868 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# OVS kernel module self tests5 6trap ovs_exit_sig EXIT TERM INT ERR7 8# Kselftest framework requirement - SKIP code is 4.9ksft_skip=410 11PAUSE_ON_FAIL=no12VERBOSE=013TRACING=014WAIT_TIMEOUT=515 16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then17 WAIT_TIMEOUT=1018fi19 20tests="21 arp_ping eth-arp: Basic arp ping between two NS22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct23 connect_v4 ip4-xon: Basic ipv4 ping between two NS24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT26 netlink_checks ovsnl: validate netlink attrs and settings27 upcall_interfaces ovs: test the upcall interfaces28 drop_reason drop: test drop reasons are emitted29 psample psample: Sampling packets with psample"30 31info() {32 [ "${ovs_dir}" != "" ] &&33 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log34 [ $VERBOSE = 0 ] || echo $*35}36 37ovs_wait() {38 info "waiting $WAIT_TIMEOUT s for: $@"39 40 if "$@" ; then41 info "wait succeeded immediately"42 return 043 fi44 45 # A quick re-check helps speed up small races in fast systems.46 # However, fractional sleeps might not necessarily work.47 local start=048 sleep 0.1 || { sleep 1; start=1; }49 50 for (( i=start; i<WAIT_TIMEOUT; i++ )); do51 if "$@" ; then52 info "wait succeeded after $i seconds"53 return 054 fi55 sleep 156 done57 info "wait failed after $i seconds"58 return 159}60 61ovs_base=`pwd`62sbxs=63sbx_add () {64 info "adding sandbox '$1'"65 66 sbxs="$sbxs $1"67 68 NO_BIN=069 70 # Create sandbox.71 local d="$ovs_base"/$172 if [ -e $d ]; then73 info "removing $d"74 rm -rf "$d"75 fi76 mkdir "$d" || return 177 ovs_setenv $178}79 80ovs_exit_sig() {81 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup"82}83 84on_exit() {85 echo "$1" > ${ovs_dir}/cleanup.tmp86 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp87 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup88}89 90ovs_setenv() {91 sandbox=$192 93 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir94 95 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup96}97 98ovs_sbx() {99 if test "X$2" != X; then100 (ovs_setenv $1; shift;101 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log)102 else103 ovs_setenv $1104 fi105}106 107ovs_add_dp () {108 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}"109 sbxname="$1"110 shift111 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $*112 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;"113}114 115ovs_add_if () {116 info "Adding IF to DP: br:$2 if:$3"117 if [ "$4" != "-u" ]; then118 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if "$2" "$3" \119 || return 1120 else121 python3 $ovs_base/ovs-dpctl.py add-if \122 -u "$2" "$3" >$ovs_dir/$3.out 2>$ovs_dir/$3.err &123 pid=$!124 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null"125 fi126}127 128ovs_del_if () {129 info "Deleting IF from DP: br:$2 if:$3"130 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1131}132 133ovs_netns_spawn_daemon() {134 sbx=$1135 shift136 netns=$1137 shift138 if [ "$netns" == "_default" ]; then139 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr &140 else141 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr &142 fi143 pid=$!144 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null"145}146 147ovs_spawn_daemon() {148 sbx=$1149 shift150 ovs_netns_spawn_daemon $sbx "_default" $*151}152 153ovs_add_netns_and_veths () {154 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}"155 ovs_sbx "$1" ip netns add "$3" || return 1156 on_exit "ovs_sbx $1 ip netns del $3"157 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1158 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1"159 ovs_sbx "$1" ip link set "$4" up || return 1160 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1161 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1162 163 if [ "$6" != "" ]; then164 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \165 || return 1166 fi167 168 if [ "$7" != "-u" ]; then169 ovs_add_if "$1" "$2" "$4" || return 1170 else171 ovs_add_if "$1" "$2" "$4" -u || return 1172 fi173 174 [ $TRACING -eq 1 ] && ovs_netns_spawn_daemon "$1" "$ns" \175 tcpdump -i any -s 65535176 177 return 0178}179 180ovs_add_flow () {181 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4"182 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4"183 if [ $? -ne 0 ]; then184 info "Flow [ $3 : $4 ] failed"185 return 1186 fi187 return 0188}189 190ovs_del_flows () {191 info "Deleting all flows from DP: sbx:$1 br:$2"192 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2"193 return 0194}195 196ovs_drop_record_and_run () {197 local sbx=$1198 shift199 200 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \201 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr202 return $?203}204 205ovs_drop_reason_count()206{207 local reason=$1208 209 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace`210 local pattern="skb:kfree_skb:.