DNE-TaaC

OTG: drive a live ixia-c endpoint, and port the 8 hardening playbooks Makes able to drive a real ixia-c endpoint, and ports the 8 playbooks from : agent warmboot, bgpd restart, qsfp_service restart, fsdb restart, malformed BGP packet, ECMP member overload, ECMP group overload, CPU high-priority queue overload. New thrift: (review first) (new structs, field 6); ( field 23). The declarative route-range model can only describe conformant BGP. This is the escape hatch: replaying a captured stream, precisely-timed churn, deliberately malformed messages. Maps to snappi , arm. Kept as a general byte sequence so the schema doesn't encode one test's use case. Durability — the main thing to weigh in on. Not in configerator yet, and the hashes are stale, so a sync clobbers it. Blast radius is contained: the passthrough uses and forwards the field only when set. A revert therefore leaves every other BGP config working, and the one config that needs the struct fails loudly at its builder. Happy to gate this PR on landing the schema first. One semantic worth knowing. OTG re-sends the sequence on every re-establishment. That makes a peer down/up a usable trigger without . It also means a peer whose UPDATEs draw a NOTIFICATION flaps forever, so replay peers are exempt from the setup-time all-sessions-up gate. Gating on them turns startup into a race against the flap cycle. Four silent-wrong-behaviour fixes Each produced a passing run that measured the wrong thing: — OTG reports ND neighbours expanded, configs write them compressed. IPv6 gateway MAC lookup missed every time, so v6 flows had no destination MAC. Dual-stack storage — used / and kept only the v4 address. "v6 flows" transmitted IPv4. — is an but neither nor , so dropped every . Any thrift optional list checked that way has this bug. — snappi's route-range step counts prefix blocks; is an address delta. The v4 branch used the raw integer, so at /24 walked 256× too far and overlapped the next speaker. Both families now share one helper, which also rejects a step that shifts to 0. Backend capabilities Step-facing APIs — , , . Playbook steps need these to drive peers, gate individual flows, and override header fields. — a disabled group is built in full, then its peers are driven DOWN and exempted from the setup gate. A playbook's toggle-up is then a real transition, not a no-op against an established session. — N devices per group, each with its own MAC and derived router ID. Duplicate router IDs prevent establishment. Prefix-targeted traffic — resolves to an address inside the advertised prefix and sweeps across it, giving the DUT's ECMP hash something to vary on. Without it nothing addresses the ECMP-routed prefixes and wrong next-hop selection is invisible. Upstream gets this from its items. Needless-reset avoidance — skips the re-push when the config is unchanged. A re-push restarts protocols and flaps every session. Ixia-C limitations ixia-c community edition caps control-plane interfaces at 4 and sessions at 4, per IP address per simulated device per AF. The full set needs far more and is rejected with an opaque HTTP 500 at . So it ships as three independently runnable profiles sharing : The builders count both dimensions and log them on every build, so exceeding the cap fails legibly instead of as an HTTP 500. Malformed BGP hand-builds UPDATE bytes per RFC 4271, using RFC 5737 documentation prefixes. Each malformation gets distinct NLRI so its effect is attributable: missing NEXT_HOP (), malformed AS_PATH (), invalid ORIGIN (), bad attribute length (). Two things are load-bearing. The attribute-length case overruns the message, which RFC 7606 §3 makes a session reset, so it goes last — anything after it is never sent on any replay cycle. And ASNs are 4-octet, because the peer negotiates AS4; 2-octet encoding would make every segment malformed and mask the defect each UPDATE exists to isolate. The assertion is blast radius: unrelated sessions and the forwarding path survive a peer that repeatedly establishes, injects garbage, and is torn down. Not "the DUT rejects the route and keeps this peer up." Rate choice Flows use absolute pps (, ) rather than percent-of-line-rate. ixia-c is a software TE: 10% line rate produced ~34% steady loss from receive-side bottlenecking, not from the DUT. Testing : 468 passed, smoke passes. All three profiles have passed against live ixia-c — restarts at 0.011% loss with genuine v6 flows on independent counters, ECMP with at 0.0007%, malformed with at 0.0009% and confirmed on the wire. DUT setup — ports, addressing, prefixes, CoPP for the CPU-queue test: . Known gaps A disabled peer flaps once at setup. OTG has no device-level disable and protocol start is all-or-nothing, so a held-down peer can establish briefly before the hold-down lands. One short up/down per disabled group, before any snapshot window opens. warns if the hold-down failed, since a playbook's toggle-up would otherwise measure nothing. is capped at by the licence, so ECMP_2 coming up adds one next-hop. Enough to exercise path selection, not enough to approach a platform limit. records the real-licence shape: 500 prefixes × 32 next-hops = 16000 members, 34 interfaces. The malformed test cannot prove routes were rejected, only that damage did not spread. compares endpoint dicts by identity, so a bidirectional item paired with itself would address the wrong leg. No profile does that, so it is annotated rather than changed. The related flow-name collision now raises instead of silently duplicating a flow.