def test_rule_install(self):
"""
Adds a policy to a subscriber. Verifies that flows are properly
installed in enforcement and enforcement stats.
Assert:
Policy classification flows installed in enforcement
Policy match flows installed in enforcement_stats
"""
fake_controller_setup(self.enforcement_controller,
self.enforcement_stats_controller)
imsi = 'IMSI001010000000013'
sub_ip = '192.168.128.74'
flow_list = [
FlowDescription(match=FlowMatch(ipv4_dst='45.10.0.0/25',
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
policy = PolicyRule(id='rule1', priority=3, flow_list=flow_list)
self.service_manager.session_rule_version_mapper.update_version(
imsi, 'rule1')
version = \
self.service_manager.session_rule_version_mapper.get_version(
imsi, 'rule1')
""" Setup subscriber, setup table_isolation to fwd pkts """
self._static_rule_dict[policy.id] = policy
sub_context = RyuDirectSubscriberContext(
imsi, sub_ip, self.enforcement_controller, self._main_tbl_num,
self.enforcement_stats_controller).add_static_rule(policy.id)
# =========================== Verification ===========================
rule_num = self.enforcement_stats_controller._rule_mapper \
.get_or_create_rule_num(policy.id)
enf_query = FlowQuery(self._main_tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
FlowMatch(ipv4_dst='45.10.0.0/25',
direction=FlowMatch.UPLINK)),
cookie=rule_num)
es_query = FlowQuery(self._scratch_tbl_num,
self.testing_controller,
match=MagmaMatch(imsi=encode_imsi(imsi),
reg2=rule_num,
rule_version=version),
cookie=rule_num)
# Verifies that 1 flow is installed in enforcement and 2 flows are
# installed in enforcement stats, one for uplink and one for downlink.
flow_verifier = FlowVerifier([
FlowTest(enf_query, 0, flow_count=1),
FlowTest(es_query, 0, flow_count=2),
], lambda: None)
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with sub_context, flow_verifier, snapshot_verifier:
pass
flow_verifier.verify()
def test_traffic_flows(self):
"""
Attach the tunnel flows with UE IP address and
send GTP and ARP traffic.
"""
# Need to delete all default flows in table 0 before
# install the specific flows test case.
self.test_detach_default_tunnel_flows()
# Attach the tunnel flows towards UE.
seid1 = 5000
self.classifier_controller.add_tunnel_flows(65525, 1, 1000,
"192.168.128.30",
self.EnodeB_IP, seid1)
# Create a set of packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
eth = Ether(dst=self.MAC_1, src=self.MAC_2)
ip = IP(src=self.Dst_nat, dst='192.168.128.30')
o_udp = UDP(sport=2152, dport=2152)
i_udp = UDP(sport=1111, dport=2222)
i_tcp = TCP(seq=1, sport=1111, dport=2222)
i_ip = IP(src='192.168.60.142', dst=self.EnodeB_IP)
arp = ARP(hwdst=self.MAC_1,
hwsrc=self.MAC_2,
psrc=self.Dst_nat,
pdst='192.168.128.30')
gtp_packet_udp = eth / ip / o_udp / GTP_U_Header(
teid=0x1, length=28, gtp_type=255) / i_ip / i_udp
gtp_packet_tcp = eth / ip / o_udp / GTP_U_Header(
teid=0x1, length=68, gtp_type=255) / i_ip / i_tcp
arp_packet = eth / arp
# Check if these flows were added (queries should return flows)
flow_queries = [
FlowQuery(self._tbl_num,
self.testing_controller,
match=MagmaMatch(tunnel_id=1, in_port=32768)),
FlowQuery(self._tbl_num,
self.testing_controller,
match=MagmaMatch(ipv4_dst='192.168.128.30'))
]
# =========================== Verification ===========================
# Verify 5 flows installed for classifier table (3 pkts matched)
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), 3, 5),
FlowTest(flow_queries[0], 0, 1),
], lambda: wait_after_send(self.testing_controller))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with flow_verifier, snapshot_verifier:
pkt_sender.send(gtp_packet_udp)
pkt_sender.send(gtp_packet_tcp)
pkt_sender.send(arp_packet)
flow_verifier.verify()
def test_subscriber_restrict_policy(self):
"""
Add restrict policy to subscriber, send 4096 packets
Assert:
Packets are properly matched with the 'restrict_match' policy
Send /20 (4096) packets, match /16 (256) packets
"""
fake_controller_setup(self.gy_controller)
imsi = 'IMSI010000000088888'
sub_ip = '192.168.128.74'
flow_list1 = [
FlowDescription(match=FlowMatch(
ip_dst=convert_ipv4_str_to_ip_proto('8.8.8.0/24'),
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
policies = [
VersionedPolicy(
rule=PolicyRule(id='restrict_match',
priority=2,
flow_list=flow_list1),
version=1,
)
]
pkts_matched = 256
pkts_sent = 4096
# ============================ Subscriber ============================
sub_context = RyuDirectSubscriberContext(
imsi, sub_ip, self.gy_controller,
self._tbl_num).add_policy(policies[0])
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub_context.cfg).build_requests(), self.testing_controller)
pkt_sender = ScapyPacketInjector(self.IFACE)
packet = IPPacketBuilder()\
.set_ip_layer('8.8.8.8', sub_ip)\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.build()
flow_query = FlowQuery(self._tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
flow_list1[0].match))
# =========================== Verification ===========================
# Verify aggregate table stats, subscriber 1 'simple_match' pkt count
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller),
pkts_sent),
FlowTest(flow_query, pkts_matched)
