Thu, Jan 05, 2017 at 09:29:56AM CET, kjerabek(a)redhat.com wrote:
This patch adds new test to our regression_tests phase3. The topology
is the same as in phase1 simple_netperf test.
This test covers performance of ipsec over ethernet. Ping and netperf is run.
Covered are both tunnel and transport mode. All tests are done with esp, ah and
comp options set together. All combinations of cipher and hash functions listed
below are tested. Netperf message size is set to 1400 bytes by default.
ciphers: aes, des, des3_ede, cast5, blowfish, serpent, twofish
hash functions: hmac(md5), sha1, sha256
Signed-off-by: Kamil Jerabek <kjerabek(a)redhat.com>
---
Changes in
v2: * removed whitespaces and static thresholds
---
.../phase3/ipsec_esp_ah_comp.README | 98 ++++
.../regression_tests/phase3/ipsec_esp_ah_comp.py | 568 +++++++++++++++++++++
.../regression_tests/phase3/ipsec_esp_ah_comp.xml | 50 ++
3 files changed, 716 insertions(+)
create mode 100644 recipes/regression_tests/phase3/ipsec_esp_ah_comp.README
create mode 100644 recipes/regression_tests/phase3/ipsec_esp_ah_comp.py
create mode 100644 recipes/regression_tests/phase3/ipsec_esp_ah_comp.xml
diff --git a/recipes/regression_tests/phase3/ipsec_esp_ah_comp.README
b/recipes/regression_tests/phase3/ipsec_esp_ah_comp.README
new file mode 100644
index 0000000..5246c33
--- /dev/null
+++ b/recipes/regression_tests/phase3/ipsec_esp_ah_comp.README
@@ -0,0 +1,98 @@
+Topology:
+
+ switch
+ +------+
+ | |
+ | |
+ +-------------+ +-------------+
+ | | | |
+ | | | |
+ | +------+ |
+ | |
+ | |
+ +-+--+ +-+--+
++-------|eth1|------+ +-------|eth1|------+
+| +-+--+ | | +-+--+ |
+| | | |
+| | | |
+| | | |
+| | | |
+| | | |
+| host1 | | host2 |
+| | | |
+| | | |
+| | | |
++-------------------+ +-------------------+
+
+Number of hosts: 2
+Host #1 description:
+ One ethernet device configured with ip addresses:
+ 192.168.99.1/24
+ fc00:1::1/64
+
+Host #2 description:
+ One ethernet device configured with ip addresses:
+ 192.168.100.1/24
+ fc00:2::1/64
+
+Test name:
+ ipsec_esp_ah_comp.py
+Test description:
+ Ping:
+ + count: 10
+ + interval: 0.1s
+ + between ipsec encrypted ethernet interfaces expecting PASS
+ Ping6:
+ + count: 10
+ + interval: 0.1s
+ + between ipsec encrypted ethernet interfaces expecting PASS
+ Netperf:
+ + duration: 60s
+ + TCP_STREAM and UDP_STREAM
+ + ipv4 and ipv6
+ + between ipsec encrypted ethernet interfaces
+ IPsec
+ + tested with esp, ah, comp options together
+ + tested with all listed ciphers and hash functions
+ + ciphers
+ + aes
+ + des
+ + des3_ede
+ + cast5
+ + blowfish
+ + serpent
+ + twofish
+ + hash functions
+ + hmac(md5)
+ + sha1
+ + sha256
+
+PerfRepo integration:
+ First, preparation in PerfRepo is required - you need to create Test objects
+ through the web interface that properly describe the individual Netperf
+ tests that this recipe runs. Don't forget to also add appropriate metrics.
