device configured with ip addresses: + 192.168.100.1/24 + fc00:2::1/64 + +Test name: + ipsec_esp_aead.py +Test description: + Ping: + + count: 10 + + interval: 0.1s + + between ipsec encrypted ethernet interfaces headers check expecting PASS + + between ipsec encrypted ethernet interfaces compression check expecting PASS + Ping6: + + count: 10 + + interval: 0.1s + + between ipsec encrypted ethernet interfaces headers check expecting PASS + + between ipsec encrypted ethernet interfaces compression check expecting PASS + Netperf: + + duration: 60s + + TCP_STREAM and UDP_STREAM + + ipv4 and ipv6 + + between ipsec encrypted ethernet interfaces + IPsec + + tested with esp AEAD + + tested with algorithm rfc4106(gcm(aes)) + + key length - 160bit + + IV length - 96bit + +PerfRepo integration: + First, preparation in PerfRepo is required - you need to create Test objects + through the web interface that properly describe the individual Netperf + tests that this recipe runs. Don't forget to also add appropriate metrics. + For these Netperf tests it's always: + * throughput + * throughput_min + * throughput_max + * throughput_deviation + + After that, to enable support for PerfRepo you need to create the file + vxlan_remote.mapping and define the following id mappings: + tcp_ipv4_id -> to store ipv4 TCP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object + tcp_ipv6_id -> to store ipv6 TCP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object + udp_ipv4_id -> to store ipv4 UDP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object + udp_ipv6_id -> to store ipv4 UDP_STREAM Netperf test results, maps to TestUid of a PerfRepo Test object + + To enable result comparison agains baselines you need to create a Report in + PerfRepo that will store the baseline. Set up the Report to only contain results + with the same hash tag and then add a new mapping to the mapping file, with + this format: + <some_hash> = <report_id> + + The hash value is automatically generated during test execution and added + to each result stored in PerfRepo. To get the Report id you need to open + that report in our browser and find if in the URL. + + When running this recipe you should also define the 'product_name' alias + (e.g. RHEL7) in order to tag the result object in PerfRepo. diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.py b/recipes/regression_tests/phase3/ipsec_esp_aead.py new file mode 100644 index 0000000..5094a09 --- /dev/null +++ b/recipes/regression_tests/phase3/ipsec_esp_aead.py @@ -0,0 +1,434 @@ +from lnst.Common.Utils import bool_it +from lnst.Controller.Task import ctl +from lnst.Controller.PerfRepoUtils import perfrepo_baseline_to_dict +from lnst.Controller.PerfRepoUtils import netperf_result_template + +from lnst.RecipeCommon.ModuleWrap import ping, ping6, netperf +from lnst.RecipeCommon.IRQ import pin_dev_irqs +from lnst.RecipeCommon.PerfRepo import generate_perfrepo_comment +import re + +# --------------------------- +# ALGORITHM AND CIPHER CONFIG +# --------------------------- + +#lenth param is in bits +def generate_key(length): + key = "0x" + key = key + (length/8) * "0b" + return key + +algorithm = [] + +algorithm.append(('rfc4106(gcm(aes))', 160, 96)) + +# ------ +# SETUP +# ------ + +mapping_file = ctl.get_alias("mapping_file") +perf_api = ctl.connect_PerfRepo(mapping_file) + +product_name = ctl.get_alias("product_name") + +m1 = ctl.get_host("machine1") +m2 = ctl.get_host("machine2") + +m1.sync_resources(modules=["IcmpPing", "Icmp6Ping", "Netperf", "Custom"]) +m2.sync_resources(modules=["PacketAssert", "IcmpPing", "Icmp6Ping", "Netperf"]) + +# ------ +# TESTS +# ------ + +ipv = ctl.get_alias("ipv") +mtu = ctl.get_alias("mtu") +netperf_duration = int(ctl.get_alias("netperf_duration")) +nperf_reserve = int(ctl.get_alias("nperf_reserve")) +nperf_confidence = ctl.get_alias("nperf_confidence") +nperf_max_runs = int(ctl.get_alias("nperf_max_runs")) +nperf_cpupin = ctl.get_alias("nperf_cpupin") +nperf_cpu_util = ctl.get_alias("nperf_cpu_util") +nperf_num_parallel = int(ctl.get_alias("nperf_num_parallel")) +nperf_debug = ctl.get_alias("nperf_debug") +nperf_max_dev = ctl.get_alias("nperf_max_dev") +nperf_msg_size = ctl.get_alias("nperf_msg_size") +pr_user_comment = ctl.get_alias("perfrepo_comment") +ipsec_mode = ctl.get_alias("ipsec_mode") +official_result = bool_it(ctl.get_alias("official_result")) + +pr_comment = generate_perfrepo_comment([m1, m2], pr_user_comment) + +m1_if = m1.get_interface("eth") +m2_if = m2.get_interface("eth") + +m1_if.set_mtu(mtu) +m2_if.set_mtu(mtu) + +m1_if_name = m1_if.get_devname() +m2_if_name = m2_if.get_devname() + +m1_if_addr = m1_if.get_ip() +m2_if_addr = m2_if.get_ip() + +m1_if_addr6 = m1_if.get_ip(1) +m2_if_addr6 = m2_if.get_ip(1) + + +# add routing rulez ipv4 +# so the host knows where to send traffic destined to remote site +m1.run("ip route add %s dev %s" % (m2_if_addr, m1_if_name)) + +# so the host knows where to send traffic destined to remote site +m2.run("ip route add %s dev %s" % (m1_if_addr, m2_if_name)) + +# add routing rulez ipv6 +# so the host knows where to send traffic destined to remote site +m1.run("ip route add %s dev %s" % (m2_if_addr6, m1_if_name)) + +# so the host knows where to send traffic destined to remote site +m2.run("ip route add %s dev %s" % (m1_if_addr6, m2_if_name)) + +if nperf_msg_size is None: + nperf_msg_size = 16000 + +if ipsec_mode is None: + ipsec_mode = "transport" + +res = m1.run("rpm -qa iproute", save_output=True) +if (res.get_result()["res_data"]["stdout"].find("iproute-2") != -1): + m1_key="0x" +else: + m1_key="" + +res = m2.run("rpm -qa iproute", save_output=True) +if (res.get_result()["res_data"]["stdout"].find("iproute-2") != -1): + m2_key="0x" +else: + m2_key="" + +if nperf_cpupin: + m1.run("service irqbalance stop") + m2.run("service irqbalance stop") + + dev_list = [(m1, m1_if), (m2, m2_if)] + + # this will pin devices irqs to cpu #0 + for m, d in dev_list: + pin_dev_irqs(m, d, 0) + +nperf_opts = "" +if nperf_cpupin and nperf_num_parallel == 1: + nperf_opts = " -T%s,%s" % (nperf_cpupin, nperf_cpupin) + +ctl.wait(15) + +def configure_ipsec(algo, algo_key, icv_len, ip_version): + if ip_version == "ipv4": + m1_addr = m1_if_addr + m2_addr = m2_if_addr + else: + m1_addr = m1_if_addr6 + m2_addr = m2_if_addr6 + + # configure policy and state + m1.run("ip xfrm policy flush") + m1.run("ip xfrm state flush") + m2.run("ip xfrm policy flush") + m2.run("ip xfrm state flush") + + m1.run("ip xfrm state add src %s dst %s proto esp spi 0x1001 "\ + "aead '%s' %s %s mode %s "\ + "sel src %s dst %s"\ + % (m2_addr, m1_addr, + algo, algo_key, icv_len, ipsec_mode, + m2_addr, m1_addr)) + + m1.run("ip xfrm policy add src %s dst %s dir in tmpl "\ + "src %s dst %s proto esp mode %s action allow"\ + % (m2_addr, m1_addr, + m2_addr, m1_addr, ipsec_mode)) + + m1.run("ip xfrm state add src %s dst %s proto esp spi 0x1000 "\ + "aead '%s' %s %s mode %s "\ + "sel src %s dst %s"\ + % (m1_addr, m2_addr, + algo, algo_key, icv_len, ipsec_mode, + m1_addr, m2_addr)) + + m1.run("ip xfrm policy add src %s dst %s dir out tmpl "\ + "src %s dst %s proto esp mode %s action allow"\ + % (m1_addr, m2_addr, + m1_addr, m2_addr, ipsec_mode)) + + + + + m2.run("ip xfrm state add src %s dst %s proto esp spi 0x1000 "\ + "aead '%s' %s %s mode %s "\ + "sel src %s dst %s"\ + % (m1_addr, m2_addr, + algo, algo_key, icv_len, ipsec_mode, + m1_addr, m2_addr)) + + m2.run("ip xfrm policy add src %s dst %s dir in tmpl "\ + "src %s dst %s proto esp mode %s action allow"\ + % (m1_addr, m2_addr, + m1_addr, m2_addr, ipsec_mode)) + + m2.run("ip xfrm state add src %s dst %s proto esp spi 0x1001 "\ + "aead '%s' %s %s mode %s sel "\ + "src %s dst %s"\ + % (m2_addr, m1_addr, + algo, algo_key, icv_len, ipsec_mode, + m2_addr, m1_addr)) + + m2.run("ip xfrm policy add src %s dst %s dir out tmpl "\ + "src %s dst %s proto esp mode %s action allow"\ + % (m2_addr, m1_addr, + m2_addr, m1_addr, ipsec_mode)) + + + +for algo, key_len, icv_len in algorithm: + # test: TCP netperf, UDP netperf + if ipv in [ 'ipv4', 'both']: + configure_ipsec(algo, + generate_key(key_len), + icv_len, + "ipv4") + + dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True) + + # ping + PacketAssert + assert_mod = ctl.get_module("PacketAssert", + options={ + "interface": m2_if_name, + "filter": "esp", + "grep_for": [ "ESP(spi=0x00001001" ], + "min": 10 + }) + + assert_proc = m2.run(assert_mod, bg=True) + + ping_mod = ctl.get_module("IcmpPing", + options={ + "addr": m2_if_addr, + "count": 10, + "interval": 0.1}) + + ctl.wait(2) + + m1.run(ping_mod) + + ctl.wait(2) + + assert_proc.intr() + + dump.intr() + + # prepare PerfRepo result for tcp + result_tcp = perf_api.new_result("tcp_ipv4_id", + "tcp_ipv4_result", + hash_ignore=[ + r'kernel_release', + r'redhat_release']) + result_tcp.add_tag(product_name) + + if nperf_num_parallel > 1: + result_tcp.add_tag("multithreaded") + result_tcp.set_parameter('num_parallel', nperf_num_parallel) + + result_tcp.set_parameter('ipsec_algorithm', algo) + result_tcp.set_parameter('key_length', key_len) + result_tcp.set_parameter('iv_length', icv_len) + result_tcp.set_parameter('msg_size', nperf_msg_size) + result_tcp.set_parameter('ipsec_mode', ipsec_mode) + + baseline = perf_api.get_baseline_of_result(result_tcp) + baseline = perfrepo_baseline_to_dict(baseline) + + + tcp_res_data = netperf((m1, m1_if, 0, {"scope": 0}), + (m2, m2_if, 0, {"scope": 0}), + client_opts={"duration" : netperf_duration, + "testname" : "TCP_STREAM", + "confidence" : nperf_confidence, + "num_parallel" : nperf_num_parallel, + "cpu_util" : nperf_cpu_util, + "runs": nperf_max_runs, + "debug": nperf_debug, + "max_deviation": nperf_max_dev, + "msg_size" : nperf_msg_size, + "netperf_opts": nperf_opts}, + baseline = baseline, + timeout = (netperf_duration + nperf_reserve)*nperf_max_runs) + + netperf_result_template(result_tcp, tcp_res_data) + result_tcp.set_comment(pr_comment) + perf_api.save_result(result_tcp, official_result) + + # prepare PerfRepo result for udp + result_udp = perf_api.new_result("udp_ipv4_id", + "udp_ipv4_result", + hash_ignore=[ + r'kernel_release', + r'redhat_release']) + result_udp.add_tag(product_name) + + if nperf_num_parallel > 1: + result_udp.add_tag("multithreaded") + result_udp.set_parameter('num_parallel', nperf_num_parallel) + + result_udp.set_parameter('ipsec_algorithm', algo) + result_udp.set_parameter('key_length', key_len) + result_udp.set_parameter('iv_length', icv_len) + result_udp.set_parameter('msg_size', nperf_msg_size) + result_udp.set_parameter('ipsec_mode', ipsec_mode) + + baseline = perf_api.get_baseline_of_result(result_udp) + baseline = perfrepo_baseline_to_dict(baseline) + + udp_res_data = netperf((m1, m1_if, 0, {"scope": 0}), + (m2, m2_if, 0, {"scope": 0}), + client_opts={"duration" : netperf_duration, + "testname" : "UDP_STREAM", + "confidence" : nperf_confidence, + "num_parallel" : nperf_num_parallel, + "cpu_util" : nperf_cpu_util, + "runs": nperf_max_runs, + "debug": nperf_debug, + "max_deviation": nperf_max_dev, + "msg_size" : nperf_msg_size, + "netperf_opts": nperf_opts}, + baseline = baseline, + timeout = (netperf_duration + nperf_reserve)*nperf_max_runs) + + netperf_result_template(result_udp, udp_res_data) + result_udp.set_comment(pr_comment) + perf_api.save_result(result_udp, official_result) + + if ipv in [ 'ipv6', 'both']: + configure_ipsec(algo, + generate_key(key_len), + icv_len, + "ipv6") + + dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True) + + # ping + PacketAssert + assert_mod = ctl.get_module("PacketAssert", + options={ + "interface": m2_if_name, + "filter": "esp", + "grep_for": [ "ESP(spi=0x00001001" ], + "min": 10 + }) + + assert_proc = m2.run(assert_mod, bg=True) + + ping_mod = ctl.get_module("Icmp6Ping", + options={ + "addr": m2_if_addr6, + "count": 10, + "interval": 0.1}) + + ctl.wait(2) + + m1.run(ping_mod) + + ctl.wait(2) + + assert_proc.intr() + + dump.intr() + + # prepare PerfRepo result for tcp + result_tcp = perf_api.new_result("tcp_ipv6_id", + "tcp_ipv6_result", + hash_ignore=[ + r'kernel_release', + r'redhat_release']) + result_tcp.add_tag(product_name) + + if nperf_num_parallel > 1: + result_tcp.add_tag("multithreaded") + result_tcp.set_parameter('num_parallel', nperf_num_parallel) + + result_tcp.set_parameter('ipsec_algorithm', algo) + result_tcp.set_parameter('key_length', key_len) + result_tcp.set_parameter('iv_length', icv_len) + result_tcp.set_parameter('msg_size', nperf_msg_size) + result_tcp.set_parameter('ipsec_mode', ipsec_mode) + + baseline = perf_api.get_baseline_of_result(result_tcp) + baseline = perfrepo_baseline_to_dict(baseline) + + + tcp_res_data = netperf((m1, m1_if, 1, {"scope": 0}), + (m2, m2_if, 1, {"scope": 