*reason: $reason"211 212 return `echo "$perf_output" | grep "$pattern" | wc -l`213}214 215ovs_test_flow_fails () {216 ERR_MSG="Flow actions may not be safe on all matching packets"217 218 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")219 ovs_add_flow $@ &> /dev/null $@ && return 1220 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")221 222 if [ "$PRE_TEST" == "$POST_TEST" ]; then223 return 1224 fi225 return 0226}227 228usage() {229 echo230 echo "$0 [OPTIONS] [TEST]..."231 echo "If no TEST argument is given, all tests will be run."232 echo233 echo "Options"234 echo " -t: capture traffic via tcpdump"235 echo " -v: verbose"236 echo " -p: pause on failure"237 echo238 echo "Available tests${tests}"239 exit 1240}241 242 243# psample test244# - use psample to observe packets245test_psample() {246 sbx_add "test_psample" || return $?247 248 # Add a datapath with per-vport dispatching.249 ovs_add_dp "test_psample" psample -V 2:1 || return 1250 251 info "create namespaces"252 ovs_add_netns_and_veths "test_psample" "psample" \253 client c0 c1 172.31.110.10/24 -u || return 1254 ovs_add_netns_and_veths "test_psample" "psample" \255 server s0 s1 172.31.110.20/24 -u || return 1256 257 # Check if psample actions can be configured.258 ovs_add_flow "test_psample" psample \259 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null260 if [ $? == 1 ]; then261 info "no support for psample - skipping"262 ovs_exit_sig263 return $ksft_skip264 fi265 266 ovs_del_flows "test_psample" psample267 268 # Test action verification.269 OLDIFS=$IFS270 IFS='*'271 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()'272 for testcase in \273 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \274 "no group with cookie"*"psample(cookie=abcd)" \275 "no group"*"psample()";276 do277 set -- $testcase;278 ovs_test_flow_fails "test_psample" psample $min_key $2279 if [ $? == 1 ]; then280 info "failed - $1"281 return 1282 fi283 done284 IFS=$OLDIFS285 286 ovs_del_flows "test_psample" psample287 # Allow ARP288 ovs_add_flow "test_psample" psample \289 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1290 ovs_add_flow "test_psample" psample \291 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1292 293 # Sample first 14 bytes of all traffic.294 ovs_add_flow "test_psample" psample \295 "in_port(1),eth(),eth_type(0x0800),ipv4()" \296 "trunc(14),psample(group=1,cookie=c0ffee),2"297 298 # Sample all traffic. In this case, use a sample() action with both299 # psample and an upcall emulating simultaneous local sampling and300 # sFlow / IPFIX.301 nlpid=$(grep -E "listening on upcall packet handler" \302 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ')303 304 ovs_add_flow "test_psample" psample \305 "in_port(2),eth(),eth_type(0x0800),ipv4()" \306 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1"307 308 # Record psample data.309 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events310 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout311 312 # Send a single ping.313 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1314 315 # We should have received one userspace action upcall and 2 psample packets.316 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1317 318 # client -> server samples should only contain the first 14 bytes of the packet.319 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \320 $ovs_dir/stdout || return 1321 322 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1323 324 return 0325}326 327# drop_reason test328# - drop packets and verify the right drop reason is reported329test_drop_reason() {330 which perf >/dev/null 2>&1 || return $ksft_skip331 332 sbx_add "test_drop_reason" || return $?333 334 ovs_add_dp "test_drop_reason" dropreason || return 1335 336 info "create namespaces"337 for ns in client server; do338 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \339 "${ns:0:1}0" "${ns:0:1}1" || return 1340 done341 342 # Setup client namespace343 ip netns exec client ip addr add 172.31.110.10/24 dev c1344 ip netns exec client ip link set c1 up345 346 # Setup server namespace347 ip netns exec server ip addr add 172.31.110.20/24 dev s1348 ip netns exec server ip link set s1 up349 350 # Check if drop reasons can be sent351 ovs_add_flow "test_drop_reason" dropreason \352 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null353 if [ $? == 1 ]; then354 info "no support for drop reasons - skipping"355 ovs_exit_sig356 return $ksft_skip357 fi358 359 ovs_del_flows "test_drop_reason" dropreason360 361 # Allow ARP362 ovs_add_flow "test_drop_reason" dropreason \363 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1364 ovs_add_flow "test_drop_reason" dropreason \365 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1366 367 # Allow client ICMP traffic but drop return path368 ovs_add_flow "test_drop_reason" dropreason \369 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2'370 ovs_add_flow "test_drop_reason" dropreason \371 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop'372 373 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20374 