1 #!/bin/bash
2 # SPDX-License-Identifier: GPL-2.0
3 #
4 # OVS kernel module self tests
5
6 trap ovs_exit_sig EXIT TERM INT ERR
7
8 # Kselftest framework requirement - SKIP code is 4.
9 ksft_skip=4
10
11 PAUSE_ON_FAIL=no
12 VERBOSE=0
13 TRACING=0
14 WAIT_TIMEOUT=5
15
16 if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then
17 WAIT_TIMEOUT=10
18 fi
19
20 tests="
21 arp_ping eth-arp: Basic arp ping between two NS
22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct
23 connect_v4 ip4-xon: Basic ipv4 ping between two NS
24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT
25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT
26 netlink_checks ovsnl: validate netlink attrs and settings
27 upcall_interfaces ovs: test the upcall interfaces
28 drop_reason drop: test drop reasons are emitted
29 psample psample: Sampling packets with psample"
30
31 info() {
32 [ "${ovs_dir}" != "" ] &&
33 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log
34 [ $VERBOSE = 0 ] || echo $*
35 }
36
37 ovs_wait() {
38 info "waiting $WAIT_TIMEOUT s for: $@"
39
40 if "$@" ; then
41 info "wait succeeded immediately"
42 return 0
43 fi
44
45 # A quick re-check helps speed up small races in fast systems.
46 # However, fractional sleeps might not necessarily work.
47 local start=0
48 sleep 0.1 || { sleep 1; start=1; }
49
50 for (( i=start; i<WAIT_TIMEOUT; i++ )); do
51 if "$@" ; then
52 info "wait succeeded after $i seconds"
53 return 0
54 fi
55 sleep 1
56 done
57 info "wait failed after $i seconds"
58 return 1
59 }
60
61 ovs_base=`pwd`
62 sbxs=
63 sbx_add () {
64 info "adding sandbox '$1'"
65
66 sbxs="$sbxs $1"
67
68 NO_BIN=0
69
70 # Create sandbox.
71 local d="$ovs_base"/$1
72 if [ -e $d ]; then
73 info "removing $d"
74 rm -rf "$d"
75 fi
76 mkdir "$d" || return 1
77 ovs_setenv $1
78 }
79
80 ovs_exit_sig() {
81 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup"
82 }
83
84 on_exit() {
85 echo "$1" > ${ovs_dir}/cleanup.tmp
86 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp
87 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup
88 }
89
90 ovs_setenv() {
91 sandbox=$1
92
93 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir
94
95 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup
96 }
97
98 ovs_sbx() {
99 if test "X$2" != X; then
100 (ovs_setenv $1; shift;
101 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log)
102 else
103 ovs_setenv $1
104 fi
105 }
106
107 ovs_add_dp () {
108 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}"
109 sbxname="$1"
110 shift
111 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $*
112 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;"
113 }
114
115 ovs_add_if () {
116 info "Adding IF to DP: br:$2 if:$3"
117 if [ "$4" != "-u" ]; then
118 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if "$2" "$3" \
119 || return 1
120 else
121 python3 $ovs_base/ovs-dpctl.py add-if \
122 -u "$2" "$3" >$ovs_dir/$3.out 2>$ovs_dir/$3.err &
123 pid=$!
124 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null"
125 fi
126 }
127
128 ovs_del_if () {
129 info "Deleting IF from DP: br:$2 if:$3"
130 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1
131 }
132
133 ovs_netns_spawn_daemon() {
134 sbx=$1
135 shift
136 netns=$1
137 shift
138 if [ "$netns" == "_default" ]; then
139 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr &
140 else
141 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr &
142 fi
143 pid=$!