0}), + client_opts={"duration" : netperf_duration, + "testname" : "TCP_STREAM", + "confidence" : nperf_confidence, + "num_parallel" : nperf_num_parallel, + "cpu_util" : nperf_cpu_util, + "runs": nperf_max_runs, + "debug": nperf_debug, + "max_deviation": nperf_max_dev, + "msg_size" : nperf_msg_size, + "netperf_opts" : nperf_opts + " -6"}, + baseline = baseline, + timeout = (netperf_duration + nperf_reserve)*nperf_max_runs) + + netperf_result_template(result_tcp, tcp_res_data) + result_tcp.set_comment(pr_comment) + perf_api.save_result(result_tcp, official_result) + + # prepare PerfRepo result for udp + result_udp = perf_api.new_result("udp_ipv6_id", + "udp_ipv6_result", + hash_ignore=[ + r'kernel_release', + r'redhat_release']) + result_udp.add_tag(product_name) + + if nperf_num_parallel > 1: + result_udp.add_tag("multithreaded") + result_udp.set_parameter('num_parallel', nperf_num_parallel) + + result_udp.set_parameter('ipsec_algorithm', algo) + result_udp.set_parameter('key_length', key_len) + result_udp.set_parameter('iv_length', icv_len) + result_udp.set_parameter('msg_size', nperf_msg_size) + result_udp.set_parameter('ipsec_mode', ipsec_mode) + + baseline = perf_api.get_baseline_of_result(result_udp) + baseline = perfrepo_baseline_to_dict(baseline) + + udp_res_data = netperf((m1, m1_if, 1, {"scope": 0}), + (m2, m2_if, 1, {"scope": 0}), + client_opts={"duration" : netperf_duration, + "testname" : "UDP_STREAM", + "confidence" : nperf_confidence, + "num_parallel" : nperf_num_parallel, + "cpu_util" : nperf_cpu_util, + "runs": nperf_max_runs, + "debug": nperf_debug, + "max_deviation": nperf_max_dev, + "msg_size" : nperf_msg_size, + "netperf_opts" : nperf_opts + " -6"}, + baseline = baseline, + timeout = (netperf_duration + nperf_reserve)*nperf_max_runs) + + netperf_result_template(result_udp, udp_res_data) + result_udp.set_comment(pr_comment) + perf_api.save_result(result_udp, official_result) + +m1.run("ip xfrm policy flush") +m1.run("ip xfrm state flush") +m2.run("ip xfrm policy flush") +m2.run("ip xfrm state flush") + +if nperf_cpupin: + m1.run("service irqbalance start") + m2.run("service irqbalance start") diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.xml b/recipes/regression_tests/phase3/ipsec_esp_aead.xml new file mode 100644 index 0000000..c37010e --- /dev/null +++ b/recipes/regression_tests/phase3/ipsec_esp_aead.xml @@ -0,0 +1,51 @@ +<lnstrecipe> + <define> + <alias name="ipv" value="both" /> + <alias name="mtu" value="1500" /> + <alias name="netperf_duration" value="60" /> + <alias name="nperf_reserve" value="20" /> + <alias name="nperf_confidence" value="99,5" /> + <alias name="nperf_max_runs" value="5"/> + <alias name="nperf_num_parallel" value="1"/> + <alias name="nperf_debug" value="0"/> + <alias name="nperf_max_dev" value="20%"/> + <alias name="mapping_file" value="ipsec_esp_aead.mapping"/> + <alias name="net_1" value="192.168.99"/> + <alias name="net6_1" value="fc00:1::"/> + <alias name="net_2" value="192.168.100"/> + <alias name="net6_2" value="fc00:2::"/> + <alias name="driver" value=""/> + <alias name="official_result" value="no" /> + </define> + <network> + <host id="machine1"> + <interfaces> + <eth id="eth" label="localnet"> + <params> + <param name="driver" value="{$driver}"/> + </params> + <addresses> + <address value="{$net_1}.1/24"/> + <address value="{$net6_1}1/64"/> + </addresses> + </eth> + </interfaces> + </host> + <host id="machine2"> + <interfaces> + <eth id="eth" label="localnet"> + <params> + <param name="driver" value="{$driver}"/> + </params> + <addresses> + <address value="{$net_2}.1/24"/> + <address value="{$net6_2}1/64"/> + </addresses> + </eth> + </interfaces> + </host> + </network> + + <task python="ipsec_esp_aead.py"/> + +</lnstrecipe>
Few coments from flake8:
'lnst.RecipeCommon.ModuleWrap.ping' imported but unused 'lnst.RecipeCommon.ModuleWrap.ping6' imported but unused 're' imported but unused
2017-11-30 10:52 GMT+01:00 Kamil Jerabek kjerabek@redhat.com:
This patch adds new ipsec_esp_aead test to our phase3 regression_tests. It is similar to ipsec_esp_ah_comp test. There is difference in configuration. In the test is configured only esp aead with algorithm rfc4106(gcm(aes)), key length 160bit and IV length 96bit.
