featureprofiles icon indicating copy to clipboard operation
featureprofiles copied to clipboard

Initial ipsec feature

Open steve-goog opened this issue 2 months ago • 5 comments

steve-goog avatar Nov 06 '25 18:11 steve-goog

Summary of Changes

Hello @steve-goog, I'm Gemini Code Assist[^1]! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a comprehensive set of test specifications for IPSec (Internet Protocol Security) functionality, covering various aspects from basic tunnel establishment and traffic forwarding to advanced scenarios like hitless renegotiation, dead-peer detection, scaling, and packet reordering. It aims to ensure robust and performant IPSec implementations on network devices, including integration with MACsec, by defining detailed procedures and verification steps.

Highlights

  • Introduction of IPSec Feature Tests: This pull request introduces a comprehensive set of test specifications for IPSec (Internet Protocol Security) functionality, covering various aspects from basic tunnel establishment to advanced scenarios.
  • Detailed Test Cases: New test scenarios are defined for IPSec, including IKE/SA negotiation, Dead Peer Detection (DPD), key rotation, Quality of Service (QoS) handling, and various error conditions like invalid tunnel configurations.
  • Scaling and Packet Order Verification: Specific tests are included to verify IPSec tunnel scaling capabilities (maximum tunnels per attachment and per device) and the correct handling of out-of-order packets, especially with induced latency on aggregated links.
  • MACsec Integration: The test environment setup includes the integration of MACsec (Media Access Control Security) on ATE-DUT interfaces, with canonical OpenConfig examples provided for MACsec configuration.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with :thumbsup: and :thumbsdown: on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

[^1]: Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

gemini-code-assist[bot] avatar Nov 06 '25 18:11 gemini-code-assist[bot]

Pull Request Functional Test Report for #4783 / e4f839fc590389fe5ea0c3887405c9c6eeb08999

Virtual Devices

Device Test Test Documentation Job Raw Log
Arista cEOS status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
6314114d Log
Cisco 8000E status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
141fab1e Log
Cisco XRd status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
cfda5add Log
Juniper ncPTX status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
b7591c59 Log
Nokia SR Linux status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
52ed4f55 Log
Openconfig Lemming status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
48c383cc Log

Hardware Devices

Device Test Test Documentation Raw Log
Arista 7808 status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
Cisco 8808 status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
Juniper PTX10008 status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.
Nokia 7250 IXR-10e status
status
status
IPSEC-1.1: IPSec with MACSec over aggregated links.
IPSEC-1.3: IPSec Packet-Order with MACSec over aggregated links.
IPSEC-1.2: IPSec Scaling with MACSec over aggregated links.

Help

OpenConfigBot avatar Nov 06 '25 18:11 OpenConfigBot

Pull Request Test Coverage Report for Build 19238552680

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 10.955%

Totals Coverage Status
Change from base Build 19230614204: 0.0%
Covered Lines: 2224
Relevant Lines: 20302

💛 - Coveralls

coveralls avatar Nov 06 '25 18:11 coveralls

Updates from comments complete, please re-check when you get a chance. Thanks!

steve-goog avatar Nov 06 '25 21:11 steve-goog

FYI: Generated metadata.textproto:

dloher@nettool:~/src/featureprofiles$ go run ./tools/addrundata --fix

dplore avatar Nov 06 '25 23:11 dplore