README for PF-1.4: Static GUEv1 Decapsulation over decap subnet range, decap TTL and DSCP behavior test #4178
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,260 @@ | ||||||
| # PF-1.4: Static GUEv1 Decapsulation over decap subnet range, decap TTL and DSCP behavior test | ||||||
nupkanoi marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
|
|
||||||
| ## Summary | ||||||
|
|
||||||
| This is to test the functionality of decapsulation of static GUEv1 to IPv4 or IPv6 payload ([GUE Variant 1](https://datatracker.ietf.org/doc/html/draft-ietf-intarea-gue-09#section-4)). These tests verify the use case of IPv4 and IPv6 encapsulated traffic in IPv4 GUE tunnel. | ||||||
|
|
||||||
| The tests validate that the DUT performs the following action- | ||||||
|
|
||||||
| - Decapsulate the outer (UDPoIPv4) headers of GUE packets destined to the locally configured decap IPv4 over DECAP subnet range and matching UDP port. | ||||||
| - Decapsulate the packet only if it matches the locally configured decap IPv4 address/addresses and matching UDP port port/port-range. | ||||||
| - Post decapsulation the DUT should | ||||||
| - Maintain the inner TTL (do not copy outer TTL to the inner TTL) | ||||||
| - Maintain the inner DSCP (do not copy outer DSCP to inner DSCP) | ||||||
| - Post decapsulation, the inner TTL value will be decremented before egressing to next-hop | ||||||
| - Traffic not subject to match criteria will be forwared using the traditional IP forwarding. | ||||||
|
|
||||||
| Comprehensive GUEv1 decapsulation and ECMP hashing test for GUE flows with IPv4|UDP outer header on decapsulation node is documented in [#4135](https://github.com/openconfig/featureprofiles/pull/4135) | ||||||
|
|
||||||
| ## Procedure | ||||||
|
|
||||||
| ### Test environment setup | ||||||
|
|
||||||
| * Create the following connections: | ||||||
| * DUT has ingress and egress port connected to the ATE. | ||||||
|
|
||||||
| ```mermaid | ||||||
| graph LR; | ||||||
| A[ATE:Port1] --Ingress--> B[Port1:DUT:Port2];B --Egress--> C[Port2:ATE]; | ||||||
| ``` | ||||||
|
|
||||||
| ### ATE Configuration | ||||||
|
|
||||||
| * ATE Port 1: Generates GUE-encapsulated traffic | ||||||
| * ATE Port 2: Receives traffic | ||||||
|
|
||||||
| * ATE Port 1 hosted prefixes: | ||||||
|
|
||||||
| * ATE-Port1 IPV4 address = ATE-P1-Address | ||||||
| * Additional Source Address = IPV4-SRC1 | ||||||
| * Additional Source Address = IPV6-SRC1 | ||||||
|
|
||||||
| * ATE Port 2 hosted prefixes: | ||||||
|
|
||||||
| * ATE-Port2 IPV4 address = ATE-P2-Address | ||||||
| * Additional destination address = IPV4-DST1 | ||||||
| * Additional destination address = IPV6-DST1 | ||||||
|
|
||||||
| * ATE Port 1 generates below flow types: | ||||||
|
|
||||||
| | Flow type | Payload Description | Header Level | Source IP | Destination IP | Source Port | Destination Port | DSCP | TTL | | ||||||
| |-------------|-----------------------|----------------|------------------|--------------------------------------------------------------------------------------------|-----------------------------------------|----------------------------------------------|------|-----| | ||||||
| | Flow type#1 | IP+UDP+IPv4 Payload | Outer IPGUE | ATE-P1-Address | Randomized: DECAP-DST_1/32, DECAP-DST_2/32, DECAP-DST_3/32, DECAP-DST_4/32 | Varies depending on the application | 6081 (DUT configured decap port) | 35 | 70 | | ||||||
| | | | Inner IPv4 | IPV4-SRC1 | IPV4-DST1 | N/A | N/A | 32 | 50 | | ||||||
| | Flow type#2 | IP+UDP+IPv6 Payload | Outer IPGUE | ATE-P1-Address | Randomized: DECAP-DST_1/32, DECAP-DST_2/32, DECAP-DST_3/32, DECAP-DST_4/32 | Varies depending on the application | 6081 (DUT configured decap port) | 35 | 70 | | ||||||
| | | | Inner IPv6 | IPV6-SRC1 | IPV6-DST1 | N/A | N/A | 32 | 50 | | ||||||