Signed-off-by: Kamil Jerabek kjerabek@redhat.com
changes in: *v2:
- add official_result handling for PerfRepo
*v3:
- add accidentally removed result parameters
- remove comment about compression check
.../regression_tests/phase3/ipsec_esp_aead.README | 90 +++++ recipes/regression_tests/phase3/ipsec_esp_aead.py | 434 +++++++++++++++++++++ recipes/regression_tests/phase3/ipsec_esp_aead.xml | 51 +++ 3 files changed, 575 insertions(+) create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.README create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.py create mode 100644 recipes/regression_tests/phase3/ipsec_esp_aead.xml
diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.README b/recipes/regression_tests/phase3/ipsec_esp_aead.README new file mode 100644 index 0000000..8738da6 --- /dev/null +++ b/recipes/regression_tests/phase3/ipsec_esp_aead.README @@ -0,0 +1,90 @@ +Topology:
switch
+------+
| |
| |
+-------------+ +-------------+
| | | |
| | | |
| +------+ |
| |
| |
+-+--+ +-+--+
++-------|eth1|------+ +-------|eth1|------+ +| +-+--+ | | +-+--+ | +| | | | +| | | | +| | | | +| | | | +| | | | +| host1 | | host2 | +| | | | +| | | | +| | | | ++-------------------+ +-------------------+
+Number of hosts: 2 +Host #1 description:
- One ethernet device configured with ip addresses:
- 192.168.99.1/24
- fc00:1::1/64
+Host #2 description:
- One ethernet device configured with ip addresses:
- 192.168.100.1/24
- fc00:2::1/64
+Test name:
- ipsec_esp_aead.py
+Test description:
- Ping:
- count: 10
- interval: 0.1s
- between ipsec encrypted ethernet interfaces headers check expecting
PASS
- between ipsec encrypted ethernet interfaces compression check
expecting PASS
- Ping6:
- count: 10
- interval: 0.1s
- between ipsec encrypted ethernet interfaces headers check expecting
PASS
- between ipsec encrypted ethernet interfaces compression check
expecting PASS
- Netperf:
- duration: 60s
- TCP_STREAM and UDP_STREAM
- ipv4 and ipv6
- between ipsec encrypted ethernet interfaces
- IPsec
- tested with esp AEAD
- tested with algorithm rfc4106(gcm(aes))
- key length - 160bit
- IV length - 96bit
+PerfRepo integration:
- First, preparation in PerfRepo is required - you need to create Test
objects
- through the web interface that properly describe the individual
Netperf
- tests that this recipe runs. Don't forget to also add appropriate
metrics.
- For these Netperf tests it's always:
- throughput
- throughput_min
- throughput_max
- throughput_deviation
- After that, to enable support for PerfRepo you need to create the file
- vxlan_remote.mapping and define the following id mappings:
- tcp_ipv4_id -> to store ipv4 TCP_STREAM Netperf test results, maps to
TestUid of a PerfRepo Test object
- tcp_ipv6_id -> to store ipv6 TCP_STREAM Netperf test results, maps to
TestUid of a PerfRepo Test object
- udp_ipv4_id -> to store ipv4 UDP_STREAM Netperf test results, maps to
TestUid of a PerfRepo Test object
- udp_ipv6_id -> to store ipv4 UDP_STREAM Netperf test results, maps to
TestUid of a PerfRepo Test object
- To enable result comparison agains baselines you need to create a
Report in
- PerfRepo that will store the baseline. Set up the Report to only
contain results
- with the same hash tag and then add a new mapping to the mapping
file, with
- this format:
- <some_hash> = <report_id>
- The hash value is automatically generated during test execution and
added
- to each result stored in PerfRepo. To get the Report id you need to
open
- that report in our browser and find if in the URL.
- When running this recipe you should also define the 'product_name'
alias
- (e.g. RHEL7) in order to tag the result object in PerfRepo.
diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.py b/recipes/regression_tests/phase3/ipsec_esp_aead.py new file mode 100644 index 0000000..5094a09 --- /dev/null +++ b/recipes/regression_tests/phase3/ipsec_esp_aead.py @@ -0,0 +1,434 @@ +from lnst.Common.Utils import bool_it +from lnst.Controller.Task import ctl +from lnst.Controller.PerfRepoUtils import perfrepo_baseline_to_dict +from lnst.Controller.PerfRepoUtils import netperf_result_template
+from lnst.RecipeCommon.ModuleWrap import ping, ping6, netperf +from lnst.RecipeCommon.IRQ import pin_dev_irqs +from lnst.RecipeCommon.PerfRepo import generate_perfrepo_comment +import re
