[doc]: Macsec test plan #4885

Pterosaur · 2021-12-31T14:13:12Z

Description of PR

Summary:
Fixes # (issue)

Type of change

Bug fix
Testbed and Framework(new/improvement)
Test case(new/improvement)

Back port request

201911

Approach

What is the motivation for this PR?

This is a doc for MACsec test plan

How did you do it?

How did you verify/test it?

Any platform specific information?

Supported testbed topology if it's a new test case?

Documentation

Signed-off-by: Ze Gan <[email protected]> Signed-off-by: Ze Gan <[email protected]>

Signed-off-by: Ze Gan <[email protected]>

…o macsec_platform Signed-off-by: Ze Gan <[email protected]>

Signed-off-by: Ze Gan <[email protected]>

sacnaik · 2022-02-24T20:12:25Z

docs/testplan/MACsec-test-plan.md

+.....       injected link
+*****       protected link
+VM<->DUT    up link
+PTF<->DUT   down link


This is specific to T0 topology. Incase of T2 the downlink can go to another VM. Is there a plan to cover test that part? where unprotected traffic goes from T1 node to T2 and T2 sends encrypted traffic to T3 ?

I have a test case that send a unprotected traffic from PTF, and DUT will forward the packets to VM0(MACsec enabled VM). Does this case cover that you mentioned?
I believe in the most time, the T2 is a larger scale topo than the current testbed topology(T0). We are truly working on building that larger topology that will be a hybrid mode(vSONiC mixed with cEOS) for lesser resource consumption.

sacnaik · 2022-02-24T20:14:09Z

docs/testplan/MACsec-test-plan.md

+    | :-------------: | :-------------: | :------------: | :----------: |
+    |                 |                 |     enable     |     true     |
+    |  cipher_suite   |   GCM-AES-128   |  cipher_suite  | GCM-AES-128  |
+    |  cipher_suite   |   GCM-AES-256   |  cipher_suite  | GCM-AES-256  |


Need an update for XPN cipher suite in this table.

Thanks for your suggestion, added it.

sacnaik · 2022-02-24T20:49:54Z

docs/testplan/MACsec-test-plan.md

+- Verify macsec packet flow where the Ingress and Egress ports are on different Linecards.
+   - TODO add expected behavior
+
+### Testcase : Scale tests


Can power consumption test be added when macsec enabled?

I'm not familiar about the power consumption test, how can we test it? is it possible to monitor this index?

sacnaik · 2022-02-24T20:51:41Z

docs/testplan/MACsec-test-plan.md

+
+#### Macsec enabled on all interfaces and the DUT is rebooted
+
+- Check the macsec docker comes up and macsec sessions are established.


Any test coverage for counters and stats?

Yes, I needed it. I added a section for testing counters and stats and will fill it later.

sacnaik · 2022-02-24T20:55:13Z

docs/testplan/MACsec-test-plan.md

+
+    3. Send a set of above packet on the down link of DUT
+    4. The target VM should receive at least one expected above packet
+    5. In the injected port of PTF, we should get at least one expected packet encapsulated by MACsec


Can SA counters used to verify the encrypted packet?

I think it's not easy to directly be used to verify the encrypted packet because there are many others traffic (BGP, LLDP and etc. )on the wire so that I don't know what the exact SA counters that should be.

sacnaik · 2022-02-24T20:56:33Z

docs/testplan/MACsec-test-plan.md

+
+- Check MKA session
+
+    1. Get the MKA session by `ip macsec show`


ip macsec show works only for Linux based macsec. It would be good to mention macsec show SONiC CLI for hardware based macsec.

Thanks for this suggestion, Rephrased it.

