Loading...
Note: File does not exist in v4.10.11.
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# OVS kernel module self tests
5
6trap ovs_exit_sig EXIT TERM INT ERR
7
8# Kselftest framework requirement - SKIP code is 4.
9ksft_skip=4
10
11PAUSE_ON_FAIL=no
12VERBOSE=0
13TRACING=0
14WAIT_TIMEOUT=5
15
16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then
17 WAIT_TIMEOUT=10
18fi
19
20tests="
21 arp_ping eth-arp: Basic arp ping between two NS
22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct
23 connect_v4 ip4-xon: Basic ipv4 ping between two NS
24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT
25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT
26 netlink_checks ovsnl: validate netlink attrs and settings
27 upcall_interfaces ovs: test the upcall interfaces
28 drop_reason drop: test drop reasons are emitted
29 psample psample: Sampling packets with psample"
30
31info() {
32 [ "${ovs_dir}" != "" ] &&
33 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log
34 [ $VERBOSE = 0 ] || echo $*
35}
36
37ovs_wait() {
38 info "waiting $WAIT_TIMEOUT s for: $@"
39
40 if "$@" ; then
41 info "wait succeeded immediately"
42 return 0
43 fi
44
45 # A quick re-check helps speed up small races in fast systems.
46 # However, fractional sleeps might not necessarily work.
47 local start=0
48 sleep 0.1 || { sleep 1; start=1; }
49
50 for (( i=start; i<WAIT_TIMEOUT; i++ )); do
51 if "$@" ; then
52 info "wait succeeded after $i seconds"
53 return 0
54 fi
55 sleep 1
56 done
57 info "wait failed after $i seconds"
58 return 1
59}
60
61ovs_base=`pwd`
62sbxs=
63sbx_add () {
64 info "adding sandbox '$1'"
65
66 sbxs="$sbxs $1"
67
68 NO_BIN=0
69
70 # Create sandbox.
71 local d="$ovs_base"/$1
72 if [ -e $d ]; then
73 info "removing $d"
74 rm -rf "$d"
75 fi
76 mkdir "$d" || return 1
77 ovs_setenv $1
78}
79
80ovs_exit_sig() {
81 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup"
82}
83
84on_exit() {
85 echo "$1" > ${ovs_dir}/cleanup.tmp
86 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp
87 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup
88}
89
90ovs_setenv() {
91 sandbox=$1
92
93 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir
94
95 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup
96}
97
98ovs_sbx() {
99 if test "X$2" != X; then
100 (ovs_setenv $1; shift;
101 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log)
102 else
103 ovs_setenv $1
104 fi
105}
106
107ovs_add_dp () {
108 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}"
109 sbxname="$1"
110 shift
111 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $*
112 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;"
113}
114
115ovs_add_if () {
116 info "Adding IF to DP: br:$2 if:$3"
117 if [ "$4" != "-u" ]; then
118 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if "$2" "$3" \
119 || return 1
120 else
121 python3 $ovs_base/ovs-dpctl.py add-if \
122 -u "$2" "$3" >$ovs_dir/$3.out 2>$ovs_dir/$3.err &
123 pid=$!
124 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null"
125 fi
126}
127
128ovs_del_if () {
129 info "Deleting IF from DP: br:$2 if:$3"
130 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1
131}
132
133ovs_netns_spawn_daemon() {
134 sbx=$1
135 shift
136 netns=$1
137 shift
138 if [ "$netns" == "_default" ]; then
139 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr &
140 else
141 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr &
142 fi
143 pid=$!