+# --------------------------- +# ALGORITHM AND CIPHER CONFIG +# ---------------------------
+#lenth param is in bits +def generate_key(length):
- key = "0x"
- key = key + (length/8) * "0b"
- return key
+algorithm = []
+algorithm.append(('rfc4106(gcm(aes))', 160, 96))
+# ------ +# SETUP +# ------
+mapping_file = ctl.get_alias("mapping_file") +perf_api = ctl.connect_PerfRepo(mapping_file)
+product_name = ctl.get_alias("product_name")
+m1 = ctl.get_host("machine1") +m2 = ctl.get_host("machine2")
+m1.sync_resources(modules=["IcmpPing", "Icmp6Ping", "Netperf", "Custom"]) +m2.sync_resources(modules=["PacketAssert", "IcmpPing", "Icmp6Ping", "Netperf"])
+# ------ +# TESTS +# ------
+ipv = ctl.get_alias("ipv") +mtu = ctl.get_alias("mtu") +netperf_duration = int(ctl.get_alias("netperf_duration")) +nperf_reserve = int(ctl.get_alias("nperf_reserve")) +nperf_confidence = ctl.get_alias("nperf_confidence") +nperf_max_runs = int(ctl.get_alias("nperf_max_runs")) +nperf_cpupin = ctl.get_alias("nperf_cpupin") +nperf_cpu_util = ctl.get_alias("nperf_cpu_util") +nperf_num_parallel = int(ctl.get_alias("nperf_num_parallel")) +nperf_debug = ctl.get_alias("nperf_debug") +nperf_max_dev = ctl.get_alias("nperf_max_dev") +nperf_msg_size = ctl.get_alias("nperf_msg_size") +pr_user_comment = ctl.get_alias("perfrepo_comment") +ipsec_mode = ctl.get_alias("ipsec_mode") +official_result = bool_it(ctl.get_alias("official_result"))
+pr_comment = generate_perfrepo_comment([m1, m2], pr_user_comment)
+m1_if = m1.get_interface("eth") +m2_if = m2.get_interface("eth")
+m1_if.set_mtu(mtu) +m2_if.set_mtu(mtu)
+m1_if_name = m1_if.get_devname() +m2_if_name = m2_if.get_devname()
+m1_if_addr = m1_if.get_ip() +m2_if_addr = m2_if.get_ip()
+m1_if_addr6 = m1_if.get_ip(1) +m2_if_addr6 = m2_if.get_ip(1)
+# add routing rulez ipv4 +# so the host knows where to send traffic destined to remote site +m1.run("ip route add %s dev %s" % (m2_if_addr, m1_if_name))
+# so the host knows where to send traffic destined to remote site +m2.run("ip route add %s dev %s" % (m1_if_addr, m2_if_name))
+# add routing rulez ipv6 +# so the host knows where to send traffic destined to remote site +m1.run("ip route add %s dev %s" % (m2_if_addr6, m1_if_name))
+# so the host knows where to send traffic destined to remote site +m2.run("ip route add %s dev %s" % (m1_if_addr6, m2_if_name))
+if nperf_msg_size is None:
- nperf_msg_size = 16000
+if ipsec_mode is None:
- ipsec_mode = "transport"
+res = m1.run("rpm -qa iproute", save_output=True) +if (res.get_result()["res_data"]["stdout"].find("iproute-2") != -1):
- m1_key="0x"
+else:
- m1_key=""
+res = m2.run("rpm -qa iproute", save_output=True) +if (res.get_result()["res_data"]["stdout"].find("iproute-2") != -1):
- m2_key="0x"
+else:
- m2_key=""
+if nperf_cpupin:
- m1.run("service irqbalance stop")
- m2.run("service irqbalance stop")
- dev_list = [(m1, m1_if), (m2, m2_if)]
- # this will pin devices irqs to cpu #0
- for m, d in dev_list:
pin_dev_irqs(m, d, 0)
+nperf_opts = "" +if nperf_cpupin and nperf_num_parallel == 1:
- nperf_opts = " -T%s,%s" % (nperf_cpupin, nperf_cpupin)
+ctl.wait(15)
+def configure_ipsec(algo, algo_key, icv_len, ip_version):
- if ip_version == "ipv4":
m1_addr = m1_if_addr
m2_addr = m2_if_addr
- else:
m1_addr = m1_if_addr6
m2_addr = m2_if_addr6
- # configure policy and state
- m1.run("ip xfrm policy flush")
- m1.run("ip xfrm state flush")
- m2.run("ip xfrm policy flush")
- m2.run("ip xfrm state flush")
- m1.run("ip xfrm state add src %s dst %s proto esp spi 0x1001 "\
"aead '%s' %s %s mode %s "\
"sel src %s dst %s"\
% (m2_addr, m1_addr,
algo, algo_key, icv_len, ipsec_mode,
m2_addr, m1_addr))
- m1.run("ip xfrm policy add src %s dst %s dir in tmpl "\
"src %s dst %s proto esp mode %s action allow"\
% (m2_addr, m1_addr,
m2_addr, m1_addr, ipsec_mode))
- m1.run("ip xfrm state add src %s dst %s proto esp spi 0x1000 "\
"aead '%s' %s %s mode %s "\
"sel src %s dst %s"\
% (m1_addr, m2_addr,
algo, algo_key, icv_len, ipsec_mode,
m1_addr, m2_addr))
- m1.run("ip xfrm policy add src %s dst %s dir out tmpl "\
"src %s dst %s proto esp mode %s action allow"\
% (m1_addr, m2_addr,
m1_addr, m2_addr, ipsec_mode))
- m2.run("ip xfrm state add src %s dst %s proto esp spi 0x1000 "\
"aead '%s' %s %s mode %s "\
"sel src %s dst %s"\
% (m1_addr, m2_addr,
algo, algo_key, icv_len, ipsec_mode,
m1_addr, m2_addr))
- m2.run("ip xfrm policy add src %s dst %s dir in tmpl "\
"src %s dst %s proto esp mode %s action allow"\
% (m1_addr, m2_addr,
m1_addr, m2_addr, ipsec_mode))
- m2.run("ip xfrm state add src %s dst %s proto esp spi 0x1001 "\
"aead '%s' %s %s mode %s sel "\
"src %s dst %s"\
% (m2_addr, m1_addr,
algo, algo_key, icv_len, ipsec_mode,
m2_addr, m1_addr))
- m2.run("ip xfrm policy add src %s dst %s dir out tmpl "\
"src %s dst %s proto esp mode %s action allow"\
% (m2_addr, m1_addr,
m2_addr, m1_addr, ipsec_mode))
+for algo, key_len, icv_len in algorithm:
- # test: TCP netperf, UDP netperf
- if ipv in [ 'ipv4', 'both']:
configure_ipsec(algo,
generate_key(key_len),
icv_len,
"ipv4")
dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True)
# ping + PacketAssert
assert_mod = ctl.get_module("PacketAssert",
options={
"interface": m2_if_name,
"filter": "esp",
"grep_for": [ "ESP\(spi=0x00001001"
],
"min": 10
})
assert_proc = m2.run(assert_mod, bg=True)
ping_mod = ctl.get_module("IcmpPing",
options={
"addr": m2_if_addr,
"count": 10,
"interval": 0.1})
ctl.wait(2)
m1.run(ping_mod)
ctl.wait(2)
assert_proc.intr()
dump.intr()
# prepare PerfRepo result for tcp
result_tcp = perf_api.new_result("tcp_ipv4_id",
"tcp_ipv4_result",
hash_ignore=[
r'kernel_release',
r'redhat_release'])
result_tcp.add_tag(product_name)
if nperf_num_parallel > 1:
result_tcp.add_tag("multithreaded")
result_tcp.set_parameter('num_parallel', nperf_num_parallel)
result_tcp.set_parameter('ipsec_algorithm', algo)
result_tcp.set_parameter('key_length', key_len)
result_tcp.set_parameter('iv_length', icv_len)
result_tcp.set_parameter('msg_size', nperf_msg_size)
result_tcp.set_parameter('ipsec_mode', ipsec_mode)
baseline = perf_api.get_baseline_of_result(result_tcp)
baseline = perfrepo_baseline_to_dict(baseline)
tcp_res_data = netperf((m1, m1_if, 0, {"scope": 0}),
(m2, m2_if, 0, {"scope": 0}),
client_opts={"duration" : netperf_duration,
"testname" : "TCP_STREAM",
"confidence" :
nperf_confidence,
"num_parallel" :
nperf_num_parallel,
"cpu_util" : nperf_cpu_util,
"runs": nperf_max_runs,
"debug": nperf_debug,
"max_deviation": nperf_max_dev,
"msg_size" : nperf_msg_size,
"netperf_opts": nperf_opts},
baseline = baseline,
timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
netperf_result_template(result_tcp, tcp_res_data)
result_tcp.set_comment(pr_comment)
perf_api.save_result(result_tcp, official_result)
# prepare PerfRepo result for udp
result_udp = perf_api.new_result("udp_ipv4_id",
"udp_ipv4_result",
hash_ignore=[
r'kernel_release',
r'redhat_release'])
result_udp.add_tag(product_name)
if nperf_num_parallel > 1:
result_udp.add_tag("multithreaded")
result_udp.set_parameter('num_parallel', nperf_num_parallel)
result_udp.set_parameter('ipsec_algorithm', algo)
result_udp.set_parameter('key_length', key_len)
result_udp.set_parameter('iv_length', icv_len)
result_udp.set_parameter('msg_size', nperf_msg_size)
result_udp.set_parameter('ipsec_mode', ipsec_mode)
baseline = perf_api.get_baseline_of_result(result_udp)
baseline = perfrepo_baseline_to_dict(baseline)
udp_res_data = netperf((m1, m1_if, 0, {"scope": 0}),
(m2, m2_if, 0, {"scope": 0}),
client_opts={"duration" : netperf_duration,
"testname" : "UDP_STREAM",
"confidence" :
nperf_confidence,
"num_parallel" :
nperf_num_parallel,
"cpu_util" : nperf_cpu_util,
"runs": nperf_max_runs,
"debug": nperf_debug,
"max_deviation":
nperf_max_dev,
"msg_size" : nperf_msg_size,
"netperf_opts": nperf_opts},
baseline = baseline,
timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
netperf_result_template(result_udp, udp_res_data)
result_udp.set_comment(pr_comment)
perf_api.save_result(result_udp, official_result)
- if ipv in [ 'ipv6', 'both']:
configure_ipsec(algo,
generate_key(key_len),
icv_len,
"ipv6")
dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True)
# ping + PacketAssert
assert_mod = ctl.get_module("PacketAssert",
options={
"interface": m2_if_name,
"filter": "esp",
"grep_for": [ "ESP\(spi=0x00001001"
],
"min": 10
})
assert_proc = m2.run(assert_mod, bg=True)
ping_mod = ctl.get_module("Icmp6Ping",
options={
"addr": m2_if_addr6,
"count": 10,
"interval": 0.1})
ctl.wait(2)
m1.run(ping_mod)
ctl.wait(2)
assert_proc.intr()
dump.intr()
# prepare PerfRepo result for tcp
result_tcp = perf_api.new_result("tcp_ipv6_id",
"tcp_ipv6_result",
hash_ignore=[
r'kernel_release',
r'redhat_release'])
result_tcp.add_tag(product_name)