Signed-off-by: Ze Gan <[email protected]>

judyjoseph · 2022-03-02T06:20:44Z

docs/testplan/MACsec-test-plan.md

+
+#### Link flap on an interface with macsec configured
+
+- MKA session can be recovered from the link flap if the port comes back up in < 6 secs (MKA lietime)


Test for both local and remote interface down/up.

judyjoseph · 2022-03-02T06:27:46Z

docs/testplan/MACsec-test-plan.md

+- Configure macsec on the member interface of a Portchannel which is already in oper UP state. There is only one member interface.
+    - Expect the portchannel to remain oper UP if the mka session establishment happens within 3*30sec, assuming LACP is in slow mode.
+    - Expect the portchannel to go down if time taken for mka session establishment is > 3*30sec.
+        - Portchannel interface goes oper UP after the MKA session is established


Add a case where the portchannel member is removed from the portchannel, add/remove IP address. Add the interface back to portchannel with macsec enabled. Check the behaviour

Signed-off-by: Ze Gan <[email protected]>

Summary: Fixes # (issue) Need the PR: sonic-net/sonic-buildimage#8554  - [ ] Bug fix - [ ] Testbed and Framework(new/improvement) - [x] Test case(new/improvement) This PR includes the basic test, control plane and data plane, for MACsec. - Control plane 1. Check the control plane processes, wpa_supplicant, can running 2. Check the related entries in APP_DB 3. To virtual switch, Check the mka session by iproute2 - Data Plane 1. Check the traffic from down link to up link 2. Check the traffic from a neighbor device to others Build testbed of SONiC neighbor devices Please refer this document https://github.com/Azure/sonic-mgmt/blob/master/docs/testbed/README.testbed.VsSetup.md to 1setup your environment. the neighbor devices should be SONiC with the **latest image** and the vm_type should choose `vsonic` ``` ./testbed-cli.sh -m veos_vtb -n 4 -k vsonic start-vms server_1 password.txt ./testbed-cli.sh -t vtestbed.csv -m veos_vtb -k vsonic add-topo vms-kvm-t0 password.txt ./testbed-cli.sh -t vtestbed.csv -m veos_vtb deploy-mg vms-kvm-t0 veos_vtb password.txt ``` Verify health ``` ./run_tests.sh -u -n vms-kvm-t0 -d vlab-01 -c test_nbr_health.py -f vtestbed.csv -i veos_vtb -e "--neighbor_type=sonic --skip_sanity --disable_loganalyzer" ``` Run MACsec Test ``` ./run_tests.sh -u -n vms-kvm-t0 -d vlab-01 -c macsec/test_macsec.py -f vtestbed.csv -i veos_vtb -e "--neighbor_type=sonic --skip_sanity --disable_loganalyzer" ``` You should get ``` === Running tests in groups === /usr/local/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py:44: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release. from cryptography.exceptions import InvalidSignature ============================================================================================= test session starts ============================================================================================== platform linux2 -- Python 2.7.17, pytest-4.6.5, py-1.11.0, pluggy-0.13.1 -- /usr/bin/python cachedir: .pytest_cache metadata: {'Python': '2.7.17', 'Platform': 'Linux-5.4.0-37-generic-x86_64-with-Ubuntu-18.04-bionic', 'Packages': {'py': '1.11.0', 'pytest': '4.6.5', 'pluggy': '0.13.1'}, 'Plugins': {u'repeat': u'0.9.1', u'ordering': u'0.6', u'ansible': u'2.2.2', u'xdist': u'1.28.0', u'al lure-pytest': u'2.8.22', u'html': u'1.22.1', u'forked': u'1.3.0', u'metadata': u'1.11.0'}} ansible: 2.8.12 rootdir: /data/sonic-mgmt_sonic_vm_topology/tests, inifile: pytest.ini plugins: forked-1.3.0, xdist-1.28.0, repeat-0.9.1, metadata-1.11.0, html-1.22.1, allure-pytest-2.8.22, ordering-0.6, ansible-2.2.2 collecting ... ['conf-name', 'group-name', 'topo', 'ptf_image_name', 'ptf', 'ptf_ip', 'ptf_ipv6', 'server', 'vm_base', 'dut', 'inv_name', 'auto_recover', 'comment'] Finished testbed info