144 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null"
145}
146
147ovs_spawn_daemon() {
148 sbx=$1
149 shift
150 ovs_netns_spawn_daemon $sbx "_default" $*
151}
152
153ovs_add_netns_and_veths () {
154 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}"
155 ovs_sbx "$1" ip netns add "$3" || return 1
156 on_exit "ovs_sbx $1 ip netns del $3"
157 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1
158 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1"
159 ovs_sbx "$1" ip link set "$4" up || return 1
160 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1
161 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1
162
163 if [ "$6" != "" ]; then
164 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \
165 || return 1
166 fi
167
168 if [ "$7" != "-u" ]; then
169 ovs_add_if "$1" "$2" "$4" || return 1
170 else
171 ovs_add_if "$1" "$2" "$4" -u || return 1
172 fi
173
174 if [ $TRACING -eq 1 ]; then
175 ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553
176 ovs_wait grep -q "listening on any" ${ovs_dir}/stderr
177 fi
178
179 return 0
180}
181
182ovs_add_flow () {
183 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4"
184 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4"
185 if [ $? -ne 0 ]; then
186 info "Flow [ $3 : $4 ] failed"
187 return 1
188 fi
189 return 0
190}
191
192ovs_del_flows () {
193 info "Deleting all flows from DP: sbx:$1 br:$2"
194 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2"
195 return 0
196}
197
198ovs_drop_record_and_run () {
199 local sbx=$1
200 shift
201
202 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \
203 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr
204 return $?
205}
206
207ovs_drop_reason_count()
208{
209 local reason=$1
210
211 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace`
212 local pattern="skb:kfree_skb:.*reason: $reason"
213
214 return `echo "$perf_output" | grep "$pattern" | wc -l`
215}
216
217ovs_test_flow_fails () {
218 ERR_MSG="Flow actions may not be safe on all matching packets"
219
220 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
221 ovs_add_flow $@ &> /dev/null $@ && return 1
222 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
223
224 if [ "$PRE_TEST" == "$POST_TEST" ]; then
225 return 1
226 fi
227 return 0
228}
229
230usage() {
231 echo
232 echo "$0 [OPTIONS] [TEST]..."
233 echo "If no TEST argument is given, all tests will be run."
234 echo
235 echo "Options"
236 echo " -t: capture traffic via tcpdump"
237 echo " -v: verbose"
238 echo " -p: pause on failure"
239 echo
240 echo "Available tests${tests}"
241 exit 1
242}
243
244
245# psample test
246# - use psample to observe packets
247test_psample() {
248 sbx_add "test_psample" || return $?
249
250 # Add a datapath with per-vport dispatching.
251 ovs_add_dp "test_psample" psample -V 2:1 || return 1
252
253 info "create namespaces"
254 ovs_add_netns_and_veths "test_psample" "psample" \
255 client c0 c1 172.31.110.10/24 -u || return 1
256 ovs_add_netns_and_veths "test_psample" "psample" \
257 server s0 s1 172.31.110.20/24 -u || return 1
258
259 # Check if psample actions can be configured.
260 ovs_add_flow "test_psample" psample \
261 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null
262 if [ $? == 1 ]; then
263 info "no support for psample - skipping"
264 ovs_exit_sig
265 return $ksft_skip
266 fi
267
268 ovs_del_flows "test_psample" psample
269
270 # Test action verification.
271 OLDIFS=$IFS
272 IFS='*'
273 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()'
274 for testcase in \
275 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \
276 "no group with cookie"*"psample(cookie=abcd)" \
277 "no group"*"psample()";
278 do
279 set -- $testcase;
280 ovs_test_flow_fails "test_psample" psample $min_key $2
281 if [ $? == 1 ]; then
282 info "failed - $1"
283 return 1
284 fi
285 done
286 IFS=$OLDIFS
287
288 ovs_del_flows "test_psample" psample
289 # Allow ARP
290 ovs_add_flow "test_psample" psample \
291 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
292 ovs_add_flow "test_psample" psample \
293 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
294
295 # Sample first 14 bytes of all traffic.
296 ovs_add_flow "test_psample" psample \
297 "in_port(1),eth(),eth_type(0x0800),ipv4()" \
298 "trunc(14),psample(group=1,cookie=c0ffee),2"
299
300 # Sample all traffic. In this case, use a sample() action with both
301 # psample and an upcall emulating simultaneous local sampling and
302 # sFlow / IPFIX.
303 nlpid=$(grep -E "listening on upcall packet handler" \
304 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ')
305
306 ovs_add_flow "test_psample" psample \
307 "in_port(2),eth(),eth_type(0x0800),ipv4()" \
308 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1"
309
310 # Record psample data.