], lambda: wait_after_send(self.testing_controller))
snapshot_verifier = SnapshotVerifier(self,
self.BRIDGE,
self.service_manager,
include_stats=False)
with isolator, sub_context, flow_verifier, snapshot_verifier:
pkt_sender.send(packet)
def test_add_two_subscribers(self):
"""
Add UE MAC flows for two subscribers
"""
imsi_1 = 'IMSI010000000088888'
imsi_2 = 'IMSI010000000099999'
other_mac = '5e:cc:cc:b1:aa:aa'
# Add subscriber with UE MAC address """
self.ue_mac_controller.add_ue_mac_flow(imsi_1, self.UE_MAC_1)
self.ue_mac_controller.add_ue_mac_flow(imsi_2, self.UE_MAC_2)
# Create a set of packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
# Only send downlink as the pkt_sender sends pkts from in_port=LOCAL
downlink_packet1 = EtherPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.build()
downlink_packet2 = EtherPacketBuilder() \
.set_ether_layer(self.UE_MAC_2, other_mac) \
.build()
# Check if these flows were added (queries should return flows)
flow_queries = [
FlowQuery(
self._tbl_num,
self.testing_controller,
match=MagmaMatch(eth_dst=self.UE_MAC_1),
),
FlowQuery(
self._tbl_num,
self.testing_controller,
match=MagmaMatch(eth_dst=self.UE_MAC_2),
),
]
# =========================== Verification ===========================
# Verify 5 flows installed and 2 total pkts matched (one for each UE)
flow_verifier = FlowVerifier(
[
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), 2,
5)
] + [FlowTest(query, 1, 1) for query in flow_queries],
lambda: wait_after_send(self.testing_controller),
)
snapshot_verifier = SnapshotVerifier(
self,
self.BRIDGE,
self.service_manager,
)
with flow_verifier, snapshot_verifier:
pkt_sender.send(downlink_packet1)
pkt_sender.send(downlink_packet2)
flow_verifier.verify()
def test_no_match(self):
"""
No match test, checks that packets are not matched when
the there is no match to the ip and direction in the blacklist.
Assert:
Both packets are not matched
Ip match flows are added
"""
# Set up subscribers
sub = SubContextConfig('IMSI001010000000013', '192.168.128.74',
self._tbl_num)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(sub).build_requests(),
self.testing_controller,
)
# Set up packets. The directions of the packets are opposite of the
# installed match flow, so there should not matches.
pkt_sender = ScapyPacketInjector(self.BRIDGE)
packets = [
self._build_default_ip_packet(self.OUTBOUND_TEST_IP, sub.ip),
self._build_default_ip_packet(sub.ip, self.INBOUND_TEST_IP),
]
# Check if these flows were added (queries should return flows)
outbound_flow_queries = [
FlowQuery(self._tbl_num, self.testing_controller,
match=MagmaMatch(eth_type=ether_types.ETH_TYPE_IP,
direction=Direction.OUT,
ipv4_dst=self.INBOUND_TEST_IP)),
FlowQuery(self._tbl_num, self.testing_controller,
match=MagmaMatch(eth_type=ether_types.ETH_TYPE_IP,
direction=Direction.IN,
ipv4_src=self.OUTBOUND_TEST_IP)),
]
# =========================== Verification ===========================
# packets are not matched, ip match flows installed
flow_verifier = FlowVerifier(
[
FlowTest(
FlowQuery(self._tbl_num, self.testing_controller), 2),
] + [FlowTest(query, 0, flow_count=1) for query in
outbound_flow_queries],
lambda: wait_after_send(
self.testing_controller)
)
with isolator, flow_verifier:
for packet in packets:
pkt_sender.send(packet)
flow_verifier.verify()
assert_bridge_snapshot_match(self,
self.BRIDGE,
self.service_manager)
def test_passthrough_rules(self):
"""
Add UE MAC flows for two subscribers
"""
imsi_1 = 'IMSI010000000088888'
other_mac = '5e:cc:cc:b1:aa:aa'
# Add subscriber with UE MAC address """
self.ue_mac_controller.add_ue_mac_flow(imsi_1, self.UE_MAC_1)
# Create a set of packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
# Only send downlink as the pkt_sender sends pkts from in_port=LOCAL
downlink_packet1 = EtherPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.build()
dhcp_packet = UDPPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.set_ip_layer('151.42.41.122', '1.1.1.1') \
.set_udp_layer(67, 68) \
.build()
dns_packet = UDPPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.set_ip_layer('151.42.41.122', '1.1.1.1') \
.set_udp_layer(53, 32795) \
.build()
# Check if these flows were added (queries should return flows)
flow_queries = [
FlowQuery(self._tbl_num,
self.testing_controller,
match=MagmaMatch(eth_dst=self.UE_MAC_1))
]
# =========================== Verification ===========================
# Verify 8 flows installed for ue_mac table (3 pkts matched)
# 4 flows installed for inout (3 pkts matched)
# 2 fliws installed (2 pkts matches)
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), 3, 8),
FlowTest(FlowQuery(self._ingress_tbl_num, self.testing_controller),
3, 4),
FlowTest(FlowQuery(self._egress_tbl_num, self.testing_controller),
2, 2),
FlowTest(flow_queries[0], 3, 4),
], lambda: wait_after_send(self.testing_controller))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with flow_verifier, snapshot_verifier:
pkt_sender.send(downlink_packet1)
pkt_sender.send(dhcp_packet)
pkt_sender.send(dns_packet)
flow_verifier.verify()
def test_inbound_ip_match(self):
"""
Inbound ip match test, checks that packets are properly matched when
the inbound traffic matches an ip in the blocklist.