generating. /usr/local/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py:44: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release. from cryptography.exceptions import InvalidSignature collecting 0 items ['conf-name', 'group-name', 'topo', 'ptf_image_name', 'ptf', 'pt f_ip', 'ptf_ipv6', 'server', 'vm_base', 'dut', 'inv_name', 'auto_recover', 'comment'] Finished testbed info generating. collected 40 items macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-128-security-true] PASSED [ 2%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-128-true] PASSED [ 5%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-128-true] PASSED [ 7%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-128-security-true] PASSED [ 10%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-128-security-true] PASSED [ 12%] macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-128-security-false] PASSED [ 15%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-128-false] PASSED [ 17%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-128-false] PASSED [ 20%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-128-security-false] PASSED [ 22%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-128-security-false] PASSED [ 25%] macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-256-security-false] PASSED [ 27%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-256-false] PASSED [ 30%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-256-false] PASSED [ 32%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-256-security-false] PASSED [ 35%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-256-security-false] PASSED [ 37%] macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-256-security-true] PASSED [ 40%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-256-true] PASSED [ 42%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-256-true] PASSED [ 45%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-256-security-true] PASSED [ 47%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-256-security-true] PASSED [ 50%] macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-XPN-128-security-false] PASSED [ 52%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-XPN-128-false] PASSED [ 55%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-XPN-128-false] PASSED [ 57%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-XPN-128-security-false] PASSED [ 60%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-XPN-128-security-false] PASSED [ 62%] macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-XPN-128-security-true] PASSED [ 65%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-XPN-128-true] PASSED [ 67%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-XPN-128-true] PASSED [ 70%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-XPN-128-security-true] PASSED [ 72%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-XPN-128-security-true] PASSED [ 75%] macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-XPN-256-security-false] PASSED [ 77%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-XPN-256-false] PASSED [ 80%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-XPN-256-false] PASSED [ 82%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-XPN-256-security-false] PASSED [ 85%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-XPN-256-security-false] PASSED [ 87%] macsec/test_macsec.py::TestControlPlane::test_wpa_supplicant_processes[GCM-AES-XPN-256-security-true] PASSED [ 90%] macsec/test_macsec.py::TestControlPlane::test_appl_db[security-GCM-AES-XPN-256-true] PASSED [ 92%] macsec/test_macsec.py::TestControlPlane::test_mka_session[security-GCM-AES-XPN-256-true] PASSED [ 95%] macsec/test_macsec.py::TestDataPlane::test_server_to_neighbor[GCM-AES-XPN-256-security-true] PASSED [ 97%] macsec/test_macsec.py::TestDataPlane::test_neighbor_to_neighbor[GCM-AES-XPN-256-security-true] PASSED [100%] ``` Tested in Virtual Switch and Arista 7280 T0 #4885