+ For these Netperf tests it's always:
+ * throughput
+ * throughput_min
+ * throughput_max
+ * throughput_deviation
+
+ After that, to enable support for PerfRepo you need to create the file
+ vxlan_remote.mapping and define the following id mappings:
+ tcp_ipv4_id -> to store ipv4 TCP_STREAM Netperf test results, maps to TestUid of a
PerfRepo Test object
+ tcp_ipv6_id -> to store ipv6 TCP_STREAM Netperf test results, maps to TestUid of a
PerfRepo Test object
+ udp_ipv4_id -> to store ipv4 UDP_STREAM Netperf test results, maps to TestUid of a
PerfRepo Test object
+ udp_ipv6_id -> to store ipv4 UDP_STREAM Netperf test results, maps to TestUid of a
PerfRepo Test object
+
+ To enable result comparison agains baselines you need to create a Report in
+ PerfRepo that will store the baseline. Set up the Report to only contain results
+ with the same hash tag and then add a new mapping to the mapping file, with
+ this format:
+ <some_hash> = <report_id>
+
+ The hash value is automatically generated during test execution and added
+ to each result stored in PerfRepo. To get the Report id you need to open
+ that report in our browser and find if in the URL.
+
+ When running this recipe you should also define the 'product_name' alias
+ (e.g. RHEL7) in order to tag the result object in PerfRepo.
diff --git a/recipes/regression_tests/phase3/ipsec_esp_ah_comp.py
b/recipes/regression_tests/phase3/ipsec_esp_ah_comp.py
new file mode 100644
index 0000000..9513ef4
--- /dev/null
+++ b/recipes/regression_tests/phase3/ipsec_esp_ah_comp.py
@@ -0,0 +1,568 @@
+from lnst.Controller.Task import ctl
+from lnst.Controller.PerfRepoUtils import perfrepo_baseline_to_dict
+from lnst.Controller.PerfRepoUtils import netperf_result_template
+
+from lnst.RecipeCommon.ModuleWrap import ping, ping6, netperf
+from lnst.RecipeCommon.IRQ import pin_dev_irqs
+from lnst.RecipeCommon.PerfRepo import generate_perfrepo_comment
+import re
+
+# ---------------------------
+# ALGORITHM AND CIPHER CONFIG
+# ---------------------------
+
+ciphers = {}
+
+def generate_key(length):
+ key = "0x"
+ key = key + length * "0b"
+ return key
+
+ciphers['aes'] = generate_key(16)
+ciphers['des'] = generate_key(8)
+ciphers['des3_ede'] = generate_key(24)
+ciphers['cast5'] = generate_key(16)
+ciphers['blowfish'] = generate_key(56)
+ciphers['serpent'] = generate_key(32)
+ciphers['twofish'] = generate_key(16)
+
+hashes = {}
+
+hashes['hmac(md5)'] = generate_key(16)
+hashes['sha1'] = generate_key(16)
+hashes['sha256'] = generate_key(16)
+
+# these does not work on RHEL6.6
+#hashes['sha384'] = generate_key(16)
+#hashes['sha512'] = generate_key(16)
+
+# ------
+# SETUP
+# ------
+
+mapping_file = ctl.get_alias("mapping_file")
+perf_api = ctl.connect_PerfRepo(mapping_file)
+
+product_name = ctl.get_alias("product_name")
+
+m1 = ctl.get_host("machine1")
+m2 = ctl.get_host("machine2")
+
+m1.sync_resources(modules=["IcmpPing", "Icmp6Ping",
"Netperf", "Custom"])
+m2.sync_resources(modules=["PacketAssert", "IcmpPing",
"Icmp6Ping", "Netperf"])
+
+# ------
+# TESTS
+# ------
+
+ipv = ctl.get_alias("ipv")
+mtu = ctl.get_alias("mtu")
User can specify mtu but it's not used for NIC MTUs. Please add device
mtu setting based on this parameter.