Assert:
Both packets are matched
Ip match flows are added
"""
# Set up subscribers
sub = SubContextConfig('IMSI001010000000013', '192.168.128.74',
default_ambr_config, self._tbl_num)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(sub).build_requests(),
self.testing_controller,
)
# Set up packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
packets = [
self._build_default_ip_packet(self.INBOUND_TEST_IP, sub.ip),
self._build_default_ip_packet(self.BOTH_DIR_TEST_IP, sub.ip),
]
# Check if these flows were added (queries should return flows)
inbound_flow_queries = [
FlowQuery(self._tbl_num, self.testing_controller,
match=MagmaMatch(eth_type=ether_types.ETH_TYPE_IP,
direction=Direction.OUT,
ipv4_dst=self.INBOUND_TEST_IP)),
FlowQuery(self._tbl_num, self.testing_controller,
match=MagmaMatch(eth_type=ether_types.ETH_TYPE_IP,
direction=Direction.OUT,
ipv4_dst=self.BOTH_DIR_TEST_IP)),
]
# =========================== Verification ===========================
# packets matched, ip match flows installed
flow_verifier = FlowVerifier(
[
FlowTest(
FlowQuery(self._tbl_num, self.testing_controller), 2),
] + [FlowTest(query, 1, flow_count=1) for query in
inbound_flow_queries],
lambda: wait_after_send(
self.testing_controller)
)
with isolator, flow_verifier:
for packet in packets:
pkt_sender.send(packet)
flow_verifier.verify()
assert_bridge_snapshot_match(self,
self.BRIDGE,
self.service_manager)
def test_subscriber_policy(self):
"""
Add policy to subscriber, send 4096 packets
Assert:
Packets are properly matched with the 'simple_match' policy
Send /20 (4096) packets, match /16 (256) packets
"""
imsi = 'IMSI010000000088888'
sub_ip = '192.168.128.74'
flow_list1 = [FlowDescription(
match=FlowMatch(
ipv4_dst='45.10.0.0/24', direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
policies = [
PolicyRule(id='simple_match', priority=2, flow_list=flow_list1)
]
pkts_matched = 256
pkts_sent = 4096
self._static_rule_dict[policies[0].id] = policies[0]
# ============================ Subscriber ============================
sub_context = RyuDirectSubscriberContext(
imsi, sub_ip, self.enforcement_controller, self._tbl_num
).add_static_rule(policies[0].id)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(sub_context.cfg)
.build_requests(),
self.testing_controller
)
pkt_sender = ScapyPacketInjector(self.IFACE)
packet = IPPacketBuilder()\
.set_ip_layer('45.10.0.0/20', sub_ip)\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.build()
flow_query = FlowQuery(
self._tbl_num, self.testing_controller,
match=flow_match_to_magma_match(flow_list1[0].match)
)
# =========================== Verification ===========================
# Verify aggregate table stats, subscriber 1 'simple_match' pkt count
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller),
pkts_sent),
FlowTest(flow_query, pkts_matched)
], lambda: wait_after_send(self.testing_controller))
with isolator, sub_context, flow_verifier:
pkt_sender.send(packet)
flow_verifier.verify()
def test_traffic_paging_flow(self):
"""
Add paging flow in table 0
"""
# Need to delete all default flows in table 0 before
# install the specific flows test case.
self.classifier_controller._delete_all_flows()
ue_ip_addr = "192.168.128.30"
self.classifier_controller.install_paging_flow(
IPAddress(version=IPAddress.IPV4,
address=ue_ip_addr.encode('utf-8')), 200, True)
# Create a set of packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
eth = Ether(dst=self.MAC_1, src=self.MAC_2)
ip = IP(src=self.Dst_nat, dst='192.168.128.30')
o_udp = UDP(sport=2152, dport=2152)
i_udp = UDP(sport=1111, dport=2222)
i_tcp = TCP(seq=1, sport=1111, dport=2222)
i_ip = IP(src='192.168.60.142', dst=self.EnodeB_IP)
gtp_packet_udp = eth / ip / o_udp / GTP_U_Header(
teid=0x1, length=28, gtp_type=255) / i_ip / i_udp
gtp_packet_tcp = eth / ip / o_udp / GTP_U_Header(
teid=0x1, length=68, gtp_type=255) / i_ip / i_tcp
# Check if these flows were added (queries should return flows)
flow_queries = [
FlowQuery(self._tbl_num,
self.testing_controller,
match=MagmaMatch(tunnel_id=1, in_port=32768)),
FlowQuery(self._tbl_num,
self.testing_controller,
match=MagmaMatch(ipv4_dst='192.168.128.30'))
]
# =========================== Verification ===========================
# Verify 2 flows installed for classifier table (2 pkts matched)
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), 2, 2),
], lambda: wait_after_send(self.testing_controller))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with flow_verifier, snapshot_verifier:
pkt_sender.send(gtp_packet_udp)
pkt_sender.send(gtp_packet_tcp)
flow_verifier.verify()
def test_delete_one_subscriber(self):
"""
Delete one of the existing subscribers
"""
imsi_1 = 'IMSI010000000088888'
other_mac = '5e:cc:cc:b1:aa:aa'
# Delete subscriber with UE MAC_1 address
self.ue_mac_controller.delete_ue_mac_flow(imsi_1, self.UE_MAC_1)
# Create a set of packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
# Only send downlink as the pkt_sender sends pkts from in_port=LOCAL
removed_ue_packet = EtherPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.build()
remaining_ue_packet = EtherPacketBuilder() \
.set_ether_layer(self.UE_MAC_2, other_mac) \