144 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null"
145 }
146
147 ovs_spawn_daemon() {
148 sbx=$1
149 shift
150 ovs_netns_spawn_daemon $sbx "_default" $*
151 }
152
153 ovs_add_netns_and_veths () {
154 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}"
155 ovs_sbx "$1" ip netns add "$3" || return 1
156 on_exit "ovs_sbx $1 ip netns del $3"
157 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1
158 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1"
159 ovs_sbx "$1" ip link set "$4" up || return 1
160 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1
161 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1
162
163 if [ "$6" != "" ]; then
164 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \
165 || return 1
166 fi
167
168 if [ "$7" != "-u" ]; then
169 ovs_add_if "$1" "$2" "$4" || return 1
170 else
171 ovs_add_if "$1" "$2" "$4" -u || return 1
172 fi
173
174 [ $TRACING -eq 1 ] && ovs_netns_spawn_daemon "$1" "$ns" \
175 tcpdump -i any -s 65535
176
177 return 0
178 }
179
180 ovs_add_flow () {
181 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4"
182 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4"
183 if [ $? -ne 0 ]; then
184 info "Flow [ $3 : $4 ] failed"
185 return 1
186 fi
187 return 0
188 }
189
190 ovs_del_flows () {
191 info "Deleting all flows from DP: sbx:$1 br:$2"
192 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2"
193 return 0
194 }
195
196 ovs_drop_record_and_run () {
197 local sbx=$1
198 shift
199
200 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \
201 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr
202 return $?
203 }
204
205 ovs_drop_reason_count()
206 {
207 local reason=$1
208
209 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace`
210 local pattern="skb:kfree_skb:.*reason: $reason"
211
212 return `echo "$perf_output" | grep "$pattern" | wc -l`
213 }
214
215 ovs_test_flow_fails () {
216 ERR_MSG="Flow actions may not be safe on all matching packets"
217
218 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
219 ovs_add_flow $@ &> /dev/null $@ && return 1
220 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
221
222 if [ "$PRE_TEST" == "$POST_TEST" ]; then
223 return 1
224 fi
225 return 0
226 }
227
228 usage() {
229 echo
230 echo "$0 [OPTIONS] [TEST]..."
231 echo "If no TEST argument is given, all tests will be run."
232 echo
233 echo "Options"
234 echo " -t: capture traffic via tcpdump"
235 echo " -v: verbose"
236 echo " -p: pause on failure"
237 echo
238 echo "Available tests${tests}"
239 exit 1
240 }
241
242
243 # psample test
244 # - use psample to observe packets
245 test_psample() {
246 sbx_add "test_psample" || return $?
247
248 # Add a datapath with per-vport dispatching.
249 ovs_add_dp "test_psample" psample -V 2:1 || return 1
250
251 info "create namespaces"
252 ovs_add_netns_and_veths "test_psample" "psample" \
253 client c0 c1 172.31.110.10/24 -u || return 1
254 ovs_add_netns_and_veths "test_psample" "psample" \
255 server s0 s1 172.31.110.20/24 -u || return 1
256
257 # Check if psample actions can be configured.
258 ovs_add_flow "test_psample" psample \
259 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null
260 if [ $? == 1 ]; then
261 info "no support for psample - skipping"
262 ovs_exit_sig
263 return $ksft_skip
264 fi
265
266 ovs_del_flows "test_psample" psample
267
268 # Test action verification.
269 OLDIFS=$IFS
270 IFS='*'
271 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()'
272 for testcase in \
273 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \
274 "no group with cookie"*"psample(cookie=abcd)" \
275 "no group"*"psample()";
276 do
277 set -- $testcase;
278 ovs_test_flow_fails "test_psample" psample $min_key $2
279 if [ $? == 1 ]; then
280 info "failed - $1"
281 return 1
282 fi
283 done
284 IFS=$OLDIFS
285
286 ovs_del_flows "test_psample" psample
287 # Allow ARP
288 ovs_add_flow "test_psample" psample \
289 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
290 ovs_add_flow "test_psample" psample \
291 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
292
293 # Sample first 14 bytes of all traffic.
294 ovs_add_flow "test_psample" psample \
295 "in_port(1),eth(),eth_type(0x0800),ipv4()" \
296 "trunc(14),psample(group=1,cookie=c0ffee),2"
297
298 # Sample all traffic. In this case, use a sample() action with both
299 # psample and an upcall emulating simultaneous local sampling and
300 # sFlow / IPFIX.
