All typedefs and identities should be declared in the module that uses
them unless other modules need them. This change also makes it easier
to work with tools like yanglint and pyang.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unintended leak of Proxy-Authorization header in requests #1
Requests `Session` object does not verify requests after making first request with verify=False #2
This tries to improve on the existing sniffer in a couple of ways:
- In addition to being usable as a context manager, also allow
explicitly starting and stopping the capture.
- Try to synchronize the start of the capture by snooping stderr and
wait for tcpdump to start up. This should eliminate the need for
sleeps before starting to send packets.
- By default, execute a safety sleep when terminating the capture to
ensure that any straggling packets have had time to arrive at their
destination.
By default, ping(1) will use a random ID in the ICMP packet. Allow
setting it to a fixed value instead.
This makes it easy to identify that particular packet in a packet
capture later on.
Very simple tests work (hostname.py), more complex
tests (static_routing.py) failes due to the lack of
model prefix, for example. infix-ip:ipv4 instead of just
ipv4.
We need to fix this before you send your configuration, run
it through libyang for example and get the full model-name.
Since containers managed by docker runs as root, files created in bind
mounted volumes will be owned by root:root. This is a problem for
files generated during test execution, as the calling user does not
have permission to remove them.
Therefore, add a wrapper entrypoint that hooks up an exit handler that
will fixup the permissions before exiting the container.
Partial revert of 23469bbe3b. When running tests in a GitHub action,
we do not want to run as host root user. Therefore, restore podman as
the default runner, but make sure to prefer docker when attaching to
the host network namespace.
When testing in the host's namespace, only docker seems to offer the
required capabilities (due to its daemon/client architecture).
Qeneth tests can still be run in podman. Users will have to install
the docker wrappers for podman to make use of this.
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
- Avoid global variable references in set_static_multicast_filter()
In test cases, it is common that we want to verify that a certain type
of traffic reaches a namespace. This has, up to this point, been
solved by the generic sniffer.Sniffer.
Try to improve the two most common use-cases...
1. Test if a flow reaches a namespace
2. Ensure that a flow does not reach a namespace
...by always exiting as soon as the first packet is received.
This saves time on positive tests, and the synchronous API allows it
to compose well with infamy.parallel().
Support the familiar subprocess.run API, and runsh from netns.py.
This should only be used for debugging, or in the rare instances when
we want to test functionality that is not available via NETCONF.
QEMU systems seem work fine with the 5s timeout, whereas some physical
devices can't quite keep up with that.
Let the slower systems indicate that they need a bit more time without
punishing faster ones with a longer default.
This will let other Infamy submodules tune their behavior based on the
particular test system they are running on.
Attributes are defined by creating graph-global attributes with an
"ix_" prefix.
Rather than setting up and tearing down two identical namespaces,
create it once and use it for the duration of the test. (This is
probably a documentation issue with Infamy: there is no requirement
that test.steps are direct descendants of the test, but until this
point there was no example of this in the source base)
In the process of this, it was also discovered that no positive ping
test was done over v6, so that has been added.
Avoid having log messages stuck in a pipe when stdout is not a tty,
e.g. when running a suite of tests using 9pm.
Two benefits:
- Nicer experience when interactively running a suite
- Timestamps inserted by 9pm are more useful
It turns out that the semantics of ping's -c option does not match our
expectations. The manual says:
> Stop after sending count ECHO_REQUEST packets. With deadline option,
> ping waits for count ECHO_REPLY packets, until the timeout expires.
But in fact, something like an ICMP_DEST_UNREACH will also count as a
response, meaning that the process will terminate with non-zero
exitcode even though the deadline has not yet been crossed, rather
than keep waiting for an ECHO_REPLY.
To add some extra flavor: this is only the case for iputils' ping,
Busybox's implementation will hold out for a response until the
deadline expires.
Therefore, wrap the ping in an ugly retry loop.
Also, return the full available context from must{,_not}_reach on
failures, instead of just the output. This allows us to show the exit
code in the top-level exception handler.
When a test starts an isolated MACVLAN namespace, it is often useful
to interactively join that namespace to investigate issues. To do
this, we need to find the "sleeper" process backing the namespace, and
`nsenter` into that process's network namespace.
Add a script that automates this process.
To start a shell in the netns of the MACVLAN stacked on top of d1b,
start a shell in the test environment:
infix/test $ ./shell
13:37:00 infamy0:test # ./nsenter d1b
13:37:01 infamy0(netns:d1b):test #
It is not uncommon for subprocesses to fail when developing new tests,
but the default representation of CalledProcessError does not print
the stdout of the program, only that it failed.
Catch this common case when a test is about to fail, and make sure to
log any output it produced.
Due to the salting being applied to Python's `hash()` (see [1]), the
hash of an object is not stable across different Python processes. As
a result, neither are the topology mappings generated by networkx.
The upside of this is randomness that we get better test coverage over
time, especially on physical devices where the underlying hardware
could differ between ports, for example.
On the other hand, it can be very frustrating to track down a bug when
locial nodes are suffled around between phyical nodes on each
invocation of a test case.
Therefore, use a random seed by default, but allow the user to specify
a fixed value if they so choose. We then add a meta test that logs the
seed being used for the current suite - which means we can simply
copy&paste that value to rerun the suite (or single test) with the
same topology mappings.
[1]: https://docs.python.org/3/reference/datamodel.html#object.__hash__
- Present the topologies to networkx as multigraphs, rather than
expaning each port of the record shape as a separate node.
- Create a topology mapping by locating a subgraph monomorphism of the
logical topology in the physical ditto.
This cuts down the time of finding a mapping by several orders of
magnitude. Example:
Before:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 13m1,213s
user 13m0,112s
sys 0m0,732s
After:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 0m0,153s
user 0m0,128s
sys 0m0,024s
Since we do not yet have lldpTxFast, or similar, to enable on LLDP, we
tickle both services to resend their HELLO frames on link down/up event
instead.
+ Reduces turnaround times drastically
+ Restore regression test for mDNS, which we lost recently
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg