Fix ISIS authentication configuration for Cisco FNTs

feature/isis/otg_tests/base_adjacencies_test/base_adjacencies_test.go

@@ -455,23 +455,13 @@ func TestAuthentication(t *testing.T) {
 				}
 
 				for _, intf := range isis.Interface {
-					if deviations.SetISISAuthWithInterfaceAuthenticationContainer(ts.DUT) {
-						intf.GetOrCreateAuthentication().Enabled = ygot.Bool(tc.enabled)
-						if tc.enabled {
-							intf.GetAuthentication().AuthPassword = ygot.String("google")
-							intf.GetAuthentication().AuthMode = tc.mode
-							intf.GetAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-						}
-
-					} else {
-						intf.GetOrCreateLevel(2).GetOrCreateHelloAuthentication().Enabled = ygot.Bool(tc.enabled)
-						if tc.enabled {
-							intf.GetLevel(2).GetHelloAuthentication().AuthPassword = ygot.String("google")
-							intf.GetLevel(2).GetHelloAuthentication().AuthMode = tc.mode
-							intf.GetLevel(2).GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-						}
+					intfAuth := intf.GetOrCreateAuthentication()
+					intfAuth.Enabled = ygot.Bool(tc.enabled)
+					if tc.enabled {
+						intfAuth.AuthPassword = ygot.String("google")
+						intfAuth.AuthMode = tc.mode
+						intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
 					}
-
 				}
 			})
 			if tc.enabled {

feature/isis/otg_tests/base_adjacencies_test/metadata.textproto

@@ -26,7 +26,6 @@ platform_exceptions: {
   }
   deviations: {
     isis_single_topology_required: true
-    set_isis_auth_with_interface_authentication_container: true
   }
 }
 platform_exceptions: {

feature/isis/otg_tests/isis_interface_hello_padding_enable_test/isis_interface_hello_padding_enable_test.go

@@ -28,6 +28,7 @@ import (
 	"github.com/openconfig/featureprofiles/internal/otgutils"
 	"github.com/openconfig/ondatra/gnmi"
 	"github.com/openconfig/ondatra/gnmi/oc"
+	otgtelemetry "github.com/openconfig/ondatra/gnmi/otg"
 	"github.com/openconfig/ygnmi/ygnmi"
 	"github.com/openconfig/ygot/ygot"
 )
@@ -129,10 +130,11 @@ func configureISIS(t *testing.T, ts *isissession.TestSession) {
 	isisIntfLevel.LevelNumber = ygot.Uint8(2)
 	isisIntfLevel.SetEnabled(true)
 	isisIntfLevel.Enabled = ygot.Bool(true)
-	isisIntfLevel.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
-	isisIntfLevel.GetHelloAuthentication().AuthPassword = ygot.String(password)
-	isisIntfLevel.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-	isisIntfLevel.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
+	intfAuth := intf.GetOrCreateAuthentication()
+	intfAuth.Enabled = ygot.Bool(true)
+	intfAuth.AuthPassword = ygot.String(password)
+	intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
+	intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
 
 	isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
 	isisIntfLevelTimers.HelloInterval = ygot.Uint32(5)
@@ -218,14 +220,23 @@ func TestIsisInterfaceHelloPaddingEnable(t *testing.T) {
 	pcl := ts.DUTConf.GetNetworkInstance(deviations.DefaultNetworkInstance(ts.DUT)).GetProtocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_ISIS, isissession.ISISName)
 	fptest.LogQuery(t, "Protocol ISIS", isissession.ProtocolPath(ts.DUT).Config(), pcl)
 
-	ts.PushAndStart(t)
+	if err := ts.PushAndStart(t); err != nil {
+		t.Fatalf("PushAndStart failed: %v", err)
+	}
+
+	// Do not consume the IS-IS adjacency timeout while either end of the link
+	// is still becoming operational after the OTG configuration push.
+	gnmi.Await(t, ts.DUT, gnmi.OC().Interface(ts.DUTPort1.Name()).OperStatus().State(), 2*time.Minute, oc.Interface_OperStatus_UP)
+	gnmi.Await(t, otg, gnmi.OTG().Port(ts.ATEPort1.ID()).Link().State(), 2*time.Minute, otgtelemetry.Port_Link_UP)
+
+	otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
+	otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
 
 	statePath := isissession.ISISPath(ts.DUT)
 	intfName := ts.DUTPort1.Name()
 	if deviations.ExplicitInterfaceInDefaultVRF(ts.DUT) || deviations.InterfaceRefInterfaceIDFormat(ts.DUT) {
 		intfName += ".0"
 	}
-	deadline := time.Now().Add(1 * time.Minute)
 	t.Run("Isis telemetry", func(t *testing.T) {
 