301 nlpid=$(grep -E "listening on upcall packet handler" \
302 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ')
303
304 ovs_add_flow "test_psample" psample \
305 "in_port(2),eth(),eth_type(0x0800),ipv4()" \
306 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1"
307
308 # Record psample data.
309 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events
310 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout
311
312 # Send a single ping.
313 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1
314
315 # We should have received one userspace action upcall and 2 psample packets.
316 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1
317
318 # client -> server samples should only contain the first 14 bytes of the packet.
319 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \
320 $ovs_dir/stdout || return 1
321
322 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1
323
324 return 0
325 }
326
327 # drop_reason test
328 # - drop packets and verify the right drop reason is reported
329 test_drop_reason() {
330 which perf >/dev/null 2>&1 || return $ksft_skip
331
332 sbx_add "test_drop_reason" || return $?
333
334 ovs_add_dp "test_drop_reason" dropreason || return 1
335
336 info "create namespaces"
337 for ns in client server; do
338 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \
339 "${ns:0:1}0" "${ns:0:1}1" || return 1
340 done
341
342 # Setup client namespace
343 ip netns exec client ip addr add 172.31.110.10/24 dev c1
344 ip netns exec client ip link set c1 up
345
346 # Setup server namespace
347 ip netns exec server ip addr add 172.31.110.20/24 dev s1
348 ip netns exec server ip link set s1 up
349
350 # Check if drop reasons can be sent
351 ovs_add_flow "test_drop_reason" dropreason \
352 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null
353 if [ $? == 1 ]; then
354 info "no support for drop reasons - skipping"
355 ovs_exit_sig
356 return $ksft_skip
357 fi
358
359 ovs_del_flows "test_drop_reason" dropreason
360
361 # Allow ARP
362 ovs_add_flow "test_drop_reason" dropreason \
363 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
364 ovs_add_flow "test_drop_reason" dropreason \
365 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
366
367 # Allow client ICMP traffic but drop return path
368 ovs_add_flow "test_drop_reason" dropreason \
369 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2'
370 ovs_add_flow "test_drop_reason" dropreason \
371 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop'
372
373 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20
374 ovs_drop_reason_count 0x30001 # OVS_DROP_FLOW_ACTION
375 if [[ "$?" -ne "2" ]]; then
376 info "Did not detect expected drops: $?"
377 return 1
378 fi
379
380 # Drop UDP 6000 traffic with an explicit action and an error code.
381 ovs_add_flow "test_drop_reason" dropreason \
382 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \
383 'drop(42)'
384 # Drop UDP 7000 traffic with an explicit action with no error code.
385 ovs_add_flow "test_drop_reason" dropreason \
386 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \
387 'drop(0)'
388
389 ovs_drop_record_and_run \
390 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000
391 ovs_drop_reason_count 0x30004 # OVS_DROP_EXPLICIT_ACTION_ERROR
392 if [[ "$?" -ne "1" ]]; then
393 info "Did not detect expected explicit error drops: $?"
394 return 1
395 fi
396
397 ovs_drop_record_and_run \
398 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000
399 ovs_drop_reason_count 0x30003 # OVS_DROP_EXPLICIT_ACTION
400 if [[ "$?" -ne "1" ]]; then
401 info "Did not detect expected explicit drops: $?"
402 return 1
403 fi
404
405 return 0
406 }
407
408 # arp_ping test
409 # - client has 1500 byte MTU
410 # - server has 1500 byte MTU
411 # - send ARP ping between two ns
412 test_arp_ping () {
413
414 which arping >/dev/null 2>&1 || return $ksft_skip
415
416 sbx_add "test_arp_ping" || return $?
417
418 ovs_add_dp "test_arp_ping" arpping || return 1
419
420 info "create namespaces"
421 for ns in client server; do
422 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \
423 "${ns:0:1}0" "${ns:0:1}1" || return 1
424 done
425
426 # Setup client namespace
427 ip netns exec client ip addr add 172.31.110.10/24 dev c1
428 ip netns exec client ip link set c1 up
429 HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`
430 info "Client hwaddr: $HW_CLIENT"
431
432 # Setup server namespace
433 ip netns exec server ip addr add 172.31.110.20/24 dev s1
434 ip netns exec server ip link set s1 up
435 HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`
436 info "Server hwaddr: $HW_SERVER"
437
438 ovs_add_flow "test_arp_ping" arpping \
439 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1
440 ovs_add_flow "test_arp_ping" arpping \
441 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1
442
443 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1
444
445 return 0
446 }
447
448 # ct_connect_v4 test
449 # - client has 1500 byte MTU
450 # - server has 1500 byte MTU
451 # - use ICMP to ping in each direction
452 # - only allow CT state stuff to pass through new in c -> s
453 test_ct_connect_v4 () {
454
455 which nc >/dev/null 2>/dev/null || return $ksft_skip
456
457 sbx_add "test_ct_connect_v4" || return $?
458
459 ovs_add_dp "test_ct_connect_v4" ct4 || return 1
460 info "create namespaces"
461 for ns in client server; do
462 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \
463 "${ns:0:1}0" "${ns:0:1}1" || return 1
464 done
465
466 ip netns exec client ip addr add 172.31.110.10/24 dev c1
467 ip netns exec client ip link set c1 up
468 ip netns exec server ip addr add 172.31.110.20/24 dev s1
469 ip netns exec server ip link set s1 up
470
471 # Add forwarding for ARP and ip packets - completely wildcarded
472 ovs_add_flow "test_ct_connect_v4" ct4 \
473 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
474 ovs_add_flow "test_ct_connect_v4" ct4 \
475 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
476 ovs_add_flow "test_ct_connect_v4" ct4 \
477 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \
478 'ct(commit),recirc(0x1)' || return 1
479 ovs_add_flow "test_ct_connect_v4" ct4 \
480 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \
481 '2' || return 1
482 ovs_add_flow "test_ct_connect_v4" ct4 \
483 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \
484 '2' || return 1
485 ovs_add_flow "test_ct_connect_v4" ct4 \
486 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \
487 '1' || return 1
488 ovs_add_flow "test_ct_connect_v4" ct4 \
489 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \
490 return 1
491
492 # do a ping
493 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1
494
495 # create an echo server in 'server'
496 echo "server" | \
497 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \
498 nc -lvnp 4443
499 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1
500
501 # Now test in the other direction (should fail)
502 echo "client" | \
503 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \
504 nc -lvnp 4443
505 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443
506 if [ $? == 0 ]; then
507 info "ct connect to client was successful"
508 return 1
509 fi
510
511 info "done..."
512 return 0
513 }
514
515 # connect_v4 test
516 # - client has 1500 byte MTU
517 # - server has 1500 byte MTU
518 # - use ICMP to ping in each direction
519 test_connect_v4 () {
520
521 sbx_add "test_connect_v4" || return $?
522
523 ovs_add_dp "test_connect_v4" cv4 || return 1
524
525 info "create namespaces"
526 for ns in client server; do
527 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \
528 "${ns:0:1}0" "${ns:0:1}1" || return 1
529 done
530
531
532 ip netns exec client ip addr add 172.31.110.10/24 dev c1
533 ip netns exec client ip link set c1 up
534 ip netns exec server ip addr add 172.31.110.20/24 dev s1
535 ip netns exec server ip link set s1 up
536
537 # Add forwarding for ARP and ip packets - completely wildcarded
538 ovs_add_flow "test_connect_v4" cv4 \
539 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
540 ovs_add_flow "test_connect_v4" cv4 \
541 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
542 ovs_add_flow "test_connect_v4" cv4 \
543 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1
544 ovs_add_flow "test_connect_v4" cv4 \
545 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1
546
547 # do a ping
548 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1
549
550 info "done..."