.build()
# Ensure the first query doesn't match anything
# And the second query still does
flow_queries = [
FlowQuery(self._tbl_num,
self.testing_controller,
match=MagmaMatch(eth_dst=self.UE_MAC_1)),
FlowQuery(self._tbl_num,
self.testing_controller,
match=MagmaMatch(eth_dst=self.UE_MAC_2))
]
# =========================== Verification ===========================
# Verify 9 flows installed and 1 total pkt matched
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), 1, 9),
FlowTest(flow_queries[0], 0, 0),
FlowTest(flow_queries[1], 1, 4),
], lambda: wait_after_send(self.testing_controller))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with flow_verifier, snapshot_verifier:
pkt_sender.send(removed_ue_packet)
pkt_sender.send(remaining_ue_packet)
flow_verifier.verify()
def test_invalid_subscriber(self):
"""
Try to apply an invalid policy to a subscriber, should log and error
Assert:
Only 1 flow gets added to the table (drop flow)
"""
fake_controller_setup(self.enforcement_controller)
imsi = 'IMSI000000000000001'
sub_ip = '192.168.128.45'
flow_list = [
FlowDescription(match=FlowMatch(
ip_src=convert_ipv4_str_to_ip_proto('9999.0.0.0/24')),
action=FlowDescription.DENY)
]
policy = PolicyRule(id='invalid', priority=2, flow_list=flow_list)
invalid_sub_context = RyuDirectSubscriberContext(
imsi, sub_ip, self.enforcement_controller,
self._tbl_num).add_dynamic_rule(policy)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
invalid_sub_context.cfg).build_requests(),
self.testing_controller)
flow_query = FlowQuery(self._tbl_num, self.testing_controller)
num_flows_start = len(flow_query.lookup())
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with isolator, invalid_sub_context, snapshot_verifier:
wait_after_send(self.testing_controller)
num_flows_final = len(flow_query.lookup())
self.assertEqual(num_flows_final - num_flows_start, 0)
def packet_sender():
isolators = [
RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub).build_requests(),
self.testing_controller,
) for sub in subs
]
flow_query = FlowQuery(20, self.testing_controller)
pkt_start = sum(flow.packets for flow in flow_query.lookup())
with ExitStack() as es:
for iso in isolators:
es.enter_context(iso)
for packet in packets:
pkt_sender.send(packet, count=count)
wait_after_send(self.testing_controller)
pkt_final = sum(flow.packets for flow in flow_query.lookup())
return pkt_final - pkt_start
def test_rule_reactivation(self):
"""
Adds a policy to a subscriber, deletes it by incrementing the
version, and add it back. Verifies that the usage stats is correctly
reported, the old flows are deleted, and the new flows are installed.
Assert:
UPLINK policy matches 128 packets (*34 = 4352 bytes)
Old flows are deleted
New flows are installed
No other stats are reported
"""
fake_controller_setup(self.enforcement_controller,
self.enforcement_stats_controller)
imsi = 'IMSI001010000000013'
sub_ip = '192.168.128.74'
num_pkts_tx_match = 128
flow_list = [
FlowDescription(match=FlowMatch(ipv4_dst='45.10.0.0/25',
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
policy = PolicyRule(id='rule1', priority=3, flow_list=flow_list)
enf_stat_name = imsi + '|rule1'
self.service_manager.session_rule_version_mapper.update_version(
imsi, 'rule1')
version = \
self.service_manager.session_rule_version_mapper.get_version(
imsi, 'rule1')
""" Setup subscriber, setup table_isolation to fwd pkts """
self._static_rule_dict[policy.id] = policy
sub_context = RyuDirectSubscriberContext(
imsi, sub_ip, self.enforcement_controller, self._main_tbl_num,
self.enforcement_stats_controller).add_static_rule(policy.id)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub_context.cfg).build_requests(), self.testing_controller)
""" Create a packet """
pkt_sender = ScapyPacketInjector(self.IFACE)
packet = IPPacketBuilder() \
.set_ip_layer('45.10.0.0/20', sub_ip) \
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00") \
.build()
# =========================== Verification ===========================
rule_num = self.enforcement_stats_controller._rule_mapper \
.get_or_create_rule_num(policy.id)
enf_query = FlowQuery(self._main_tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
FlowMatch(ipv4_dst='45.10.0.0/25',
direction=FlowMatch.UPLINK)),
cookie=rule_num)
es_old_version_query = FlowQuery(self._scratch_tbl_num,
self.testing_controller,
match=MagmaMatch(
imsi=encode_imsi(imsi),
reg2=rule_num,
rule_version=version),
cookie=rule_num)
es_new_version_query = FlowQuery(self._scratch_tbl_num,
self.testing_controller,
match=MagmaMatch(
imsi=encode_imsi(imsi),
reg2=rule_num,
rule_version=version + 1),
cookie=rule_num)
packet_wait = FlowVerifier([], self._wait_func([enf_stat_name]))
""" Verify that flows are properly deleted """
verifier = FlowVerifier([
FlowTest(es_old_version_query, 0, flow_count=0),
FlowTest(es_new_version_query, num_pkts_tx_match, flow_count=2),
FlowTest(enf_query, num_pkts_tx_match, flow_count=1),
], self._wait_func([enf_stat_name]))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
"""
Send a packet, then deactivate and reactivate the same rule and send a
packet. Wait until it is received by ovs and enf stats.