+netperf_duration = int(ctl.get_alias("netperf_duration"))
+nperf_reserve = int(ctl.get_alias("nperf_reserve"))
+nperf_confidence = ctl.get_alias("nperf_confidence")
+nperf_max_runs = int(ctl.get_alias("nperf_max_runs"))
+nperf_cpupin = ctl.get_alias("nperf_cpupin")
+nperf_cpu_util = ctl.get_alias("nperf_cpu_util")
+nperf_num_parallel = int(ctl.get_alias("nperf_num_parallel"))
+nperf_debug = ctl.get_alias("nperf_debug")
+nperf_max_dev = ctl.get_alias("nperf_max_dev")
+nperf_msg_size = ctl.get_alias("nperf_msg_size")
+pr_user_comment = ctl.get_alias("perfrepo_comment")
+ipsec_mode = ctl.get_alias("ipsec_mode")
+
+pr_comment = generate_perfrepo_comment([m1, m2], pr_user_comment)
+
+m1_if = m1.get_interface("eth")
+m2_if = m2.get_interface("eth")
+
+m1_if_name = m1_if.get_devname()
+m2_if_name = m2_if.get_devname()
+
+m1_if_addr = m1_if.get_ip()
+m2_if_addr = m2_if.get_ip()
+
+m1_if_addr6 = m1_if.get_ip(1)
+m2_if_addr6 = m2_if.get_ip(1)
+
+
+# add routing rulez ipv4
+# so the rtr knows where to send traffic destined to remote site
+m1.run("ip route add %s dev %s" % (m2_if_addr, m1_if_name))
+
+# so the rtr knows where to send traffic destined to remote site
+m2.run("ip route add %s dev %s" % (m1_if_addr, m2_if_name))
+
+# add routing rulez ipv6
+# so the rtr knows where to send traffic destined to remote site
+m1.run("ip route add %s dev %s" % (m2_if_addr6, m1_if_name))
+
+# so the rtr knows where to send traffic destined to remote site
+m2.run("ip route add %s dev %s" % (m1_if_addr6, m2_if_name))
+
+if nperf_msg_size is None:
+ nperf_msg_size = 1400
Why this value? We want to have this undefined and let the netperf to use
it's default values if user does not specify this parameter.
Oh, I think I remember. There was a problem with UDP when the netperf
with default size 65kB could not pass any data due to UDP limitation.
I'd say let's have default value set to 16000 to test fragmented
scenario by default.
Please do not forget to include this parameter in perfrepo results!
+
+if ipsec_mode is None:
+ ipsec_mode = "transport"
+
+res = m1.run("rpm -qa iproute", save_output=True)
+if
(res.get_result()["res_data"]["stdout"].find("iproute-2") !=
-1):
+ m1_key="0x"
+else:
+ m1_key=""
+
+res = m2.run("rpm -qa iproute", save_output=True)
+if
(res.get_result()["res_data"]["stdout"].find("iproute-2") !=
-1):
+ m2_key="0x"
+else:
+ m2_key=""
+
+if nperf_cpupin:
+ m1.run("service irqbalance stop")
+ m2.run("service irqbalance stop")
+
+ dev_list = [(m1, m1_phy), (m2, m2_phy)]
+
+ # this will pin devices irqs to cpu #0
+ for m, d in dev_list:
+ pin_dev_irqs(m, d, 0)
+
+nperf_opts = ""
+if nperf_cpupin and nperf_num_parallel == 1:
+ nperf_opts = " -T%s,%s" % (nperf_cpupin, nperf_cpupin)
+
+ctl.wait(15)
+
+def configure_ipsec(ciph_alg, ciph_key, hash_alg, hash_key, ip_version):
+ if ip_version == "ipv4":
+ m1_addr = m1_if_addr
+ m2_addr = m2_if_addr
+ else:
+ m1_addr = m1_if_addr6
+ m2_addr = m2_if_addr6
+
+ # configure policy and state
+ m1.run("ip xfrm policy flush")
+ m1.run("ip xfrm state flush")
+ m2.run("ip xfrm policy flush")
+ m2.run("ip xfrm state flush")
+
+ m1.run("ip xfrm policy add src %s dst %s dir out "\
+ "tmpl src %s dst %s proto comp spi 4 mode %s "\
+ "tmpl src %s dst %s proto esp spi 2 mode %s "\