| | Flow type#3 | IP+UDP+IPv4 Payload | Outer IPGUE | ATE-P1-Address | Randomized: DECAP-DST_1/32, DECAP-DST_2/32, DECAP-DST_3/32, DECAP-DST_4/32 | Varies depending on the application | 6085 (DUT unconfigured port) | 35 | 70 | | ||||||
| | | | Inner IPv4 | IPV4-SRC1 | IPV4-DST1 | N/A | N/A | 32 | 50 | | ||||||
| | Flow type#4 | IP+UDP+IPv6 Payload | Outer IPGUE | ATE-P1-Address | Randomized: DECAP-DST_1/32, DECAP-DST_2/32, DECAP-DST_3/32, DECAP-DST_4/32 | Varies depending on the application | 6085 (DUT unconfigured port) | 35 | 70 | | ||||||
| | | | Inner IPv6 | IPV6-SRC1 | IPV6-DST1 | N/A | N/A | 32 | 50 | | ||||||
| | Flow type#5 | IP+UDP+IPv4 Payload | Outer IPGUE | ATE-P1-Address | ATE-P2-Address | Varies depending on the application | 6081 (DUT configured decap port) | 35 | 70 | | ||||||
| | | | Inner IPv4 | IPV4-SRC1 | IPV4-DST1 | N/A | N/A | 32 | 50 | | ||||||
| | Flow type#6 | IP+UDP+IPv6 Payload | Outer IPGUE | ATE-P1-Address | ATE-P2-Address | Varies depending on the application | 6081 (DUT configured decap port) | 35 | 70 | | ||||||
| | | | Inner IPv6 | IPV6-SRC1 | IPV6-DST1 | N/A | N/A | 32 | 50 | | ||||||
|
|
||||||
| * ATE Port 2 receives below flow/packet types: | ||||||
|
|
||||||
| | RX-Flow-type | Payload Type | Header Level | Source IP | Destination IP | DSCP | TTL | UDP Source Port | UDP Destination Port | | ||||||
| |----------------|---------------------|----------------|------------------|------------------|------|-----|-----------------------------------------|----------------------------------------------| | ||||||
| | RX-Flow-type#1 | IPv4 Payload | N/A | IPV4-SRC1 | IPV4-DST1 | 32 | 49 | N/A | N/A | | ||||||
| | RX-Flow-type#2 | IPv6 Payload | N/A | IPV6-SRC1 | IPV6-DST1 | 32 | 49 | N/A | N/A | | ||||||
| | RX-Flow-type#5 | IP+UDP+IPv4 Payload | Outer IPGUE | ATE-P1-Address | ATE-P2-Address | 35 | 68 | Varies depending on the application | 6081 (configured non-default on DUT) | | ||||||
| | | | Inner IPv4 | IPV4-SRC1 | IPV4-DST1 | 32 | 50 | N/A | N/A | | ||||||
| | RX-Flow-type#6 | IP+UDP+IPv6 Payload | Outer IPGUE | ATE-P1-Address | ATE-P2-Address | 35 | 68 | Varies depending on the application | 6081 (configured non-default on DUT) | | ||||||
| | | | Inner IPv6 | IPV6-SRC1 | IPV6-DST1 | 32 | 50 | N/A | N/A | | ||||||
|
|
||||||
| ### DUT Configuration | ||||||
|
|
||||||
| 1. Interfaces: Configure all DUT ports as singleton IP interfaces towards the ATE ports | ||||||
|
|
||||||
| 2. GUE Decapsulation: | ||||||
| * Configure a Loopback address with DECAP-DST_3/32 address | ||||||
| * Configure the DUT as GUEv1 decapsulator with below fields: | ||||||
| - DECAP-DST-SUBNET/30 as decapsulation subnet-range | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| - DECAP-DST/32 is one of the IP prefix from DECAP-DST-SUBNET/30 | ||||||
| - Do not enable copying TTL bits from outer to inner header post decapsulation | ||||||
|
There was a problem hiding this comment. Today OC only has a single config leaf for The definition of this leaf is ambiguous as to what should happen to the payload's fields on decapsulation. Reading this test, it looks like we only want one option: don't modify the payload's TTL or DSCP based on the outer header. Simply decrement the inner packet TTL on decap and preserve DSCP. We could update the OC to clarify. However, I think there is a logic issue here. I would expect to decrement the inner packet TTL at the encap node, not decap. Why encap a packet on ingress at the encap node which has TTL=1, send it across the network and then drop it at the decap node because the TTL was exceeded? In addition, how will the decap node send a TTL exceeded message back to the source? There was a problem hiding this comment. Ack. I spoke to Dan on updating the OC for decapsulation. In regards to TTL = 0 being after decapsulation, this is consistent with RFC 2003, if the inner packet's Time-to-Live (TTL) reaches 0 after being decapsulated and decremented, the decapsulator node will drop the packet. In such cases, the decapsulator is responsible for sending a Time Exceeded message back to the encapsulator, which in turn forwards this message to the original sender of the packet. Please refer to the relevant section of RFC 2003 for details. |