ovs_drop_reason_count 0x30001 # OVS_DROP_FLOW_ACTION375 if [[ "$?" -ne "2" ]]; then376 info "Did not detect expected drops: $?"377 return 1378 fi379 380 # Drop UDP 6000 traffic with an explicit action and an error code.381 ovs_add_flow "test_drop_reason" dropreason \382 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \383 'drop(42)'384 # Drop UDP 7000 traffic with an explicit action with no error code.385 ovs_add_flow "test_drop_reason" dropreason \386 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \387 'drop(0)'388 389 ovs_drop_record_and_run \390 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000391 ovs_drop_reason_count 0x30004 # OVS_DROP_EXPLICIT_ACTION_ERROR392 if [[ "$?" -ne "1" ]]; then393 info "Did not detect expected explicit error drops: $?"394 return 1395 fi396 397 ovs_drop_record_and_run \398 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000399 ovs_drop_reason_count 0x30003 # OVS_DROP_EXPLICIT_ACTION400 if [[ "$?" -ne "1" ]]; then401 info "Did not detect expected explicit drops: $?"402 return 1403 fi404 405 return 0406}407 408# arp_ping test409# - client has 1500 byte MTU410# - server has 1500 byte MTU411# - send ARP ping between two ns412test_arp_ping () {413 414 which arping >/dev/null 2>&1 || return $ksft_skip415 416 sbx_add "test_arp_ping" || return $?417 418 ovs_add_dp "test_arp_ping" arpping || return 1419 420 info "create namespaces"421 for ns in client server; do422 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \423 "${ns:0:1}0" "${ns:0:1}1" || return 1424 done425 426 # Setup client namespace427 ip netns exec client ip addr add 172.31.110.10/24 dev c1428 ip netns exec client ip link set c1 up429 HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`430 info "Client hwaddr: $HW_CLIENT"431 432 # Setup server namespace433 ip netns exec server ip addr add 172.31.110.20/24 dev s1434 ip netns exec server ip link set s1 up435 HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`436 info "Server hwaddr: $HW_SERVER"437 438 ovs_add_flow "test_arp_ping" arpping \439 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1440 ovs_add_flow "test_arp_ping" arpping \441 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1442 443 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1444 445 return 0446}447 448# ct_connect_v4 test449# - client has 1500 byte MTU450# - server has 1500 byte MTU451# - use ICMP to ping in each direction452# - only allow CT state stuff to pass through new in c -> s453test_ct_connect_v4 () {454 455 which nc >/dev/null 2>/dev/null || return $ksft_skip456 457 sbx_add "test_ct_connect_v4" || return $?458 459 ovs_add_dp "test_ct_connect_v4" ct4 || return 1460 info "create namespaces"461 for ns in client server; do462 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \463 "${ns:0:1}0" "${ns:0:1}1" || return 1464 done465 466 ip netns exec client ip addr add 172.31.110.10/24 dev c1467 ip netns exec client ip link set c1 up468 ip netns exec server ip addr add 172.31.110.20/24 dev s1469 ip netns exec server ip link set s1 up470 471 # Add forwarding for ARP and ip packets - completely wildcarded472 ovs_add_flow "test_ct_connect_v4" ct4 \473 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1474 ovs_add_flow "test_ct_connect_v4" ct4 \475 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1476 ovs_add_flow "test_ct_connect_v4" ct4 \477 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \478 'ct(commit),recirc(0x1)' || return 1479 ovs_add_flow "test_ct_connect_v4" ct4 \480 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \481 '2' || return 1482 ovs_add_flow "test_ct_connect_v4" ct4 \483 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \484 '2' || return 1485 ovs_add_flow "test_ct_connect_v4" ct4 \486 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \487 '1' || return 1488 ovs_add_flow "test_ct_connect_v4" ct4 \489 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \490 return 1491 492 # do a ping493 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1494 495 # create an echo server in 'server'496 echo "server" | \497 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \498 nc -lvnp 4443499 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1500 501 # Now test in the other direction (should fail)502 echo "client" | \503 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \504 nc -lvnp 4443505 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443506 if [ $? == 0 ]; then507 info "ct connect to client was successful"508 return 1509 fi510 511 info "done..."512 return 0513}514 515# connect_v4 test516# - client has 1500 byte MTU517# - server has 1500 byte MTU518# - use ICMP to ping in each direction519test_connect_v4 () {520 521 sbx_add "test_connect_v4" || return $?522 523 ovs_add_dp "test_connect_v4" cv4 || return 1524 525 info "create namespaces"526 for ns in client server; do527 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \528 "${ns:0:1}0" "${ns:0:1}1" || return 1529 done530 531 532 ip netns exec client ip addr add 172.31.110.10/24 