 		// Checking adjacency
@@ -309,6 +320,7 @@ func TestIsisInterfaceHelloPaddingEnable(t *testing.T) {
 		})
 		t.Run("Adjacency state checks", func(t *testing.T) {
 			adjPath := statePath.Interface(intfName).Level(2).Adjacency(ateSysID)
+			deadline := time.Now().Add(time.Minute)
 
 			if got := gnmi.Get(t, ts.DUT, adjPath.SystemId().State()); got != ateSysID {
 				t.Errorf("FAIL- Expected neighbor system id not found, got %s, want %s", got, ateSysID)
@@ -374,6 +386,7 @@ func TestIsisInterfaceHelloPaddingEnable(t *testing.T) {
 		})
 		t.Run("System level counter checks", func(t *testing.T) {
 			if deviations.MissingValueForDefaults(ts.DUT) {
+				deadline := time.Now().Add(time.Minute)
 				missingValueForDefaults := deviations.MissingValueForDefaults(ts.DUT)
 				sysCounts := isissession.ISISPath(ts.DUT).Level(2).SystemLevelCounters()
 				validators := []check.Validator{

feature/isis/otg_tests/isis_interface_level_passive_test/isis_interface_level_passive_test.go

@@ -104,11 +104,11 @@ func configureISIS(t *testing.T, ts *isissession.TestSession) {
 	isisIntfLevel2.LevelNumber = ygot.Uint8(2)
 	isisIntfLevel2.SetEnabled(true)
 	isisIntfLevel2.Enabled = ygot.Bool(true)
-
-	isisIntfLevel2.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
-	isisIntfLevel2.GetHelloAuthentication().AuthPassword = ygot.String(password)
-	isisIntfLevel2.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-	isisIntfLevel2.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
+	intfAuth := intf.GetOrCreateAuthentication()
+	intfAuth.Enabled = ygot.Bool(true)
+	intfAuth.AuthPassword = ygot.String(password)
+	intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
+	intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
 
 	isisIntfLevel2.GetOrCreateAf(oc.IsisTypes_AFI_TYPE_IPV4, oc.IsisTypes_SAFI_TYPE_UNICAST).Enabled = ygot.Bool(true)
 	isisIntfLevel2.GetOrCreateAf(oc.IsisTypes_AFI_TYPE_IPV4, oc.IsisTypes_SAFI_TYPE_UNICAST).Metric = ygot.Uint32(v4Metric)
@@ -184,8 +184,10 @@ func TestISISLevelPassive(t *testing.T) {
 	pcl := ts.DUTConf.GetNetworkInstance(deviations.DefaultNetworkInstance(ts.DUT)).GetProtocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_ISIS, isissession.ISISName)
 	fptest.LogQuery(t, "Protocol ISIS", isissession.ProtocolPath(ts.DUT).Config(), pcl)
 
-	ts.PushAndStart(t)
-	time.Sleep(time.Minute * 2)
+	if err := ts.PushAndStart(t); err != nil {
+		t.Fatalf("PushAndStart failed: %v", err)
+	}
+	otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
 
 	statePath := isissession.ISISPath(ts.DUT)
 	intfName := ts.DUTPort1.Name()

feature/isis/otg_tests/isis_metric_style_wide_enabled_test/isis_metric_style_wide_enabled_test.go

@@ -115,10 +115,11 @@ func configureISIS(t *testing.T, ts *isissession.TestSession) {
 	isisIntfLevel.LevelNumber = ygot.Uint8(2)
 	isisIntfLevel.SetEnabled(true)
 	isisIntfLevel.Enabled = ygot.Bool(true)
-	isisIntfLevel.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
-	isisIntfLevel.GetHelloAuthentication().AuthPassword = ygot.String(password)
-	isisIntfLevel.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-	isisIntfLevel.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
+	intfAuth := intf.GetOrCreateAuthentication()
+	intfAuth.Enabled = ygot.Bool(true)
+	intfAuth.AuthPassword = ygot.String(password)
+	intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
+	intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
 
 	isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
 	isisIntfLevelTimers.HelloInterval = ygot.Uint32(5)
@@ -200,8 +201,10 @@ func TestISISWideMetricEnabled(t *testing.T) {
 	pcl := ts.DUTConf.GetNetworkInstance(deviations.DefaultNetworkInstance(ts.DUT)).GetProtocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_ISIS, isissession.ISISName)
 	fptest.LogQuery(t, "Protocol ISIS", isissession.ProtocolPath(ts.DUT).Config(), pcl)
 