||||||
| - Use single UDP destination port 6081 for both IPv4 and IPv6 payload type | ||||||
| * Configure static routes for destination IPV4-DST2 and IPV6-DST2 towards ATE Port 2 | ||||||
| * Configure the UDP decap destination port as 6081 | ||||||
|
There was a problem hiding this comment. This is redundant to line 86 above https://github.com/openconfig/featureprofiles/pull/4178/files#diff-e5956eca55ce603152d1d2a717707b75ec9740dfe7edd4e430213d3de4085b24R86 There was a problem hiding this comment. ack. removed the redundant text |
||||||
|
|
||||||
| * DECAP-DST-SUBNET/30 subnet comprises of below IP prefixes: | ||||||
| - DECAP-DST_1/32 | ||||||
| - DECAP-DST_2/32 | ||||||
| - DECAP-DST_3/32 | ||||||
| - DECAP-DST_4/32 | ||||||
|
|
||||||
| * DUT hosted IPv4 prefixes: | ||||||
| * Loopback Address = DECAP-DST_3/32 | ||||||
|
There was a problem hiding this comment. Would you want to have the DUT with more than one loopback address in the decap range? There was a problem hiding this comment. DUT will have only one IP address from the DECAP range. I have updated the DUT configuration to be generating and advertising this aggregate range |
||||||
|
|
||||||
| ### Test Procedure | ||||||
| Traffic: | ||||||
| - Generate the applicable GUE-encapsulated flow from ATE Port 1 | ||||||
| - Sent 1000 packets at the 10% of the line rate. | ||||||
| - Keep the frame size Internet Mix. | ||||||
|
|
||||||
|
|
||||||
| ### PF-1.4.1: GUE Decapsulation of inner IPv4 traffic over DECAP subnet range | ||||||
| - Push DUT configuration | ||||||
| - Initiate traffic flow type#1 | ||||||
| Verification: | ||||||
| - The outer header destination IP of the traffic falls within the configured decap range (DECAP-DST-SUBNET/30) | ||||||
| - The outer header destination port of the traffic (UDP 6081) matches the configured non-default UDP decap port criteria | ||||||
| - The DUT will decapsulate the outer header and perform the lookup based on the inner IP address | ||||||
| - The TTL bits will not be copied to the inner header | ||||||
| - The inner header TTL value will be decremented by 1 | ||||||
| - The inner packet's DSCP value (32) will be preserved | ||||||
| - The DUT will forward the traffic towards ATE Port 2 | ||||||
| - The relevant DUT counters will reflect 1,000,000 decapsulated packets | ||||||
| - ATE Port 2 receives 1000 packets structured as RX-Flow-type#2 | ||||||
|
There was a problem hiding this comment. If the DUT only has one loopback in the range, and the flow sends to all addresses, won't the DUT get approximately 1/3 of the 1,000 packets? There was a problem hiding this comment. I have updated the topology implementation and configuration section for DUT to be generating and advertising this aggregate range, so that it attracts traffic for all IP addresses in the mentioned range |
||||||
| - No packet loss should be observed | ||||||
|
|
||||||
| ### PF-1.4.2: GUE Decapsulation of inner IPv6 traffic over DECAP subnet range | ||||||
| - Push DUT configuration. | ||||||
| - Initiate traffic flow type#2 | ||||||
| Verification: | ||||||
| - The outer header destination IP of the traffic falls within the configured decap range (DECAP-DST-SUBNET/30) | ||||||
| - The outer header destination port of the traffic (UDP 6081) matches the configured non-default UDP decap port criteria | ||||||