Signed-off-by: Ze Gan <[email protected]>

Pterosaur and others added 2 commits December 17, 2021 00:20

Init MACsec test plan

9b7481d

Signed-off-by: Ze Gan <[email protected]> Signed-off-by: Ze Gan <[email protected]>

Update doc

9c1fdd1

Signed-off-by: Ze Gan <[email protected]>

Pterosaur requested review from wangxin and yxieca as code owners December 31, 2021 14:13

Pterosaur added 3 commits January 6, 2022 16:19

Add rekey

fcb19bc

Signed-off-by: Ze Gan <[email protected]>

update doc

dc1dbd4

Signed-off-by: Ze Gan <[email protected]>

update doc

2b9af2c

Signed-off-by: Ze Gan <[email protected]>

Pterosaur force-pushed the macsec_platform branch 2 times, most recently from 5df2880 to 1a61439 Compare January 6, 2022 17:07

update doc

d41f0a6

Signed-off-by: Ze Gan <[email protected]>

Pterosaur force-pushed the macsec_platform branch from 1a61439 to d41f0a6 Compare January 7, 2022 00:55

Pterosaur mentioned this pull request Feb 7, 2022

[testcase]MACsec basic test #3571

Merged

3 tasks

Pterosaur marked this pull request as draft February 7, 2022 08:05

Add more testcases

97c095e

Signed-off-by: Ze Gan <[email protected]>

Pterosaur requested a review from judyjoseph February 8, 2022 04:27

judyjoseph and others added 13 commits February 8, 2022 20:16

Update MACsec-test-plan.md

da7fb76

Polish

aca48ff

Signed-off-by: Ze Gan <[email protected]>

Merge branch 'macsec_platform' of github.com:Pterosaur/sonic-mgmt int…

5a56438

…o macsec_platform Signed-off-by: Ze Gan <[email protected]>

Polish

5321df3

Signed-off-by: Ze Gan <[email protected]>

Update MACsec-test-plan.md

66ce4f2

Update MACsec-test-plan.md

ecf5360

Add struction to setup MACsec testbed

c26797d

Signed-off-by: Ze Gan <[email protected]>

Rename rekey section

7a9196a

Signed-off-by: Ze Gan <[email protected]>

Rename rekey section

22a6994

Signed-off-by: Ze Gan <[email protected]>

Update rekey test plan

4279dfe

Signed-off-by: Ze Gan <[email protected]>

Update MACsec-test-plan.md

a644498

Update MACsec-test-plan.md

a061323

Polish doc

291d418

Signed-off-by: Ze Gan <[email protected]>

sacnaik reviewed Feb 24, 2022

View reviewed changes

Pterosaur added 2 commits February 25, 2022 13:11

Rephrase

da31f24

Signed-off-by: Ze Gan <[email protected]>

Rephrase

f57727c

Signed-off-by: Ze Gan <[email protected]>

Pterosaur marked this pull request as ready for review March 2, 2022 04:00

judyjoseph reviewed Mar 2, 2022

View reviewed changes

Add more test

562915a

Signed-off-by: Ze Gan <[email protected]>

Pterosaur added 2 commits March 29, 2022 11:01

Update testcases status

3cacd6f

Signed-off-by: Ze Gan <[email protected]>

Polish doc

56a83a5

Signed-off-by: Ze Gan <[email protected]>

Pterosaur force-pushed the macsec_platform branch from f2304e3 to 56a83a5 Compare June 6, 2022 08:14

Pterosaur requested a review from judyjoseph June 6, 2022 11:32

jimmyzhai approved these changes Jun 7, 2022

View reviewed changes

Pterosaur merged commit 3657ab6 into sonic-net:master Jun 7, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[doc]: Macsec test plan #4885

[doc]: Macsec test plan #4885

Pterosaur commented Dec 31, 2021 •

edited

Loading

sacnaik Feb 24, 2022

Pterosaur Feb 28, 2022

sacnaik Feb 24, 2022

Pterosaur Feb 28, 2022

sacnaik Feb 24, 2022

Pterosaur Feb 28, 2022

sacnaik Feb 24, 2022

Pterosaur Feb 28, 2022

sacnaik Feb 24, 2022

Pterosaur Feb 28, 2022 •

edited

Loading

sacnaik Feb 24, 2022

Pterosaur Feb 28, 2022

judyjoseph Mar 2, 2022

judyjoseph Mar 2, 2022


		#### Macsec enabled on all interfaces and the DUT is rebooted

		- Check the macsec docker comes up and macsec sessions are established.


		- Check MKA session

		1. Get the MKA session by `ip macsec show`


		#### Link flap on an interface with macsec configured

		- MKA session can be recovered from the link flap if the port comes back up in < 6 secs (MKA lietime)

[doc]: Macsec test plan #4885

[doc]: Macsec test plan #4885

Conversation

Pterosaur commented Dec 31, 2021 • edited Loading

Description of PR

Type of change

Back port request

Approach

What is the motivation for this PR?

How did you do it?

How did you verify/test it?

Any platform specific information?

Supported testbed topology if it's a new test case?

Documentation

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Pterosaur Feb 28, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Pterosaur commented Dec 31, 2021 •

edited

Loading

Pterosaur Feb 28, 2022 •

edited

Loading