Upgrading ACL implementation

[groupbasedpolicy.git] / renderers / vpp / src / test / java / org / opendaylight / groupbasedpolicy / renderer / vpp / policy / acl / AclManagerTest.java

diff --git a/renderers/vpp/src/test/java/org/opendaylight/groupbasedpolicy/renderer/vpp/policy/acl/AclManagerTest.java b/renderers/vpp/src/test/java/org/opendaylight/groupbasedpolicy/renderer/vpp/policy/acl/AclManagerTest.java
index 32a58ff30e251da4d8c6926dd654623aab1dd49a..4b618758018a7760c8c682c9176c8022a5a8916c 100644 (file)
--- a/renderers/vpp/src/test/java/org/opendaylight/groupbasedpolicy/renderer/vpp/policy/acl/AclManagerTest.java
+++ b/renderers/vpp/src/test/java/org/opendaylight/groupbasedpolicy/renderer/vpp/policy/acl/AclManagerTest.java
@@ -30,6 +30,7 @@ import org.opendaylight.groupbasedpolicy.util.DataStoreHelper;
 import org.opendaylight.vbd.impl.transaction.VbdNetconfTransaction;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160708.AccessLists;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160708.access.lists.Acl;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.common.rev140421.ContextId;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.renderer.rev151103.renderers.renderer.renderer.policy.configuration.endpoints.AddressEndpointWithLocation;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.renderer.rev151103.renderers.renderer.renderer.policy.configuration.renderer.endpoints.RendererEndpoint;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.renderer.rev151103.renderers.renderer.renderer.policy.configuration.renderer.endpoints.RendererEndpointKey;
@@ -64,7 +65,7 @@ public class AclManagerTest extends TestResources {
     @Test
     public void oneEndpointChanged() {
         List<Acl> acls = processChangedEndpoints(Sets.newHashSet(rendererEndpointKey(l3AddrEp1.getKey())), true);
-        Assert.assertEquals(acls.size(), 6);
+        Assert.assertEquals(6, acls.size());
         acls.forEach(acl -> {
             if (acl.getAclName().contains(VppPathMapper.interfacePathToInterfaceName(NODE1_CONNECTOR_1).get())) {
                 Assert.assertEquals(2 + 4, acl.getAccessListEntries().getAce().size());
@@ -73,10 +74,18 @@ public class AclManagerTest extends TestResources {
             }
         });
         acls = processChangedEndpoints(Sets.newHashSet(rendererEndpointKey(l3AddrEp1.getKey())), false);
-        Assert.assertEquals(acls.size(), 6);
+        Assert.assertEquals(6, acls.size());
         acls.forEach(acl -> {
+            System.out.println("DEBUGX " + acl);
             if (acl.getAclName().contains(VppPathMapper.interfacePathToInterfaceName(NODE1_CONNECTOR_1).get())) {
-                Assert.assertEquals(2, acl.getAccessListEntries().getAce().size());
+                acl.getAccessListEntries().getAce().forEach(ace -> {
+                    System.out.println("DEBUG1 " + ace);
+                });
+                /*
+                 * TODO rules were not removed, entire ACL is removed elsewhere when interface at
+                 * NODE1_CONNECTOR_1 detaches from bridge domain.
+                 */
+                Assert.assertEquals(6, acl.getAccessListEntries().getAce().size());
             } else {
                 Assert.assertEquals(2, acl.getAccessListEntries().getAce().size());
             }
@@ -89,8 +98,7 @@ public class AclManagerTest extends TestResources {
         Assert.assertEquals(acls.size(), 4);
         acls.forEach(acl -> {
             if (acl.getAclName().contains(VppPathMapper.interfacePathToInterfaceName(NODE1_CONNECTOR_1).get())) {
-                // TODO fix so that the following assert is uncomemnted
-                // Assert.assertEquals(2 + 2, acl.getAccessListEntries().getAce().size());
+                 Assert.assertEquals(2 + 4, acl.getAccessListEntries().getAce().size());
             } else {
                 Assert.assertEquals(2 + 2, acl.getAccessListEntries().getAce().size());
             }