| - The DUT will decapsulate the outer header and perform the lookup based on the inner IP address | ||||||
| - The TTL bits will not be copied to the inner header | ||||||
| - The inner header TTL value will be decremented by 1 | ||||||
| - The inner packet's DSCP value (32) will be preserved | ||||||
| - The DUT will forward the traffic towards ATE Port 2 | ||||||
| - The relevant DUT counters will reflect 1,000,000 decapsulated packets | ||||||
| - ATE Port 2 receives 1000 packets structured as RX-Flow-type#4 | ||||||
| - No packet loss should be observed | ||||||
|
|
||||||
| ### PF-1.4.3: GUE Decapsulation of inner IPv4 traffic using non-default and unconfigured GUE UDP port (Negative). | ||||||
| - Push DUT configuration. | ||||||
| - Initiate traffic flow type#3 | ||||||
| Verification: | ||||||
| - The outer header destination IP of the traffic falls within the DECAP-DST-SUBNET/30 range | ||||||
| - The outer header destination UDP port (6085) of the traffic is not configured for decapsulation, therefore it does not match the decapsulation criteria. | ||||||
| - The DUT should not decapsulate these packets. Packets should be dropped since no specific drop rule exists for unmatched GUE | ||||||
|
There was a problem hiding this comment. I think the packets will be dropped due to no-route. ie: since the policy-forwarding rule doesn't match the packet, then the next-step is for the DUT to lookup the destination. Since that is the loopback address, the packet will be sent to the device controller/CPU. What should happen in this case? There was a problem hiding this comment. You have a point. I updated this section. PTAL |
||||||
| - The DUT decapsulation counters should not increment for this flow | ||||||
| - The drop counters will reflect the packets to 1000 | ||||||
|
There was a problem hiding this comment. Please specific which drop counters as OC paths |
||||||
| - 100% packet loss should be observed on ATE Port 2 for RX-Flow-type equivalent | ||||||
|
|
||||||
| ### PF-1.4.4: GUE Decapsulation of inner IPv6 traffic using non-default and unconfigured GUE UDP port (Negative). | ||||||
| - Push DUT configuration. | ||||||
| - Initiate traffic flow type#4 | ||||||
| Verification: | ||||||
| - The outer header destination IP of the traffic falls within the DECAP-DST-SUBNET/30 range | ||||||
| - The outer header destination UDP port (6085) of the traffic is not configured for decapsulation, therefore it does not match the decapsulation criteria. | ||||||
| - The DUT should not decapsulate these packets. Packets should be dropped since no specific drop rule exists for unmatched GUE | ||||||
| - The DUT decapsulation counters should not increment for this flow | ||||||
| - The drop counters will reflect the packets to 1000 | ||||||
|
|
||||||
| - 100% packet loss should be observed on ATE Port 2 for RX-Flow-type equivalent | ||||||
|
|
||||||
| ### PF-1.4.5: Inner IPV4 GUE Pass-through (Negative) | ||||||
| - Push DUT configuration. | ||||||
| - Initiate traffic flow type#5 | ||||||
| Verification: | ||||||
| - The outer header destination UDP port (6081) matches a configured decap port | ||||||
| - The outer header destination IP (ATE-P2-Address) of the traffic does not fall within the configured decap range (DECAP-DST-SUBNET/30), therefore it does not match the decapsulation criteria for the destination IP | ||||||
| - The DUT will not decapsulate the outer header. Instead, it will perform a lookup based on the outer destination IP address and forward the packets as standard IP traffic | ||||||
| - ATE Port 2 receives 1000 packets structured as RX-Flow-type#7 (original GUE encapsulated packets, outer TTL decremented by DUT) | ||||||
| - No packet loss should be observed for this flow | ||||||
|
|
||||||
| ### PF-1.4.6: Inner IPV6 GUE Pass-through (Negative) | ||||||