dev c1533 ip netns exec client ip link set c1 up534 ip netns exec server ip addr add 172.31.110.20/24 dev s1535 ip netns exec server ip link set s1 up536 537 # Add forwarding for ARP and ip packets - completely wildcarded538 ovs_add_flow "test_connect_v4" cv4 \539 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1540 ovs_add_flow "test_connect_v4" cv4 \541 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1542 ovs_add_flow "test_connect_v4" cv4 \543 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1544 ovs_add_flow "test_connect_v4" cv4 \545 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1546 547 # do a ping548 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1549 550 info "done..."551 return 0552}553 554# nat_connect_v4 test555# - client has 1500 byte MTU556# - server has 1500 byte MTU557# - use ICMP to ping in each direction558# - only allow CT state stuff to pass through new in c -> s559test_nat_connect_v4 () {560 which nc >/dev/null 2>/dev/null || return $ksft_skip561 562 sbx_add "test_nat_connect_v4" || return $?563 564 ovs_add_dp "test_nat_connect_v4" nat4 || return 1565 info "create namespaces"566 for ns in client server; do567 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \568 "${ns:0:1}0" "${ns:0:1}1" || return 1569 done570 571 ip netns exec client ip addr add 172.31.110.10/24 dev c1572 ip netns exec client ip link set c1 up573 ip netns exec server ip addr add 172.31.110.20/24 dev s1574 ip netns exec server ip link set s1 up575 576 ip netns exec client ip route add default via 172.31.110.20577 578 ovs_add_flow "test_nat_connect_v4" nat4 \579 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1580 ovs_add_flow "test_nat_connect_v4" nat4 \581 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1582 ovs_add_flow "test_nat_connect_v4" nat4 \583 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \584 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)"585 ovs_add_flow "test_nat_connect_v4" nat4 \586 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \587 "ct(commit,nat),recirc(0x2)"588 589 ovs_add_flow "test_nat_connect_v4" nat4 \590 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2"591 ovs_add_flow "test_nat_connect_v4" nat4 \592 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1"593 594 # do a ping595 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1596 597 # create an echo server in 'server'598 echo "server" | \599 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \600 nc -lvnp 4443601 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1602 603 # Now test in the other direction (should fail)604 echo "client" | \605 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \606 nc -lvnp 4443607 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443608 if [ $? == 0 ]; then609 info "connect to client was successful"610 return 1611 fi612 613 info "done..."614 return 0615}616 617# nat_related_v4 test618# - client->server ip packets go via SNAT619# - client solicits ICMP destination unreachable packet from server620# - undo NAT for ICMP reply and test dst ip has been updated621test_nat_related_v4 () {622 which nc >/dev/null 2>/dev/null || return $ksft_skip623 624 sbx_add "test_nat_related_v4" || return $?625 626 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1627 info "create namespaces"628 for ns in client server; do629 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \630 "${ns:0:1}0" "${ns:0:1}1" || return 1631 done632 633 ip netns exec client ip addr add 172.31.110.10/24 dev c1634 ip netns exec client ip link set c1 up635 ip netns exec server ip addr add 172.31.110.20/24 dev s1636 ip netns exec server ip link set s1 up637 638 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10639 640 # Allow ARP641 ovs_add_flow "test_nat_related_v4" natrelated4 \642 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1643 ovs_add_flow "test_nat_related_v4" natrelated4 \644 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1645 646 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20647 ovs_add_flow "test_nat_related_v4" natrelated4 \648 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \649 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1650 ovs_add_flow "test_nat_related_v4" natrelated4 \651 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \652 "2" || return 1653 654 # Allow related ICMP responses back from server and undo NAT to restore original IP655 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP656 ovs_add_flow "test_nat_related_v4" natrelated4 \657 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \658 "ct(commit,nat),recirc(0x2)" || return 1659 ovs_add_flow "test_nat_related_v4" natrelated4 \660 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \661 "1" || return 1662 ovs_add_flow "test_nat_related_v4" natrelated4 \663 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \664 "drop" || return 1665 666 # Solicit destination unreachable response from server667 ovs_sbx "test_nat_related_v4" ip netns exec client \668 