@@ -99,11 +107,57 @@ public class AclManagerTest extends TestResources {
         Assert.assertEquals(acls.size(), 4);
         acls.forEach(acl -> {
             if (acl.getAclName().contains(VppPathMapper.interfacePathToInterfaceName(NODE1_CONNECTOR_1).get())) {
+                // Peer is updated 4 rules went to 2.
                 Assert.assertEquals(2, acl.getAccessListEntries().getAce().size());
             } else {
+             // Entire ACL is removed elsewhere -> no update of rules needed.
+                Assert.assertEquals(4, acl.getAccessListEntries().getAce().size());
+            }
+        });
+    }
+
+    /**
+     * Tests DHCP rules configuration. There should be no entries for DHCP servers serving different
+     * subnets, i.e.
+     * hosts should only have rules for accessing DHCP server in their subnet.
+     */
+    @Test
+    public void dhcpDifferentSubnets() {
+        final String ep4Mac = "20:00:00:00:00:02";
+        final String ep4Ip = "20.0.0.2/32";
+        final ContextId l2BdId2 = new ContextId("l2BridgeDomainId2");
+        final String node1Connector4 =
+                "/ietf-interfaces:interfaces/ietf-interfaces:interface[ietf-interfaces:name='nodeConnector4']";
+        final AddressEndpointWithLocation l2DhcpEp = l2AddressEndpointWithLocation(ep4Mac, l2BdId2, ep4Ip, L3_CTX_ID);
+        final AddressEndpointWithLocation l3DhcpEp = appendLocationToEndpoint(
+                l3AddressEndpointWithLocation(ep4Mac, l2BdId2, ep4Ip, L3_CTX_ID), NODE1, node1Connector4);
+        List<AddressEndpointWithLocation> addrEps = createAddressEndpoints();
+        addrEps.add(l2DhcpEp);
+        addrEps.add(l3DhcpEp);
+        List<RendererEndpoint> rEps = new ArrayList<>();
+        // DHCP from different subnet
+        rEps.add(createRendEndpoint(rendererEndpointKey(l3DhcpEp.getKey()), SECURITY_GROUP.SERVER,
+                peerEndpointKey(l3AddrEp2.getKey()), peerEndpointKey(l3AddrEp3.getKey())));
+        // DHCP from local subnet
+        rEps.add(createRendEndpoint(rendererEndpointKey(l3AddrEp1.getKey()), SECURITY_GROUP.SERVER,
+                peerEndpointKey(l3AddrEp2.getKey()), peerEndpointKey(l3AddrEp3.getKey())));
+        rEps.add(createRendEndpoint(rendererEndpointKey(l3AddrEp2.getKey()), SECURITY_GROUP.CLIENT,
+                peerEndpointKey(l3AddrEp1.getKey()), peerEndpointKey(l3DhcpEp.getKey())));
+        rEps.add(createRendEndpoint(rendererEndpointKey(l3AddrEp3.getKey()), SECURITY_GROUP.CLIENT,
+                peerEndpointKey(l3AddrEp1.getKey()), peerEndpointKey(l3DhcpEp.getKey())));
+        ctx = super.createPolicyContext(addrEps, rEps, createRuleGroupsDhcpTest(), createForwarding());
+        List<Acl> acls = processChangedEndpoints(Sets.newHashSet(rendererEndpointKey(l3AddrEp2.getKey())), true);
+        Assert.assertEquals(acls.size(), 6);
+        acls.forEach(acl -> {
+            if (acl.getAclName().contains(VppPathMapper.interfacePathToInterfaceName(node1Connector4).get())) {
                 Assert.assertEquals(2, acl.getAccessListEntries().getAce().size());
+            } else if (acl.getAclName().contains(VppPathMapper.interfacePathToInterfaceName(NODE1_CONNECTOR_1).get())) {
+                Assert.assertEquals(6, acl.getAccessListEntries().getAce().size());
+            } else {
+                Assert.assertEquals(4, acl.getAccessListEntries().getAce().size());
             }
         });
+
     }
 
     /**
@@ -128,7 +182,8 @@ public class AclManagerTest extends TestResources {
             if (acl.getAclName().contains(VppPathMapper.interfacePathToInterfaceName(NODE1_CONNECTOR_1).get())) {
                 Assert.assertEquals(2, acl.getAccessListEntries().getAce().size());
             } else {
-                Assert.assertEquals(2, acl.getAccessListEntries().getAce().size());
+                // Entire ACL is removed elsewhere -> no update of rules needed.
+                Assert.assertEquals(6, acl.getAccessListEntries().getAce().size());
             }
         });
     }