311 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events
312 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout
313
314 # Send a single ping.
315 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1
316
317 # We should have received one userspace action upcall and 2 psample packets.
318 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1
319
320 # client -> server samples should only contain the first 14 bytes of the packet.
321 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \
322 $ovs_dir/stdout || return 1
323
324 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1
325
326 return 0
327}
328
329# drop_reason test
330# - drop packets and verify the right drop reason is reported
331test_drop_reason() {
332 which perf >/dev/null 2>&1 || return $ksft_skip
333
334 sbx_add "test_drop_reason" || return $?
335
336 ovs_add_dp "test_drop_reason" dropreason || return 1
337
338 info "create namespaces"
339 for ns in client server; do
340 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \
341 "${ns:0:1}0" "${ns:0:1}1" || return 1
342 done
343
344 # Setup client namespace
345 ip netns exec client ip addr add 172.31.110.10/24 dev c1
346 ip netns exec client ip link set c1 up
347
348 # Setup server namespace
349 ip netns exec server ip addr add 172.31.110.20/24 dev s1
350 ip netns exec server ip link set s1 up
351
352 # Check if drop reasons can be sent
353 ovs_add_flow "test_drop_reason" dropreason \
354 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null
355 if [ $? == 1 ]; then
356 info "no support for drop reasons - skipping"
357 ovs_exit_sig
358 return $ksft_skip
359 fi
360
361 ovs_del_flows "test_drop_reason" dropreason
362
363 # Allow ARP
364 ovs_add_flow "test_drop_reason" dropreason \
365 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
366 ovs_add_flow "test_drop_reason" dropreason \
367 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
368
369 # Allow client ICMP traffic but drop return path
370 ovs_add_flow "test_drop_reason" dropreason \
371 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2'
372 ovs_add_flow "test_drop_reason" dropreason \
373 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop'
374
375 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20
376 ovs_drop_reason_count 0x30001 # OVS_DROP_FLOW_ACTION
377 if [[ "$?" -ne "2" ]]; then
378 info "Did not detect expected drops: $?"
379 return 1
380 fi
381
382 # Drop UDP 6000 traffic with an explicit action and an error code.
383 ovs_add_flow "test_drop_reason" dropreason \
384 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \
385 'drop(42)'
386 # Drop UDP 7000 traffic with an explicit action with no error code.
387 ovs_add_flow "test_drop_reason" dropreason \
388 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \
389 'drop(0)'
390
391 ovs_drop_record_and_run \
392 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000
393 ovs_drop_reason_count 0x30004 # OVS_DROP_EXPLICIT_ACTION_ERROR
394 if [[ "$?" -ne "1" ]]; then
395 info "Did not detect expected explicit error drops: $?"
396 return 1
397 fi
398
399 ovs_drop_record_and_run \
400 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000
401 ovs_drop_reason_count 0x30003 # OVS_DROP_EXPLICIT_ACTION
402 if [[ "$?" -ne "1" ]]; then
403 info "Did not detect expected explicit drops: $?"
404 return 1
405 fi
406
407 return 0
408}
409
410# arp_ping test
411# - client has 1500 byte MTU
412# - server has 1500 byte MTU
413# - send ARP ping between two ns
414test_arp_ping () {
415
416 which arping >/dev/null 2>&1 || return $ksft_skip
417
418 sbx_add "test_arp_ping" || return $?
419
420 ovs_add_dp "test_arp_ping" arpping || return 1
421
422 info "create namespaces"
423 for ns in client server; do
424 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \
425 "${ns:0:1}0" "${ns:0:1}1" || return 1
426 done
427
428 # Setup client namespace
429 ip netns exec client ip addr add 172.31.110.10/24 dev c1
430 ip netns exec client ip link set c1 up
431 HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`
432 info "Client hwaddr: $HW_CLIENT"
433
434 # Setup server namespace
435 ip netns exec server ip addr add 172.31.110.20/24 dev s1
436 ip netns exec server ip link set s1 up
437 HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`
438 info "Server hwaddr: $HW_SERVER"
439
440 ovs_add_flow "test_arp_ping" arpping \
441 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1
442 ovs_add_flow "test_arp_ping" arpping \
443 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1
444
445 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1
446
447 return 0
448}
449
450# ct_connect_v4 test
451# - client has 1500 byte MTU
452# - server has 1500 byte MTU
453# - use ICMP to ping in each direction
454# - only allow CT state stuff to pass through new in c -> s
455test_ct_connect_v4 () {
456
457 which nc >/dev/null 2>/dev/null || return $ksft_skip
458
459 sbx_add "test_ct_connect_v4" || return $?