+ "tmpl src %s dst %s proto ah spi 3 mode %s"
+ % (m1_addr, m2_addr,
+ m1_addr, m2_addr, ipsec_mode,
+ m1_addr, m2_addr, ipsec_mode,
+ m1_addr, m2_addr, ipsec_mode))
+ m1.run("ip xfrm policy add src %s dst %s dir in "\
+ "tmpl src %s dst %s proto comp spi 1 mode %s level use "\
+ "tmpl src %s dst %s proto esp spi 2 mode %s "\
+ "tmpl src %s dst %s proto ah spi 3 mode %s"
+ % (m2_addr, m1_addr,
+ m2_addr, m1_addr, ipsec_mode,
+ m2_addr, m1_addr, ipsec_mode,
+ m2_addr, m1_addr, ipsec_mode))
+
+ m1.run("ip xfrm state add "\
+ "src %s dst %s proto comp spi 4 mode %s "\
+ "comp deflate"\
+ % (m1_addr, m2_addr, ipsec_mode))
+ m1.run("ip xfrm state add "\
+ "src %s dst %s proto comp spi 1 mode %s "\
+ "comp deflate"\
+ % (m2_addr, m1_addr, ipsec_mode))
+
+ m1.run("ip xfrm state add "\
+ "src %s dst %s proto esp spi 2 mode %s "\
+ "enc '%s' %s"\
+ % (m1_addr, m2_addr, ipsec_mode,
+ ciph_alg, ciph_key))
+ m1.run("ip xfrm state add "\
+ "src %s dst %s proto esp spi 2 mode %s "\
+ "enc '%s' %s"\
+ % (m2_addr, m1_addr, ipsec_mode,
+ ciph_alg, ciph_key))
+
+ m1.run("ip xfrm state add "\
+ "src %s dst %s proto ah spi 3 mode %s "\
+ "auth '%s' %s"
+ % (m1_addr, m2_addr, ipsec_mode,
+ hash_alg, hash_key))
+ m1.run("ip xfrm state add "\
+ "src %s dst %s proto ah spi 3 mode %s "\
+ "auth '%s' %s"
+ % (m2_addr, m1_addr, ipsec_mode,
+ hash_alg, hash_key))
+
+
+ # second machine
+ m2.run("ip xfrm policy add src %s dst %s dir out "\
+ "tmpl src %s dst %s proto comp spi 1 mode %s "\
+ "tmpl src %s dst %s proto esp spi 2 mode %s "\
+ "tmpl src %s dst %s proto ah spi 3 mode %s"
+ % (m2_addr, m1_addr,
+ m2_addr, m1_addr, ipsec_mode,
+ m2_addr, m1_addr, ipsec_mode,
+ m2_addr, m1_addr, ipsec_mode))
+ m2.run("ip xfrm policy add src %s dst %s dir in "\
+ "tmpl src %s dst %s proto comp spi 4 mode %s level use "\
+ "tmpl src %s dst %s proto esp spi 2 mode %s "\
+ "tmpl src %s dst %s proto ah spi 3 mode %s"
+ % (m1_addr, m2_addr,
+ m1_addr, m2_addr, ipsec_mode,
+ m1_addr, m2_addr, ipsec_mode,
+ m1_addr, m2_addr, ipsec_mode))
+
+ m2.run("ip xfrm state add "\
+ "src %s dst %s proto comp spi 4 mode %s "\
+ "comp deflate"\
+ % (m1_addr, m2_addr, ipsec_mode))
+ m2.run("ip xfrm state add "\
+ "src %s dst %s proto comp spi 1 mode %s "\
+ "comp deflate"\
+ % (m2_addr, m1_addr, ipsec_mode))
+
+ m2.run("ip xfrm state add "\
+ "src %s dst %s proto esp spi 2 mode %s "\
+ "enc '%s' %s"\
+ % (m1_addr, m2_addr, ipsec_mode,
+ ciph_alg, ciph_key))
+ m2.run("ip xfrm state add "\
+ "src %s dst %s proto esp spi 2 mode %s "\
+ "enc '%s' %s"\
+ % (m2_addr, m1_addr, ipsec_mode,
+ ciph_alg, ciph_key))
+
+ m2.run("ip xfrm state add "\
+ "src %s dst %s proto ah spi 3 mode %s "\
+ "auth '%s' %s"\
+ % (m1_addr, m2_addr, ipsec_mode,
+ hash_alg, hash_key))
+ m2.run("ip xfrm state add "\
+ "src %s dst %s proto ah spi 3 mode %s "\
+ "auth '%s' %s"\
+ % (m2_addr, m1_addr, ipsec_mode,
+ hash_alg, hash_key))
+
+
+for ciph_alg, ciph_key in ciphers.iteritems():
+ for hash_alg, hash_key in hashes.iteritems():
+ if ipv in [ 'ipv4', 'both']:
+ configure_ipsec(ciph_alg, ciph_key, hash_alg, hash_key, "ipv4")
+ # ------
+ # TESTS
+ # ------
Please remove this banner :-) Instead write a short description of what's
being test bellow (non-compressed, compressed check, TCP netperf, UDP netperf).