"""
with isolator, sub_context, verifier, snapshot_verifier:
with packet_wait:
self.enforcement_stats_controller._report_usage.reset_mock()
pkt_sender.send(packet)
self.enforcement_stats_controller._report_usage.reset_mock()
self.service_manager.session_rule_version_mapper. \
update_version(imsi, 'rule1')
self.enforcement_controller.deactivate_rules(imsi, [policy.id])
self.enforcement_controller.activate_rules(imsi, sub_ip,
[policy.id], [])
self.enforcement_stats_controller.activate_rules(
imsi, sub_ip, [policy.id], [])
pkt_sender.send(packet)
verifier.verify()
stats = get_enforcement_stats(
self.enforcement_stats_controller._report_usage.call_args_list)
"""
Verify both packets are reported after reactivation.
"""
self.assertEqual(stats[enf_stat_name].sid, imsi)
self.assertEqual(stats[enf_stat_name].rule_id, "rule1")
self.assertEqual(stats[enf_stat_name].bytes_rx, 0)
# TODO Figure out why this one fails.
#self.assertEqual(stats[enf_stat_name].bytes_tx,
# num_pkts_tx_match * len(packet))
self.assertEqual(len(stats), 1)
def test_two_subscribers(self):
"""
Add 2 subscribers at the same time
Assert:
For subcriber1 the packets are matched to the proper policy
For subcriber2 the packets are matched to the proper policy
The total packet delta in the table is from the above matches
"""
fake_controller_setup(self.enforcement_controller)
pkt_sender = ScapyPacketInjector(self.IFACE)
ip_match = [
FlowDescription(match=FlowMatch(
ip_src=convert_ipv4_str_to_ip_proto('8.8.8.0/24'),
direction=1),
action=1)
]
tcp_match = [
FlowDescription(match=FlowMatch(ip_proto=6,
direction=FlowMatch.DOWNLINK),
action=FlowDescription.DENY)
]
self._static_rule_dict['t'] = PolicyRule(id='t',
priority=2,
flow_list=ip_match)
# =========================== Subscriber 1 ===========================
sub_context1 = RyuDirectSubscriberContext(
'IMSI208950001111111', '192.168.128.5',
self.enforcement_controller, self._tbl_num).add_static_rule('t')
isolator1 = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub_context1.cfg).build_requests(), self.testing_controller)
packet_ip = IPPacketBuilder()\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.set_ip_layer(sub_context1.cfg.ip, '8.8.8.8')\
.build()
s1_pkts_sent = 29
pkts_to_send = [PktsToSend(packet_ip, s1_pkts_sent)]
flow_query1 = FlowQuery(self._tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
ip_match[0].match))
s1 = SubTest(sub_context1, isolator1,
FlowTest(flow_query1, s1_pkts_sent))
# =========================== Subscriber 2 ===========================
sub_context2 = RyuDirectSubscriberContext(
'IMSI911500451242001', '192.168.128.100',
self.enforcement_controller, self._tbl_num).add_dynamic_rule(
PolicyRule(id='qqq', priority=2, flow_list=tcp_match))
isolator2 = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub_context2.cfg).build_requests(), self.testing_controller)
packet_tcp = TCPPacketBuilder()\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.set_ip_layer(sub_context2.cfg.ip, '15.0.0.8')\
.build()
s2_pkts_sent = 18
pkts_to_send.append(PktsToSend(packet_tcp, s2_pkts_sent))
flow_query2 = FlowQuery(self._tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
tcp_match[0].match))
s2 = SubTest(sub_context2, isolator2,
FlowTest(flow_query2, s2_pkts_sent))
# =========================== Verification ===========================
# Verify aggregate table stats, subscriber 1 & 2 flows packet matches
pkts = s1_pkts_sent + s2_pkts_sent
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), pkts),
s1.flowtest_list, s2.flowtest_list
], lambda: wait_after_send(self.testing_controller))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with s1.isolator, s1.context, s2.isolator, s2.context, flow_verifier, \
snapshot_verifier:
for pkt in pkts_to_send:
pkt_sender.send(pkt.pkt, pkt.num)
flow_verifier.verify()
def test_outbound_ip_match(self):
"""
Outbound ip match test, checks that packets are properly matched when
the outbound traffic matches an ip in the blocklist.