460
461 ovs_add_dp "test_ct_connect_v4" ct4 || return 1
462 info "create namespaces"
463 for ns in client server; do
464 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \
465 "${ns:0:1}0" "${ns:0:1}1" || return 1
466 done
467
468 ip netns exec client ip addr add 172.31.110.10/24 dev c1
469 ip netns exec client ip link set c1 up
470 ip netns exec server ip addr add 172.31.110.20/24 dev s1
471 ip netns exec server ip link set s1 up
472
473 # Add forwarding for ARP and ip packets - completely wildcarded
474 ovs_add_flow "test_ct_connect_v4" ct4 \
475 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
476 ovs_add_flow "test_ct_connect_v4" ct4 \
477 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
478 ovs_add_flow "test_ct_connect_v4" ct4 \
479 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \
480 'ct(commit),recirc(0x1)' || return 1
481 ovs_add_flow "test_ct_connect_v4" ct4 \
482 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \
483 '2' || return 1
484 ovs_add_flow "test_ct_connect_v4" ct4 \
485 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \
486 '2' || return 1
487 ovs_add_flow "test_ct_connect_v4" ct4 \
488 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \
489 '1' || return 1
490 ovs_add_flow "test_ct_connect_v4" ct4 \
491 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \
492 return 1
493
494 # do a ping
495 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1
496
497 # create an echo server in 'server'
498 echo "server" | \
499 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \
500 nc -lvnp 4443
501 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1
502
503 # Now test in the other direction (should fail)
504 echo "client" | \
505 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \
506 nc -lvnp 4443
507 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443
508 if [ $? == 0 ]; then
509 info "ct connect to client was successful"
510 return 1
511 fi
512
513 info "done..."
514 return 0
515}
516
517# connect_v4 test
518# - client has 1500 byte MTU
519# - server has 1500 byte MTU
520# - use ICMP to ping in each direction
521test_connect_v4 () {
522
523 sbx_add "test_connect_v4" || return $?
524
525 ovs_add_dp "test_connect_v4" cv4 || return 1
526
527 info "create namespaces"
528 for ns in client server; do
529 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \
530 "${ns:0:1}0" "${ns:0:1}1" || return 1
531 done
532
533
534 ip netns exec client ip addr add 172.31.110.10/24 dev c1
535 ip netns exec client ip link set c1 up
536 ip netns exec server ip addr add 172.31.110.20/24 dev s1
537 ip netns exec server ip link set s1 up
538
539 # Add forwarding for ARP and ip packets - completely wildcarded
540 ovs_add_flow "test_connect_v4" cv4 \
541 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
542 ovs_add_flow "test_connect_v4" cv4 \
543 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
544 ovs_add_flow "test_connect_v4" cv4 \
545 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1
546 ovs_add_flow "test_connect_v4" cv4 \
547 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1
548
549 # do a ping
550 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1
551
552 info "done..."
553 return 0
554}
555
556# nat_connect_v4 test
557# - client has 1500 byte MTU
558# - server has 1500 byte MTU
559# - use ICMP to ping in each direction
560# - only allow CT state stuff to pass through new in c -> s
561test_nat_connect_v4 () {
562 which nc >/dev/null 2>/dev/null || return $ksft_skip
563
564 sbx_add "test_nat_connect_v4" || return $?