+ dump = m1.run("tcpdump -i %s -nn -vv" %
m1_if_name, bg=True)
+
+ # ping + PacketAssert
+ assert_mod = ctl.get_module("PacketAssert",
+ options={
+ "interface": m2_if_name,
+ "filter": "ah",
+ "grep_for": [
"AH\(spi=0x00000003",
+ "ESP\(spi=0x00000002"
],
+ "min": 10
+ })
+
+ assert_proc = m2.run(assert_mod, bg=True)
+
+ ping_mod = ctl.get_module("IcmpPing",
+ options={
+ "addr": m2_if_addr,
+ "count": 10,
+ "interval": 0.1})
+
+ ctl.wait(2)
+
+ m1.run(ping_mod)
+
+ ctl.wait(2)
+
+ assert_proc.intr()
+
+ dump.intr()
+
+ m1.run("ip -s xfrm pol")
+ m1.run("ip -s xfrm state")
+
+ # ping test with bigger size to check compression is used
+ pkt_capture = m2.run("tcpdump -i %s ah" % m2_if_name,
+ save_output=True,
+ bg=True)
+ ctl.wait(3)
+ ping_mod.update_options({ "size": int(mtu) - 28 })
Hmm, I think this should be done better. I understand that you copied it
from my test :-) but let's rewrite it.
Let's send ping of the same size as MTU (no magic numbers like 28).
If the resulting packet is equal to MTU then the compression was not
performed and the test must fail.
+ ping_mod.update_options({ "count": 1 })
+ m1.run(ping_mod)
+ ctl.wait(3)
+
+ pkt_capture.intr()
+
+ stdout = pkt_capture.get_result()["res_data"]["stdout"]
+
+ small_ping_fail=0
^^^ actually this is big_ping!! please fix.
+ re_length = ".*length ([0-9]*)"
+ m = re.match(re_length, stdout)
+ if m:
+ pkt_len = int(m.group(1))
+ if pkt_len > (int(mtu) - 28)/2:
+ # failed
+ small_ping_fail=1
+ else:
+ small_ping_fail=1
+
+ comp_mod = ctl.get_module("Custom")
+ if small_ping_fail != 0:
+ comp_mod.update_options({ "fail": "Check of compression
for bigger packets failed" })
+ else:
+ comp_mod.update_options({ "passed": "Check of compression
for bigger packets passed" })
+
+ m1.run(comp_mod)
+
+ # fragmentation of packets bigger than mtu
+ dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True)
+
+ ping_mod.update_options({ "size": 2*int(mtu) })
Actually this fragmentation test won't work, at least for MTU=1500. Since
the compression is in place here the icmp echo request of size 3000 will be
compressed to such small size that the fragmentation does not take place
at all. See tcpdump:
ping 192.168.100.1 -c 10 -i 0.1 -s 3000
14:49:48.232524 IP (tos 0x0, ttl 64, id 41, offset 0, flags [none], proto AH (51),
length 456)
192.168.99.1 > 192.168.100.1: AH(spi=0x00000003,sumlen=16,seq=0xc): IP (tos
0x0, ttl 64, id 40, offset 0, flags [none], proto ESP (50), length 412)
192.168.99.1 > 192.168.100.1: ESP(spi=0x00000002,seq=0xc), length 392
The length is 456 bytes < MTU(1500)!
I've tried 5*mtu and even with that I could not get over it. This is very
tricky so I'd completely remove this part.