bash -c "echo a | nc -u -w 1 172.31.110.20 10000"669 670 # Check to make sure no packets matched the drop rule with incorrect dst ip671 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \672 | grep "drop" | grep "packets:0" >/dev/null || return 1673 674 info "done..."675 return 0676}677 678# netlink_validation679# - Create a dp680# - check no warning with "old version" simulation681test_netlink_checks () {682 sbx_add "test_netlink_checks" || return 1683 684 info "setting up new DP"685 ovs_add_dp "test_netlink_checks" nv0 || return 1686 # now try again687 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")688 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1689 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")690 if [ "$PRE_TEST" != "$POST_TEST" ]; then691 info "failed - gen warning"692 return 1693 fi694 695 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \696 return 1697 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \698 return 1699 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \700 wc -l) == 3 ] || \701 return 1702 ovs_del_if "test_netlink_checks" nv0 right0 || return 1703 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \704 wc -l) == 2 ] || \705 return 1706 707 info "Checking clone depth"708 ERR_MSG="Flow actions may not be safe on all matching packets"709 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")710 ovs_add_flow "test_netlink_checks" nv0 \711 'in_port(1),eth(),eth_type(0x800),ipv4()' \712 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \713 >/dev/null 2>&1 && return 1714 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")715 716 if [ "$PRE_TEST" == "$POST_TEST" ]; then717 info "failed - clone depth too large"718 return 1719 fi720 721 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")722 ovs_add_flow "test_netlink_checks" nv0 \723 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \724 &> /dev/null && return 1725 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")726 if [ "$PRE_TEST" == "$POST_TEST" ]; then727 info "failed - error not generated"728 return 1729 fi730 return 0731}732 733test_upcall_interfaces() {734 sbx_add "test_upcall_interfaces" || return 1735 736 info "setting up new DP"737 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1738 739 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \740 172.31.110.1/24 -u || return 1741 742 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out743 744 info "sending arping"745 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \746 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr747 748 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1749 return 0750}751 752run_test() {753 (754 tname="$1"755 tdesc="$2"756 757 if python3 ovs-dpctl.py -h 2>&1 | \758 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then759 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}"760 return $ksft_skip761 fi762 763 python3 ovs-dpctl.py show >/dev/null 2>&1 || \764 echo "[DPCTL] show exception."765 766 if ! lsmod | grep openvswitch >/dev/null 2>&1; then767 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}"768 return $ksft_skip769 fi770 771 printf "TEST: %-60s [START]\n" "${tname}"772 773 unset IFS774 775 eval test_${tname}776 ret=$?777 778 if [ $ret -eq 0 ]; then779 printf "TEST: %-60s [ OK ]\n" "${tdesc}"780 ovs_exit_sig781 rm -rf "$ovs_dir"782 elif [ $ret -eq 1 ]; then783 printf "TEST: %-60s [FAIL]\n" "${tdesc}"784 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then785 echo786 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue"787 read a788 fi789 ovs_exit_sig790 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir"791 exit 1792 elif [ $ret -eq $ksft_skip ]; then793 printf "TEST: %-60s [SKIP]\n" "${tdesc}"794 elif [ $ret -eq 2 ]; then795 rm -rf test_${tname}796 run_test "$1" "$2"797 fi798 799 return $ret800 )801 ret=$?802 case $ret in803 0)804 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0805 all_skipped=false806 ;;807 $ksft_skip)808 [ $all_skipped = true ] && exitcode=$ksft_skip809 ;;810 *)811 all_skipped=false812 exitcode=1813 ;;814 esac815 816 return $ret817}818 819 820exitcode=0821desc=0822all_skipped=true823 824while getopts :pvt o825do826 case $o in827 p) PAUSE_ON_FAIL=yes;;828 v) VERBOSE=1;;829 t) if which tcpdump > /dev/null 2>&1; then830 TRACING=1831 else832 echo "=== tcpdump not available, tracing disabled"833 fi834 ;;835 *) usage;;836 esac837done838shift $(($OPTIND-1))839 840IFS=" 841"842 843for arg do844 # Check first that all requested tests are available before running any845 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; }846done847 848name=""849desc=""850for t in ${tests}; do851 [ "${name}" = "" ] && name="${t}" && continue852 [ "${desc}" = "" ] && desc="${t}"853 854 run_this=1855 for arg do856 [ "${arg}" != "${arg#--*}" ] && continue857 [ "${arg}" = "${name}" ] && run_this=1 && break858 run_this=0859 done860 if [ $run_this -eq 1 ]; then861 run_test "${name}" "${desc}"862 fi863 name=""864 desc=""865done866 867exit ${exitcode}868