-	ts.PushAndStart(t)
-	time.Sleep(time.Minute * 2)
+	if err := ts.PushAndStart(t); err != nil {
+		t.Fatalf("PushAndStart failed: %v", err)
+	}
+	otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
 
 	statePath := isissession.ISISPath(ts.DUT)
 	intfName := ts.DUTPort1.Name()

feature/mpls/otg_tests/label_block/metadata.textproto

@@ -29,4 +29,4 @@ platform_exceptions: {
   deviations: {
     sr_igp_config_unsupported: true
   }
-}
+}

feature/mpls/otg_tests/label_block/mpls_label_block_with_isis_test.go

@@ -213,10 +213,11 @@ func configureISISMPLSSR(t *testing.T, ts *isissession.TestSession) {
 	isisIntfLevel.LevelNumber = ygot.Uint8(2)
 	isisIntfLevel.SetEnabled(true)
 	isisIntfLevel.Enabled = ygot.Bool(true)
-	isisIntfLevel.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
-	isisIntfLevel.GetHelloAuthentication().AuthPassword = ygot.String(password)
-	isisIntfLevel.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-	isisIntfLevel.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
+	intfAuth := intf.GetOrCreateAuthentication()
+	intfAuth.Enabled = ygot.Bool(true)
+	intfAuth.AuthPassword = ygot.String(password)
+	intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
+	intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
 
 	isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
 	isisIntfLevelTimers.HelloInterval = ygot.Uint32(5)
@@ -442,8 +443,10 @@ func TestMPLSLabelBlockWithISIS(t *testing.T) {
 
 	}
 
-	ts.PushAndStart(t)
-	time.Sleep(time.Minute * 2)
+	if err := ts.PushAndStart(t); err != nil {
+		t.Fatalf("PushAndStart failed: %v", err)
+	}
+	otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
 
 	// Checking ISIS
 	verifyISIS(t, ts)

internal/cfgplugins/isis.go

@@ -123,21 +123,11 @@ func NewISIS(t *testing.T, dut *ondatra.DUTDevice, ISISData *ISISGlobalParams, b
 			isisInterface.SetPassive(true)
 		} else if ISISData.ISISAuthKey != "" {
 			// Configure interface-level MD5 authentication for IS-IS Hello packets on active links.
-			// Cisco IOS-XR uses the top-level interface authentication container (SetISISAuthWithInterfaceAuthenticationContainer),
-			// whereas standard OpenConfig models configure hello-authentication under Level(2).
-			if deviations.SetISISAuthWithInterfaceAuthenticationContainer(dut) {
-				intfAuth := isisInterface.GetOrCreateAuthentication()
-				intfAuth.Enabled = ygot.Bool(true)
-				intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-				intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
-				intfAuth.AuthPassword = ygot.String(ISISData.ISISAuthKey)
-			} else {
-				lvl2IntfAuth := isisInterface.GetOrCreateLevel(2).GetOrCreateHelloAuthentication()
-				lvl2IntfAuth.Enabled = ygot.Bool(true)
-				lvl2IntfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
-				lvl2IntfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
-				lvl2IntfAuth.AuthPassword = ygot.String(ISISData.ISISAuthKey)
-			}
+			intfAuth := isisInterface.GetOrCreateAuthentication()
+			intfAuth.Enabled = ygot.Bool(true)
+			intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
+			intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
+			intfAuth.AuthPassword = ygot.String(ISISData.ISISAuthKey)
 		}
 	}
 

internal/deviations/deviations.go

@@ -1309,11 +1309,6 @@
 	return lookupDUTDeviations(dut).GetSrIgpConfigUnsupported()
 }
 
-// SetISISAuthWithInterfaceAuthenticationContainer returns true if Isis Authentication is blocked for one level specific config for P2P links, and the corresponding hello-authentication leafs can be set with ISIS Interface/Authentication container.
-func SetISISAuthWithInterfaceAuthenticationContainer(dut *ondatra.DUTDevice) bool {
-	return lookupDUTDeviations(dut).GetSetIsisAuthWithInterfaceAuthenticationContainer()
-}
-
 // GreGueTunnelInterfaceOcUnsupported returns true if GRE/GUE tunnel interface oc is unsupported
 func GreGueTunnelInterfaceOcUnsupported(dut *ondatra.DUTDevice) bool {
 	return lookupDUTDeviations(dut).GetGreGueTunnelInterfaceOcUnsupported()
@@ -2153,7 +2148,7 @@
 