>+ ping_mod.update_options({ "count": 10 })
>+
>+ m1.run(ping_mod)
>+ dump.intr()
>+
>+ # prepare PerfRepo result for tcp
>+ result_tcp = perf_api.new_result("tcp_ipv4_id",
>+ "tcp_ipv4_result",
>+ hash_ignore=[
>+ r'kernel_release',
>+ r'redhat_release'])
>+ result_tcp.add_tag(product_name)
>+
>+ if nperf_num_parallel > 1:
>+ result_tcp.add_tag("multithreaded")
>+ result_tcp.set_parameter('num_parallel', nperf_num_parallel)
>+
>+ result_tcp.set_parameter('cipher_alg', ciph_alg)
>+ result_tcp.set_parameter('hash_alg', hash_alg)
>+
>+ baseline = perf_api.get_baseline_of_result(result_tcp)
>+ baseline = perfrepo_baseline_to_dict(baseline)
>+
>+
>+ tcp_res_data = netperf((m1, m1_if, 0, {"scope": 0}),
>+ (m2, m2_if, 0, {"scope": 0}),
>+ client_opts={"duration" :
netperf_duration,
>+ "testname" :
"TCP_STREAM",
>+ "confidence" :
nperf_confidence,
>+ "num_parallel" :
nperf_num_parallel,
>+ "cpu_util" :
nperf_cpu_util,
>+ "runs": nperf_max_runs,
>+ "debug": nperf_debug,
>+ "max_deviation":
nperf_max_dev,
>+ "msg_size" :
nperf_msg_size,
>+ "netperf_opts":
nperf_opts},
>+ baseline = baseline,
>+ timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
>+
>+ netperf_result_template(result_tcp, tcp_res_data)
>+ result_tcp.set_comment(pr_comment)
>+ perf_api.save_result(result_tcp)
>+
>+ # prepare PerfRepo result for udp
>+ result_udp = perf_api.new_result("udp_ipv4_id",
>+ "udp_ipv4_result",
>+ hash_ignore=[
>+ r'kernel_release',
>+ r'redhat_release'])
>+ result_udp.add_tag(product_name)
>+
>+ if nperf_num_parallel > 1:
>+ result_udp.add_tag("multithreaded")
>+ result_udp.set_parameter('num_parallel', nperf_num_parallel)
>+
>+ result_udp.set_parameter('cipher_alg', ciph_alg)
>+ result_udp.set_parameter('hash_alg', hash_alg)
>+
>+ baseline = perf_api.get_baseline_of_result(result_udp)
>+ baseline = perfrepo_baseline_to_dict(baseline)
>+
>+ udp_res_data = netperf((m1, m1_if, 0, {"scope": 0}),
>+ (m2, m2_if, 0, {"scope": 0}),
>+ client_opts={"duration" :
netperf_duration,
>+ "testname" :
"UDP_STREAM",
>+ "confidence" :
nperf_confidence,
>+ "num_parallel" :
nperf_num_parallel,
>+ "cpu_util" :
nperf_cpu_util,
>+ "runs": nperf_max_runs,
>+ "debug": nperf_debug,
>+ "max_deviation":
nperf_max_dev,
>+ "msg_size" :
nperf_msg_size,
>+ "netperf_opts":
nperf_opts},
>+ baseline = baseline,
>+ timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
>+
>+ netperf_result_template(result_udp, udp_res_data)
>+ result_udp.set_comment(pr_comment)
>+ perf_api.save_result(result_udp)
>+
>+ if ipv in [ 'ipv6', 'both']:
>+ configure_ipsec(ciph_alg, ciph_key, hash_alg, hash_key,
"ipv6")
>+ # ------
>+ # TESTS
>+ # ------
>+ dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True)
>+
>+ # ping + PacketAssert
>+ assert_mod = ctl.get_module("PacketAssert",