if nperf_num_parallel > 1:
result_tcp.add_tag("multithreaded")
result_tcp.set_parameter('num_parallel', nperf_num_parallel)
result_tcp.set_parameter('ipsec_algorithm', algo)
result_tcp.set_parameter('key_length', key_len)
result_tcp.set_parameter('iv_length', icv_len)
result_tcp.set_parameter('msg_size', nperf_msg_size)
result_tcp.set_parameter('ipsec_mode', ipsec_mode)
baseline = perf_api.get_baseline_of_result(result_tcp)
baseline = perfrepo_baseline_to_dict(baseline)
tcp_res_data = netperf((m1, m1_if, 1, {"scope": 0}),
(m2, m2_if, 1, {"scope": 0}),
client_opts={"duration" : netperf_duration,
"testname" : "TCP_STREAM",
"confidence" :
nperf_confidence,
"num_parallel" :
nperf_num_parallel,
"cpu_util" : nperf_cpu_util,
"runs": nperf_max_runs,
"debug": nperf_debug,
"max_deviation":
nperf_max_dev,
"msg_size" : nperf_msg_size,
"netperf_opts" : nperf_opts +
" -6"},
baseline = baseline,
timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
netperf_result_template(result_tcp, tcp_res_data)
result_tcp.set_comment(pr_comment)
perf_api.save_result(result_tcp, official_result)
# prepare PerfRepo result for udp
result_udp = perf_api.new_result("udp_ipv6_id",
"udp_ipv6_result",
hash_ignore=[
r'kernel_release',
r'redhat_release'])
result_udp.add_tag(product_name)
if nperf_num_parallel > 1:
result_udp.add_tag("multithreaded")
result_udp.set_parameter('num_parallel', nperf_num_parallel)
result_udp.set_parameter('ipsec_algorithm', algo)
result_udp.set_parameter('key_length', key_len)
result_udp.set_parameter('iv_length', icv_len)
result_udp.set_parameter('msg_size', nperf_msg_size)
result_udp.set_parameter('ipsec_mode', ipsec_mode)
baseline = perf_api.get_baseline_of_result(result_udp)
baseline = perfrepo_baseline_to_dict(baseline)
udp_res_data = netperf((m1, m1_if, 1, {"scope": 0}),
(m2, m2_if, 1, {"scope": 0}),
client_opts={"duration" : netperf_duration,
"testname" : "UDP_STREAM",
"confidence" :
nperf_confidence,
"num_parallel" :
nperf_num_parallel,
"cpu_util" : nperf_cpu_util,
"runs": nperf_max_runs,
"debug": nperf_debug,
"max_deviation":
nperf_max_dev,
"msg_size" : nperf_msg_size,
"netperf_opts" : nperf_opts +
" -6"},
baseline = baseline,
timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
netperf_result_template(result_udp, udp_res_data)
result_udp.set_comment(pr_comment)
perf_api.save_result(result_udp, official_result)
+m1.run("ip xfrm policy flush") +m1.run("ip xfrm state flush") +m2.run("ip xfrm policy flush") +m2.run("ip xfrm state flush")
+if nperf_cpupin:
- m1.run("service irqbalance start")
- m2.run("service irqbalance start")
diff --git a/recipes/regression_tests/phase3/ipsec_esp_aead.xml b/recipes/regression_tests/phase3/ipsec_esp_aead.xml new file mode 100644 index 0000000..c37010e --- /dev/null +++ b/recipes/regression_tests/phase3/ipsec_esp_aead.xml @@ -0,0 +1,51 @@ +<lnstrecipe>
<define>
<alias name="ipv" value="both" />
<alias name="mtu" value="1500" />
<alias name="netperf_duration" value="60" />
<alias name="nperf_reserve" value="20" />
<alias name="nperf_confidence" value="99,5" />
<alias name="nperf_max_runs" value="5"/>
<alias name="nperf_num_parallel" value="1"/>
<alias name="nperf_debug" value="0"/>
<alias name="nperf_max_dev" value="20%"/>
<alias name="mapping_file" value="ipsec_esp_aead.mapping"/>
<alias name="net_1" value="192.168.99"/>
<alias name="net6_1" value="fc00:1::"/>
<alias name="net_2" value="192.168.100"/>
<alias name="net6_2" value="fc00:2::"/>
<alias name="driver" value=""/>
<alias name="official_result" value="no" />
</define>
<network>
<host id="machine1">
<interfaces>
<eth id="eth" label="localnet">
<params>
<param name="driver" value="{$driver}"/>
</params>
<addresses>
<address value="{$net_1}.1/24"/>
<address value="{$net6_1}1/64"/>
</addresses>
</eth>
</interfaces>
</host>
<host id="machine2">
<interfaces>
<eth id="eth" label="localnet">
<params>
<param name="driver" value="{$driver}"/>
</params>
<addresses>
<address value="{$net_2}.1/24"/>
<address value="{$net6_2}1/64"/>
</addresses>
</eth>
</interfaces>
</host>
</network>
<task python="ipsec_esp_aead.py"/>
+</lnstrecipe>
2.5.5 _______________________________________________ LNST-developers mailing list -- lnst-developers@lists.fedorahosted.org To unsubscribe send an email to lnst-developers-leave@lists. fedorahosted.org
lnst-developers@lists.fedorahosted.org