Assert:
Both packets are matched
Ip match flows are added
"""
sub = self._setup_subscribers()
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(sub).build_requests(),
self.testing_controller,
)
# Set up packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
packets = [
_build_default_ip_packet(self.MAC_DEST, sub.ip,
self.OUTBOUND_TEST_IP),
_build_default_ip_packet(self.MAC_DEST, sub.ip,
self.BOTH_DIR_TEST_IP),
]
# Check if these flows were added (queries should return flows)
outbound_flow_queries = [
FlowQuery(
self._tbl_num,
self.testing_controller,
match=MagmaMatch(
eth_type=ether_types.ETH_TYPE_IP,
direction=Direction.IN,
ipv4_src=self.OUTBOUND_TEST_IP,
),
),
FlowQuery(
self._tbl_num,
self.testing_controller,
match=MagmaMatch(
eth_type=ether_types.ETH_TYPE_IP,
direction=Direction.IN,
ipv4_src=self.BOTH_DIR_TEST_IP,
),
),
]
# =========================== Verification ===========================
# packets matched, ip match flows installed
flow_verifier = FlowVerifier(
[
FlowTest(
FlowQuery(self._tbl_num, self.testing_controller),
2,
),
] + [
FlowTest(query, 1, flow_count=1)
for query in outbound_flow_queries
],
lambda: wait_after_send(self.testing_controller, ),
)
with isolator, flow_verifier:
for packet in packets:
pkt_sender.send(packet)
flow_verifier.verify()
assert_bridge_snapshot_match(
self,
self.BRIDGE,
self.service_manager,
)
def test_subscriber_two_policies(self):
"""
Add 2 policies to subscriber
Assert:
Packets are properly matched with the 'match' policy
The total packet delta in the table is from the above match
"""
fake_controller_setup(self.enforcement_controller)
imsi = 'IMSI208950000000001'
sub_ip = '192.168.128.74'
flow_list1 = [
FlowDescription(match=FlowMatch(
ip_src=convert_ipv4_str_to_ip_proto('15.0.0.0/24'),
direction=FlowMatch.DOWNLINK),
action=FlowDescription.DENY)
]
flow_list2 = [
FlowDescription(match=FlowMatch(ip_proto=6,
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
policies = [
PolicyRule(id='match', priority=2, flow_list=flow_list1),
PolicyRule(id='no_match', priority=2, flow_list=flow_list2)
]
pkts_sent = 42
self._static_rule_dict[policies[0].id] = policies[0]
self._static_rule_dict[policies[1].id] = policies[1]
# ============================ Subscriber ============================
sub_context = RyuDirectSubscriberContext(imsi, sub_ip,
self.enforcement_controller,
self._tbl_num) \
.add_static_rule(policies[0].id)\
.add_static_rule(policies[1].id)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub_context.cfg).build_requests(), self.testing_controller)
pkt_sender = ScapyPacketInjector(self.IFACE)
packet = IPPacketBuilder()\
.set_ip_layer(sub_ip, '15.0.0.8')\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.build()
flow_query = FlowQuery(self._tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
flow_list1[0].match))
# =========================== Verification ===========================
# Verify aggregate table stats, subscriber 1 'match' rule pkt count
flow_verifier = FlowVerifier([
FlowTest(FlowQuery(self._tbl_num, self.testing_controller),
pkts_sent),
FlowTest(flow_query, pkts_sent)
], lambda: wait_after_send(self.testing_controller))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager)
with isolator, sub_context, flow_verifier, snapshot_verifier:
pkt_sender.send(packet, pkts_sent)
flow_verifier.verify()
def test_ipv4_redirect(self):
"""
Partial redirection test, checks if flows were added properly for ipv4
based redirection.
Assert:
1 Packet is matched
Packet bypass flows are added
Flow learn action is triggered - another flow is added to the table
"""
fake_controller_setup(self.enforcement_controller)
redirect_ip = "54.12.31.42"
imsi = 'IMSI012000000088888'
sub_ip = '192.168.128.74'
flow_list = [FlowDescription(match=FlowMatch())]
policy = VersionedPolicy(
rule=PolicyRule(
id='redir_ip_test', priority=3, flow_list=flow_list,
redirect=RedirectInformation(
support=1,
address_type=0,
server_address=redirect_ip,
),
),
version=1,
)
# ============================ Subscriber ============================
sub_context = RyuDirectSubscriberContext(
imsi, sub_ip, self.enforcement_controller, self._tbl_num,
).add_policy(policy)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(sub_context.cfg)
.build_requests(),
self.testing_controller,
)
pkt_sender = ScapyPacketInjector(self.IFACE)
packet = TCPPacketBuilder()\
.set_tcp_layer(42132, 80, 321)\
.set_tcp_flags("S")\
.set_ip_layer('151.42.41.122', sub_ip)\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.build()
# Check if these flows were added (queries should return flows)
permit_outbound = FlowQuery(
self._tbl_num, self.testing_controller,
match=flow_match_to_magma_match(
FlowMatch(
ip_dst=convert_ipv4_str_to_ip_proto(redirect_ip),
direction=FlowMatch.UPLINK,
),
),
)
permit_inbound = FlowQuery(
self._tbl_num, self.testing_controller,
match=flow_match_to_magma_match(
FlowMatch(
ip_src=convert_ipv4_str_to_ip_proto(redirect_ip),
direction=FlowMatch.DOWNLINK,
),
),
)
learn_action_flow = flow_match_to_magma_match(
FlowMatch(
ip_proto=6, direction=FlowMatch.DOWNLINK,
ip_src=convert_ipv4_str_to_ip_proto(self.BRIDGE_IP_ADDRESS),
ip_dst=convert_ipv4_str_to_ip_proto(sub_ip),
),
)
learn_action_query = FlowQuery(
self._tbl_num, self.testing_controller,
learn_action_flow,
)
# =========================== Verification ===========================
# 1 packet sent, permit rules installed, learn action installed. Since
# the enforcement table is entered via the DPI table and the scratch
# enforcement table, the number of packets handled by the table is 2.
flow_verifier = FlowVerifier(
[
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), 2),
FlowTest(permit_outbound, 0, flow_count=1),
FlowTest(permit_inbound, 0, flow_count=1),
FlowTest(learn_action_query, 0, flow_count=1),
], lambda: wait_after_send(self.testing_controller),
)
with isolator, sub_context, flow_verifier:
pkt_sender.send(packet)
assert_bridge_snapshot_match(
self, self.BRIDGE,
self.service_manager,
)
flow_verifier.verify()
def test_url_redirect(self):
"""
Partial redirection test, checks if flows were added properly for url
based redirection.