>+ options={
>+ "interface": m2_if_name,
>+ "filter": "ah",
>+ "grep_for": [
"AH\(spi=0x00000003",
>+
"ESP\(spi=0x00000002" ],
>+ "min": 10
>+ })
>+
>+ assert_proc = m2.run(assert_mod, bg=True)
>+
>+ ping_mod = ctl.get_module("Icmp6Ping",
>+ options={
>+ "addr": m2_if_addr6,
>+ "count": 10,
>+ "interval": 0.1})
>+
>+ ctl.wait(2)
>+
>+ m1.run(ping_mod)
>+
>+ ctl.wait(2)
>+
>+ assert_proc.intr()
>+
>+ dump.intr()
>+
>+ m1.run("ip -s xfrm pol")
>+ m1.run("ip -s xfrm state")
>+
>+ # ping test with bigger size to check compression is used
>+ pkt_capture = m2.run("tcpdump -i %s ah" % m2_if_name,
>+ save_output=True,
>+ bg=True)
>+ ctl.wait(3)
>+ ping_mod.update_options({ "size": int(mtu) - 28 })
+ ping_mod.update_options({ "count": 1 })
+ m1.run(ping_mod)
+ ctl.wait(3)
+
+ pkt_capture.intr()
+
+ stdout = pkt_capture.get_result()["res_data"]["stdout"]
+
+ small_ping_fail=0
+
re_length = ".*length ([0-9]*)"
+ m = re.match(re_length, stdout)
+ if m:
+ pkt_len = int(m.group(1))
+ if pkt_len > (int(mtu) - 28)/2:
+ # failed
+ small_ping_fail=1
+ else:
+ small_ping_fail=1
+
+ comp_mod = ctl.get_module("Custom")
+ if small_ping_fail != 0:
+ comp_mod.update_options({ "fail": "Check of compression
for bigger packets failed" })
+ else:
+ comp_mod.update_options({ "passed": "Check of compression
for bigger packets passed" })
+
+ m1.run(comp_mod)
+
+ # fragmentation of packets bigger than mtu
+ dump = m1.run("tcpdump -i %s -nn -vv" % m1_if_name, bg=True)
+
+ ping_mod.update_options({ "size": 2*int(mtu) })
>+
ping_mod.update_options({ "count": 10 })
>+
>+ m1.run(ping_mod)
>+ dump.intr()
>+
>+ # prepare PerfRepo result for tcp
>+ result_tcp = perf_api.new_result("tcp_ipv6_id",
>+ "tcp_ipv6_result",
>+ hash_ignore=[
>+ r'kernel_release',
>+ r'redhat_release'])
>+ result_tcp.add_tag(product_name)
>+
>+ if nperf_num_parallel > 1:
>+ result_tcp.add_tag("multithreaded")
>+ result_tcp.set_parameter('num_parallel', nperf_num_parallel)
>+
>+ result_tcp.set_parameter('cipher_alg', ciph_alg)
>+ result_tcp.set_parameter('hash_alg', hash_alg)
>+
>+ baseline = perf_api.get_baseline_of_result(result_tcp)
>+ baseline = perfrepo_baseline_to_dict(baseline)
>+
>+
>+ tcp_res_data = netperf((m1, m1_if, 1, {"scope": 0}),
>+ (m2, m2_if, 1, {"scope": 0}),
>+ client_opts={"duration" :
netperf_duration,
>+ "testname" :
"TCP_STREAM",
>+ "confidence" :
nperf_confidence,
>+ "num_parallel" :
nperf_num_parallel,
>+ "cpu_util" :
nperf_cpu_util,
>+ "runs": nperf_max_runs,
>+ "debug": nperf_debug,
>+ "max_deviation":
nperf_max_dev,
>+ "msg_size" :
nperf_msg_size,
>+ "netperf_opts" : nperf_opts
+ "-6"},
Parameter "-6" is not necessary. Actually netperf does not have it.
I believe this is a relict of rewriting the test from iperf to netperf.
Please remove this.