565
566 ovs_add_dp "test_nat_connect_v4" nat4 || return 1
567 info "create namespaces"
568 for ns in client server; do
569 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \
570 "${ns:0:1}0" "${ns:0:1}1" || return 1
571 done
572
573 ip netns exec client ip addr add 172.31.110.10/24 dev c1
574 ip netns exec client ip link set c1 up
575 ip netns exec server ip addr add 172.31.110.20/24 dev s1
576 ip netns exec server ip link set s1 up
577
578 ip netns exec client ip route add default via 172.31.110.20
579
580 ovs_add_flow "test_nat_connect_v4" nat4 \
581 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
582 ovs_add_flow "test_nat_connect_v4" nat4 \
583 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
584 ovs_add_flow "test_nat_connect_v4" nat4 \
585 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \
586 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)"
587 ovs_add_flow "test_nat_connect_v4" nat4 \
588 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
589 "ct(commit,nat),recirc(0x2)"
590
591 ovs_add_flow "test_nat_connect_v4" nat4 \
592 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2"
593 ovs_add_flow "test_nat_connect_v4" nat4 \
594 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1"
595
596 # do a ping
597 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1
598
599 # create an echo server in 'server'
600 echo "server" | \
601 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \
602 nc -lvnp 4443
603 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1
604
605 # Now test in the other direction (should fail)
606 echo "client" | \
607 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \
608 nc -lvnp 4443
609 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443
610 if [ $? == 0 ]; then
611 info "connect to client was successful"
612 return 1
613 fi
614
615 info "done..."
616 return 0
617}
618
619# nat_related_v4 test
620# - client->server ip packets go via SNAT
621# - client solicits ICMP destination unreachable packet from server
622# - undo NAT for ICMP reply and test dst ip has been updated
623test_nat_related_v4 () {
624 which nc >/dev/null 2>/dev/null || return $ksft_skip
625
626 sbx_add "test_nat_related_v4" || return $?
627
628 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1
629 info "create namespaces"
630 for ns in client server; do
631 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \
632 "${ns:0:1}0" "${ns:0:1}1" || return 1
633 done
634
635 ip netns exec client ip addr add 172.31.110.10/24 dev c1
636 ip netns exec client ip link set c1 up
637 ip netns exec server ip addr add 172.31.110.20/24 dev s1
638 ip netns exec server ip link set s1 up
639
640 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10
641
642 # Allow ARP
643 ovs_add_flow "test_nat_related_v4" natrelated4 \
644 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1
645 ovs_add_flow "test_nat_related_v4" natrelated4 \
646 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1
647
648 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20
649 ovs_add_flow "test_nat_related_v4" natrelated4 \
650 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \
651 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1
652 ovs_add_flow "test_nat_related_v4" natrelated4 \
653 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \
654 "2" || return 1
655
656 # Allow related ICMP responses back from server and undo NAT to restore original IP
657 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP
658 ovs_add_flow "test_nat_related_v4" natrelated4 \
659 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
660 "ct(commit,nat),recirc(0x2)" || return 1
661 ovs_add_flow "test_nat_related_v4" natrelated4 \
662 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \
663 "1" || return 1
664 ovs_add_flow "test_nat_related_v4" natrelated4 \
665 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \
666 "drop" || return 1
667
668 # Solicit destination unreachable response from server
669 ovs_sbx "test_nat_related_v4" ip netns exec client \
670 bash -c "echo a | nc -u -w 1 172.31.110.20 10000"
671
672 # Check to make sure no packets matched the drop rule with incorrect dst ip
673 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \
674 | grep "drop" | grep "packets:0" >/dev/null || return 1
675
676 info "done..."