| - Push DUT configuration. | ||||||
| - Initiate traffic flow type#6 | ||||||
| Verification: | ||||||
| - The outer header destination UDP port (6081) matches a configured decap port | ||||||
| - The outer header destination IP (ATE-P2-Address) of the traffic does not fall within the configured decap range (DECAP-DST-SUBNET/30), therefore it does not match the decapsulation criteria for the destination IP | ||||||
| - The DUT will not decapsulate the outer header. Instead, it will perform a lookup based on the outer destination IP address and forward the packets as standard IP traffic | ||||||
| - ATE Port 2 receives 1000 packets structured as RX-Flow-type#8 (original GUE encapsulated packets, outer TTL decremented by DUT) | ||||||
| - No packet loss should be observed | ||||||
|
|
||||||
| ## Canonical OpenConfig for GUEv1 Decapsulation configuration | ||||||
| TODO: decap policy to be updated by https://github.com/openconfig/public/pull/1288 | ||||||
|
|
||||||
| ```json | ||||||
| { | ||||||
| "network-instances": { | ||||||
| "network-instance": { | ||||||
| "config": { | ||||||
| "name": "DEFAULT" | ||||||
| }, | ||||||
| "name": "DEFAULT", | ||||||
| "policy-forwarding": { | ||||||
| "policies": { | ||||||
| "policy": [ | ||||||
| { | ||||||
| "config": { | ||||||
| "policy-id": "decap-policy" | ||||||
| }, | ||||||
| "rules": { | ||||||
| "rule": [ | ||||||
| { | ||||||
| "sequence-id": 1, | ||||||
| "config": { | ||||||
| "sequence-id": 1 | ||||||
| }, | ||||||
| "ipv4": { | ||||||
| "config": { | ||||||
| "destination-address-prefix-set": "dst_prefix", | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| "protocol": "IP_UDP" | ||||||
| } | ||||||
| }, | ||||||
| "transport": { | ||||||
| "config": { | ||||||
| "destination-port": 6080 | ||||||
| } | ||||||
| } | ||||||
| "action": { | ||||||
| "decapsulate-gue": true | ||||||
| }, | ||||||
| }, | ||||||
| ] | ||||||
| } | ||||||
| } | ||||||
| ] | ||||||
| } | ||||||
| } | ||||||
| } | ||||||
| } | ||||||
| } | ||||||
| ``` | ||||||
|
|
||||||
|
|
||||||
| ## OpenConfig Path and RPC Coverage | ||||||
|
|
||||||
| ```yaml | ||||||
|
|
||||||
| # paths: | ||||||
|
|
||||||
| /network-instances/network-instance/policy-forwarding/policies/policy/config/policy-id: | ||||||
| /network-instances/network-instance/policy-forwarding/policies/policy/rules/rule/config/ipv4/config/destination-address-prefix-set: | ||||||
| /network-instances/network-instance/policy-forwarding/policies/policy/rules/rule/config/ipv4/config/protocol: | ||||||
| /network-instances/network-instance/policy-forwarding/policies/policy/rules/rule/transport/config/destination-port: | ||||||
| /network-instances/network-instance/policy-forwarding/policies/policy/rules/rule/action/decapsulate-gue: | ||||||
|
|
||||||
| # telemetry | ||||||
| openconfig-interfaces/interfaces/interface/state/counters/out-pkts: | ||||||
| openconfig-interfaces/interfaces/interface/state/counters/out-unicast-pkts: | ||||||
| openconfig-network-instance/network-instances/network-instance/policy-forwarding/policies/policy/rules/rule/state/matched-pkts: | ||||||
| openconfig-network-instance/network-instances/network-instance/policy-forwarding/policies/policy/rules/rule/state/matched-octets: | ||||||
|
|
||||||
| rpcs: | ||||||
| gnmi: | ||||||
| gNMI.Set: | ||||||
| union_replace: true | ||||||
| replace: true | ||||||
| gNMI.Subscribe: | ||||||
| on_change: true | ||||||
| ``` | ||||||
|
|
||||||
| ## Required DUT platform | ||||||
|
|
||||||
| * Specify the minimum DUT-type: | ||||||
| * FFF - fixed form factor | ||||||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please move to folder:
feature/policy_forwarding/decapsulation/otg_tests/ip_guev1_static_decap_subnet_range/README.md
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
done