+ baseline = baseline,
+ timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
+
+ netperf_result_template(result_tcp, tcp_res_data)
+ result_tcp.set_comment(pr_comment)
+ perf_api.save_result(result_tcp)
+
+ # prepare PerfRepo result for udp
+ result_udp = perf_api.new_result("udp_ipv6_id",
+ "udp_ipv6_result",
+ hash_ignore=[
+ r'kernel_release',
+ r'redhat_release'])
+ result_udp.add_tag(product_name)
+
+ if nperf_num_parallel > 1:
+ result_udp.add_tag("multithreaded")
+ result_udp.set_parameter('num_parallel', nperf_num_parallel)
+
+ result_udp.set_parameter('cipher_alg', ciph_alg)
+ result_udp.set_parameter('hash_alg', hash_alg)
+
+ baseline = perf_api.get_baseline_of_result(result_udp)
+ baseline = perfrepo_baseline_to_dict(baseline)
+
+ udp_res_data = netperf((m1, m1_if, 1, {"scope": 0}),
+ (m2, m2_if, 1, {"scope": 0}),
+ client_opts={"duration" : netperf_duration,
+ "testname" :
"UDP_STREAM",
+ "confidence" :
nperf_confidence,
+ "num_parallel" :
nperf_num_parallel,
+ "cpu_util" : nperf_cpu_util,
+ "runs": nperf_max_runs,
+ "debug": nperf_debug,
+ "max_deviation":
nperf_max_dev,
+ "msg_size" : nperf_msg_size,
+ "netperf_opts" : nperf_opts +
"-6"},
+ baseline = baseline,
+ timeout = (netperf_duration +
nperf_reserve)*nperf_max_runs)
+
+ netperf_result_template(result_udp, udp_res_data)
+ result_udp.set_comment(pr_comment)
+ perf_api.save_result(result_udp)
+
+m1.run("ip xfrm policy flush")
+m1.run("ip xfrm state flush")
+m2.run("ip xfrm policy flush")
+m2.run("ip xfrm state flush")
+
+if nperf_cpupin:
+ m1.run("service irqbalance start")
+ m2.run("service irqbalance start")
diff --git a/recipes/regression_tests/phase3/ipsec_esp_ah_comp.xml
b/recipes/regression_tests/phase3/ipsec_esp_ah_comp.xml
new file mode 100644
index 0000000..c7c8e68
--- /dev/null
+++ b/recipes/regression_tests/phase3/ipsec_esp_ah_comp.xml
@@ -0,0 +1,50 @@
+<lnstrecipe>
+ <define>
+ <alias name="ipv" value="both" />
+ <alias name="mtu" value="1450" />
Why 1450?
+ <alias name="netperf_duration"
value="60" />
+ <alias name="nperf_reserve" value="20" />
+ <alias name="nperf_confidence" value="99,5" />
+ <alias name="nperf_max_runs" value="5"/>
+ <alias name="nperf_num_parallel" value="1"/>
+ <alias name="nperf_debug" value="0"/>
+ <alias name="nperf_max_dev" value="20%"/>
+ <alias name="mapping_file"
value="ipsec_transport_esp_ah_comp.mapping"/>
+ <alias name="net_1" value="192.168.99"/>
+ <alias name="net6_1" value="fc00:1::"/>
+ <alias name="net_2" value="192.168.100"/>
+ <alias name="net6_2" value="fc00:2::"/>
+ <alias name="driver" value=""/>
+ </define>
+ <network>
+ <host id="machine1">
+ <interfaces>
+ <eth id="eth" label="localnet">
+ <params>
+ <param name="driver" value="{$driver}"/>
+ </params>
^^^^ tabs here. Please indent properly.
+ <addresses>
+ <address value="{$net_1}.1/24"/>
+ <address value="{$net6_1}1/64"/>
+ </addresses>
+ </eth>
+ </interfaces>
+ </host>
+ <host id="machine2">
+ <interfaces>
+ <eth id="eth" label="localnet">
+ <params>
+ <param name="driver" value="{$driver}"/>
+ </params>
^^^^ tabs here. Please indent properly.
>+ <addresses>
>+ <address value="{$net_2}.1/24"/>
>+ <address value="{$net6_2}1/64"/>
>+ </addresses>
>+ </eth>
>+ </interfaces>
>+ </host>
>+ </network>
>+
>+ <task python="ipsec_esp_ah_comp.py"/>
>+
>+</lnstrecipe>
>--
>2.5.5
>_______________________________________________
>LNST-developers mailing list -- lnst-developers(a)lists.fedorahosted.org
>To unsubscribe send an email to lnst-developers-leave(a)lists.fedorahosted.org