677 return 0
678}
679
680# netlink_validation
681# - Create a dp
682# - check no warning with "old version" simulation
683test_netlink_checks () {
684 sbx_add "test_netlink_checks" || return 1
685
686 info "setting up new DP"
687 ovs_add_dp "test_netlink_checks" nv0 || return 1
688 # now try again
689 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")
690 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1
691 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")
692 if [ "$PRE_TEST" != "$POST_TEST" ]; then
693 info "failed - gen warning"
694 return 1
695 fi
696
697 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \
698 return 1
699 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \
700 return 1
701 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \
702 wc -l) == 3 ] || \
703 return 1
704 ovs_del_if "test_netlink_checks" nv0 right0 || return 1
705 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \
706 wc -l) == 2 ] || \
707 return 1
708
709 info "Checking clone depth"
710 ERR_MSG="Flow actions may not be safe on all matching packets"
711 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
712 ovs_add_flow "test_netlink_checks" nv0 \
713 'in_port(1),eth(),eth_type(0x800),ipv4()' \
714 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \
715 >/dev/null 2>&1 && return 1
716 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
717
718 if [ "$PRE_TEST" == "$POST_TEST" ]; then
719 info "failed - clone depth too large"
720 return 1
721 fi
722
723 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
724 ovs_add_flow "test_netlink_checks" nv0 \
725 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \
726 &> /dev/null && return 1
727 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
728 if [ "$PRE_TEST" == "$POST_TEST" ]; then
729 info "failed - error not generated"
730 return 1
731 fi
732 return 0
733}
734
735test_upcall_interfaces() {
736 sbx_add "test_upcall_interfaces" || return 1
737
738 info "setting up new DP"
739 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1
740
741 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \
742 172.31.110.1/24 -u || return 1
743
744 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out
745
746 info "sending arping"
747 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \
748 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr
749
750 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1
751 return 0
752}
753
754run_test() {
755 (
756 tname="$1"
757 tdesc="$2"
758
759 if python3 ovs-dpctl.py -h 2>&1 | \
760 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then
761 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}"
762 return $ksft_skip
763 fi
764
765 python3 ovs-dpctl.py show >/dev/null 2>&1 || \
766 echo "[DPCTL] show exception."
767
768 if ! lsmod | grep openvswitch >/dev/null 2>&1; then
769 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}"
770 return $ksft_skip
771 fi
772
773 printf "TEST: %-60s [START]\n" "${tname}"
774
775 unset IFS
776
777 eval test_${tname}
778 ret=$?
779
780 if [ $ret -eq 0 ]; then
781 printf "TEST: %-60s [ OK ]\n" "${tdesc}"
782 ovs_exit_sig
783 rm -rf "$ovs_dir"
784 elif [ $ret -eq 1 ]; then
785 printf "TEST: %-60s [FAIL]\n" "${tdesc}"
786 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
787 echo
788 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue"
789 read a
790 fi
791 ovs_exit_sig
792 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir"
793 exit 1
794 elif [ $ret -eq $ksft_skip ]; then
795 printf "TEST: %-60s [SKIP]\n" "${tdesc}"
796 elif [ $ret -eq 2 ]; then
797 rm -rf test_${tname}
798 run_test "$1" "$2"
799 fi
800
801 return $ret
802 )
803 ret=$?
804 case $ret in
805 0)
806 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0
807 all_skipped=false
808 ;;
809 $ksft_skip)
810 [ $all_skipped = true ] && exitcode=$ksft_skip
811 ;;
812 *)
813 all_skipped=false
814 exitcode=1
815 ;;
816 esac
817
818 return $ret
819}
820
821
822exitcode=0
823desc=0
824all_skipped=true
825
826while getopts :pvt o
827do
828 case $o in
829 p) PAUSE_ON_FAIL=yes;;
830 v) VERBOSE=1;;
831 t) if which tcpdump > /dev/null 2>&1; then
832 TRACING=1
833 else
834 echo "=== tcpdump not available, tracing disabled"
835 fi
836 ;;
837 *) usage;;
838 esac
839done
840shift $(($OPTIND-1))
841
842IFS="
843"
844
845for arg do
846 # Check first that all requested tests are available before running any
847 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; }
848done
849
850name=""
851desc=""
852for t in ${tests}; do
853 [ "${name}" = "" ] && name="${t}" && continue
854 [ "${desc}" = "" ] && desc="${t}"
855
856 run_this=1
857 for arg do
858 [ "${arg}" != "${arg#--*}" ] && continue
859 [ "${arg}" = "${name}" ] && run_this=1 && break
860 run_this=0
861 done
862 if [ $run_this -eq 1 ]; then
863 run_test "${name}" "${desc}"
864 fi
865 name=""
866 desc=""
867done
868
869exit ${exitcode}