Assert:
1 Packet is matched
Packet bypass flows are added
Flow learn action is triggered - another flow is added to the table
"""
fake_controller_setup(self.enforcement_controller)
redirect_ips = ["185.128.101.5", "185.128.121.4"]
self.enforcement_controller._redirect_manager._dns_cache.get(
"about.sha.ddih.org", lambda: redirect_ips, max_age=42)
imsi = 'IMSI010000000088888'
sub_ip = '192.168.128.74'
flow_list = [FlowDescription(match=FlowMatch())]
policy = PolicyRule(id='redir_test',
priority=3,
flow_list=flow_list,
redirect=RedirectInformation(
support=1,
address_type=2,
server_address="http://about.sha.ddih.org/"))
# ============================ Subscriber ============================
sub_context = RyuDirectSubscriberContext(
imsi, sub_ip, self.enforcement_controller,
self._tbl_num).add_dynamic_rule(policy)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub_context.cfg).build_requests(), self.testing_controller)
pkt_sender = ScapyPacketInjector(self.IFACE)
packet = TCPPacketBuilder()\
.set_tcp_layer(42132, 80, 321)\
.set_tcp_flags("S")\
.set_ip_layer('151.42.41.122', sub_ip)\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.build()
# Check if these flows were added (queries should return flows)
permit_outbound, permit_inbound = [], []
for ip in redirect_ips:
permit_outbound.append(
FlowQuery(self._tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
FlowMatch(ipv4_dst=ip,
direction=FlowMatch.UPLINK))))
permit_inbound.append(
FlowQuery(self._tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
FlowMatch(ipv4_src=ip,
direction=FlowMatch.DOWNLINK))))
learn_action_flow = flow_match_to_magma_match(
FlowMatch(ip_proto=6,
direction=FlowMatch.DOWNLINK,
ipv4_src=self.BRIDGE_IP_ADDRESS,
ipv4_dst=sub_ip))
learn_action_query = FlowQuery(self._tbl_num, self.testing_controller,
learn_action_flow)
# =========================== Verification ===========================
# 1 packet sent, permit rules installed, learn action installed. Since
# the enforcement table is entered via the DPI table and the scratch
# enforcement table, the number of packets handled by the table is 2.
flow_verifier = FlowVerifier(
[
FlowTest(FlowQuery(self._tbl_num, self.testing_controller), 2),
FlowTest(learn_action_query, 0, flow_count=1)
] +
[FlowTest(query, 0, flow_count=1) for query in permit_outbound] +
[FlowTest(query, 0, flow_count=1) for query in permit_inbound],
lambda: wait_after_send(self.testing_controller))
with isolator, sub_context, flow_verifier:
pkt_sender.send(packet)
assert_bridge_snapshot_match(self, self.BRIDGE,
self.service_manager)
flow_verifier.verify()
def test_enforcement_restart(self):
"""
Adds rules using the setup feature
1) Empty SetupFlowsRequest
- assert default flows
2) Add 2 imsis, add 2 policies(sub1_rule_temp, sub2_rule_keep),
- assert everything is properly added
3) Same imsis 1 new policy, 1 old (sub2_new_rule, sub2_rule_keep)
- assert everything is properly added
4) Empty SetupFlowsRequest
- assert default flows
"""
fake_controller_setup(
enf_controller=self.enforcement_controller,
enf_stats_controller=self.enforcement_stats_controller,
startup_flow_controller=self.startup_flows_contoller)
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager,
'default_flows')
with snapshot_verifier:
pass
imsi1 = 'IMSI010000000088888'
imsi2 = 'IMSI010000000012345'
sub2_ip = '192.168.128.74'
flow_list1 = [
FlowDescription(match=FlowMatch(ipv4_dst='45.10.0.0/24',
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT),
FlowDescription(match=FlowMatch(ipv4_dst='45.11.0.0/24',
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
flow_list2 = [
FlowDescription(match=FlowMatch(ipv4_dst='10.10.1.0/24',
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
policies1 = [
PolicyRule(id='sub1_rule_temp', priority=2, flow_list=flow_list1),
]
policies2 = [
PolicyRule(id='sub2_rule_keep', priority=3, flow_list=flow_list2)
]
enf_stat_name = [imsi1 + '|sub1_rule_temp', imsi2 + '|sub2_rule_keep']
self.service_manager.session_rule_version_mapper.update_version(
imsi1, 'sub1_rule_temp')
self.service_manager.session_rule_version_mapper.update_version(
imsi2, 'sub2_rule_keep')
setup_flows_request = SetupFlowsRequest(requests=[
ActivateFlowsRequest(sid=SIDUtils.to_pb(imsi1),
dynamic_rules=policies1),
ActivateFlowsRequest(sid=SIDUtils.to_pb(imsi2),
dynamic_rules=policies2),
],
epoch=global_epoch)
fake_controller_setup(
enf_controller=self.enforcement_controller,
enf_stats_controller=self.enforcement_stats_controller,
startup_flow_controller=self.startup_flows_contoller,
setup_flows_request=setup_flows_request)