 // AcctzRecordSessionChannelIdUnsupported returns true if the device does not support Acctz record for fail user
 // Juniper: https://partnerissuetracker.corp.google.com/issues/500627000
 func AcctzRecordSessionChannelIdUnsupported(dut *ondatra.DUTDevice) bool {
 	return lookupDUTDeviations(dut).GetAcctzRecordSessionChannelIdUnsupported()
 }
 
@@ -2186,7 +2181,7 @@
 
 // Device does not support secondary controller card CPU utilization
 // Arista: https://issuetracker.google.com/issues/508666262
 func SecondaryControllerCardCpuUtilizationUnsupported(dut *ondatra.DUTDevice) bool {
 	return lookupDUTDeviations(dut).GetSecondaryControllerCardCpuUtilizationUnsupported()
 }
 
@@ -2342,7 +2337,7 @@
 }
 
 // IpRoutingInVrfOcUnsupported returns true if device does not support OC configuration for IP routing in VRF.
 func IpRoutingInVrfOcUnsupported(dut *ondatra.DUTDevice) bool {
 	return lookupDUTDeviations(dut).GetIpRoutingInVrfOcUnsupported()
 }
 

internal/gnmi/setup/setup.go

@@ -240,11 +240,11 @@ func BuildBenchmarkingConfig(t *testing.T) *oc.Root {
 
 		isisIntfLevel := isisIntf.GetOrCreateLevel(2)
 		isisIntfLevel.Enabled = ygot.Bool(true)
-		isisIntfLevelAuth := isisIntfLevel.GetOrCreateHelloAuthentication()
-		isisIntfLevelAuth.Enabled = ygot.Bool(true)
-		isisIntfLevelAuth.AuthPassword = ygot.String(authPassword)
-		isisIntfLevelAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
-		isisIntfLevelAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
+		isisIntfAuth := isisIntf.GetOrCreateAuthentication()
+		isisIntfAuth.Enabled = ygot.Bool(true)
+		isisIntfAuth.AuthPassword = ygot.String(authPassword)
+		isisIntfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
+		isisIntfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
 
 		isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
 		isisIntfLevelTimers.HelloInterval = ygot.Uint32(1)

internal/isisscale/isisscale.go

@@ -384,28 +384,14 @@ func VerifyISISAuthTelemetry(t *testing.T, dut *ondatra.DUTDevice, isisInterface
 
 	// 2. Query and verify Interface Hello Authentication State across all interfaces
 	helloAuthCount := 0
-	if deviations.SetISISAuthWithInterfaceAuthenticationContainer(dut) {
-		intfAuthVals := gnmi.LookupAll(t, dut, isisProto.InterfaceAny().Authentication().State())
-		if len(intfAuthVals) == 0 {
-			return false, fmt.Errorf("interface auth telemetry state is not present in telemetry stream")
-		}
-		for _, intfAuth := range intfAuthVals {
-			if val, ok := intfAuth.Val(); ok {
-				if val.GetEnabled() {
-					helloAuthCount++
-				}
-			}
-		}
-	} else {
-		helloAuthVals := gnmi.LookupAll(t, dut, isisProto.InterfaceAny().LevelAny().HelloAuthentication().State())
-		if len(helloAuthVals) == 0 {
-			return false, fmt.Errorf("interface hello auth telemetry state is not present in telemetry stream")
-		}
-		for _, helloAuth := range helloAuthVals {
-			if val, ok := helloAuth.Val(); ok {
-				if val.GetEnabled() {
-					helloAuthCount++
-				}
+	intfAuthVals := gnmi.LookupAll(t, dut, isisProto.InterfaceAny().Authentication().State())
+	if len(intfAuthVals) == 0 {
+		return false, fmt.Errorf("interface auth telemetry state is not present in telemetry stream")
+	}
+	for _, intfAuth := range intfAuthVals {
+		if val, ok := intfAuth.Val(); ok {
+			if val.GetEnabled() {
+				helloAuthCount++
 			}
 		}
 	}

proto/metadata.proto

@@ -716,10 +716,7 @@ message Metadata {
     // Cisco b/390502067
     bool sr_igp_config_unsupported = 260;
 
-    // Cisco: b/404301960
-    // Devices that block one IS-IS level specific authentication config attribute for P2P links.
-    // The same leafs can be set directly under ISIS Interface authentication /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/authentication.
-    bool set_isis_auth_with_interface_authentication_container = 261;
+    reserved 261;
 
     // Devices that do not support GRE/GUE tunnel interface oc.
     // Juniper b/398171114