sub_context = RyuDirectSubscriberContext(imsi2, sub2_ip,
self.enforcement_controller,
self._enforcement_tbl_num)
isolator = RyuDirectTableIsolator(
RyuForwardFlowArgsBuilder.from_subscriber(
sub_context.cfg).build_requests(), self.testing_controller)
pkt_sender = ScapyPacketInjector(self.IFACE)
packets = IPPacketBuilder()\
.set_ip_layer('10.10.1.8/20', sub2_ip)\
.set_ether_layer(self.MAC_DEST, "00:00:00:00:00:00")\
.build()
pkts_sent = 4096
pkts_matched = 256
flow_query = FlowQuery(self._enforcement_tbl_num,
self.testing_controller,
match=flow_match_to_magma_match(
flow_list2[0].match))
flow_verifier = FlowVerifier([
FlowTest(
FlowQuery(self._enforcement_tbl_num, self.testing_controller),
pkts_sent),
FlowTest(flow_query, pkts_matched)
], self._wait_func(enf_stat_name))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager,
'before_restart')
with isolator, flow_verifier, snapshot_verifier:
pkt_sender.send(packets)
flow_verifier.verify()
flow_list1 = [
FlowDescription(match=FlowMatch(ipv4_dst='24.10.0.0/24',
direction=FlowMatch.UPLINK),
action=FlowDescription.PERMIT)
]
policies = [
PolicyRule(id='sub2_new_rule', priority=2, flow_list=flow_list1),
PolicyRule(id='sub2_rule_keep', priority=3, flow_list=flow_list2)
]
self.service_manager.session_rule_version_mapper.update_version(
imsi2, 'sub2_new_rule')
enf_stat_name = [imsi2 + '|sub2_new_rule', imsi2 + '|sub2_rule_keep']
setup_flows_request = SetupFlowsRequest(requests=[
ActivateFlowsRequest(sid=SIDUtils.to_pb(imsi2),
dynamic_rules=policies)
],
epoch=global_epoch)
fake_controller_setup(
enf_controller=self.enforcement_controller,
enf_stats_controller=self.enforcement_stats_controller,
startup_flow_controller=self.startup_flows_contoller,
setup_flows_request=setup_flows_request)
flow_verifier = FlowVerifier([FlowTest(flow_query, pkts_matched)],
self._wait_func(enf_stat_name))
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager,
'after_restart')
with flow_verifier, snapshot_verifier:
pass
fake_controller_setup(
enf_controller=self.enforcement_controller,
enf_stats_controller=self.enforcement_stats_controller,
startup_flow_controller=self.startup_flows_contoller)
snapshot_verifier = SnapshotVerifier(self, self.BRIDGE,
self.service_manager,
'default_flows')
with snapshot_verifier:
pass
def test_passthrough_rules(self):
"""
Add UE MAC flows for two subscribers
"""
imsi_1 = 'IMSI010000000088888'
other_mac = '5e:cc:cc:b1:aa:aa'
cli_ip = '1.1.1.1'
server_ip = '151.42.41.122'
fake_mandatory_controller_setup(self.ingress_controller)
fake_mandatory_controller_setup(self.middle_controller)
fake_mandatory_controller_setup(self.egress_controller)
# Add subscriber with UE MAC address """
self.ue_mac_controller.add_ue_mac_flow(imsi_1, self.UE_MAC_1)
# Create a set of packets
pkt_sender = ScapyPacketInjector(self.BRIDGE)
# Only send downlink as the pkt_sender sends pkts from in_port=LOCAL
downlink_packet1 = EtherPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.build()
dhcp_packet = DHCPPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.set_ip_layer(server_ip, cli_ip) \
.set_udp_layer(67, 68) \
.set_bootp_layer(2, cli_ip, server_ip, other_mac) \
.set_dhcp_layer([("message-type", "ack"), "end"]) \
.build()
dns_packet = UDPPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.set_ip_layer('151.42.41.122', '1.1.1.1') \
.set_udp_layer(53, 32795) \
.build()
arp_packet = ARPPacketBuilder() \
.set_ether_layer(self.UE_MAC_1, other_mac) \
.set_arp_layer('1.1.1.1') \
.set_arp_hwdst(self.UE_MAC_1) \
.set_arp_src(other_mac, '1.1.1.12') \
.build()
# Check if these flows were added (queries should return flows)
flow_queries = [
FlowQuery(
self._tbl_num,
self.testing_controller,
match=MagmaMatch(eth_dst=self.UE_MAC_1),
),
]
# =========================== Verification ===========================
# Verify 3 flows installed for ue_mac table (4 pkts matched)
# 2 flows installed for ingress (4 pkts matched)
# 2 flows installed for egress(3 pkts matches)
flow_verifier = FlowVerifier(
[
FlowTest(
FlowQuery(
self._tbl_num,
self.testing_controller,
),
4,
3,
),
FlowTest(
FlowQuery(
self._ingress_tbl_num,
self.testing_controller,
),
4,
2,
),
FlowTest(
FlowQuery(
self._egress_tbl_num,
self.testing_controller,
),
3,
2,
),
FlowTest(flow_queries[0], 4, 1),
],
lambda: wait_after_send(self.testing_controller),
)
snapshot_verifier = SnapshotVerifier(
self,
self.BRIDGE,
self.service_manager,
)
with flow_verifier, snapshot_verifier:
pkt_sender.send(dhcp_packet)
pkt_sender.send(downlink_packet1)
pkt_sender.send(dns_packet)
hub.sleep(3)
pkt_sender.send(arp_packet)
flow_verifier.verify()