551 return 0
552 }
553
554 # nat_connect_v4 test
555 # - client has 1500 byte MTU
556 # - server has 1500 byte MTU
557 # - use ICMP to ping in each direction
558 # - only allow CT state stuff to pass through new in c -> s
559 test_nat_connect_v4 () {
560 which nc >/dev/null 2>/dev/null || return $ksft_skip
561
562 sbx_add "test_nat_connect_v4" || return $?
563
564 ovs_add_dp "test_nat_connect_v4" nat4 || return 1
565 info "create namespaces"
566 for ns in client server; do
567 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \
568 "${ns:0:1}0" "${ns:0:1}1" || return 1
569 done
570
571 ip netns exec client ip addr add 172.31.110.10/24 dev c1
572 ip netns exec client ip link set c1 up
573 ip netns exec server ip addr add 172.31.110.20/24 dev s1
574 ip netns exec server ip link set s1 up
575
576 ip netns exec client ip route add default via 172.31.110.20
577
578 ovs_add_flow "test_nat_connect_v4" nat4 \
579 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
580 ovs_add_flow "test_nat_connect_v4" nat4 \
581 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
582 ovs_add_flow "test_nat_connect_v4" nat4 \
583 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \
584 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)"
585 ovs_add_flow "test_nat_connect_v4" nat4 \
586 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
587 "ct(commit,nat),recirc(0x2)"
588
589 ovs_add_flow "test_nat_connect_v4" nat4 \
590 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2"
591 ovs_add_flow "test_nat_connect_v4" nat4 \
592 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1"
593
594 # do a ping
595 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1
596
597 # create an echo server in 'server'
598 echo "server" | \
599 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \
600 nc -lvnp 4443
601 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1
602
603 # Now test in the other direction (should fail)
604 echo "client" | \
605 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \
606 nc -lvnp 4443
607 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443
608 if [ $? == 0 ]; then
609 info "connect to client was successful"
610 return 1
611 fi
612
613 info "done..."
614 return 0
615 }
616
617 # nat_related_v4 test
618 # - client->server ip packets go via SNAT
619 # - client solicits ICMP destination unreachable packet from server
620 # - undo NAT for ICMP reply and test dst ip has been updated
621 test_nat_related_v4 () {
622 which nc >/dev/null 2>/dev/null || return $ksft_skip
623
624 sbx_add "test_nat_related_v4" || return $?
625
626 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1
627 info "create namespaces"
628 for ns in client server; do
629 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \
630 "${ns:0:1}0" "${ns:0:1}1" || return 1
631 done
632
633 ip netns exec client ip addr add 172.31.110.10/24 dev c1
634 ip netns exec client ip link set c1 up
635 ip netns exec server ip addr add 172.31.110.20/24 dev s1
636 ip netns exec server ip link set s1 up
637
638 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10
639
640 # Allow ARP
641 ovs_add_flow "test_nat_related_v4" natrelated4 \
642 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1
643 ovs_add_flow "test_nat_related_v4" natrelated4 \
644 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1
645
646 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20
647 ovs_add_flow "test_nat_related_v4" natrelated4 \
648 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \
649 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1
650 ovs_add_flow "test_nat_related_v4" natrelated4 \
651 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \
652 "2" || return 1
653
654 # Allow related ICMP responses back from server and undo NAT to restore original IP
655 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP
656 ovs_add_flow "test_nat_related_v4" natrelated4 \
657 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
658 "ct(commit,nat),recirc(0x2)" || return 1
659 ovs_add_flow "test_nat_related_v4" natrelated4 \
660 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \
661 "1" || return 1
662 ovs_add_flow "test_nat_related_v4" natrelated4 \
663 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \
664 "drop" || return 1
665
666 # Solicit destination unreachable response from server
667 ovs_sbx "test_nat_related_v4" ip netns exec client \
668 bash -c "echo a | nc -u -w 1 172.31.110.20 10000"
669
670 # Check to make sure no packets matched the drop rule with incorrect dst ip
671 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \
672 | grep "drop" | grep "packets:0" >/dev/null || return 1
673
674 info "done..."
675 return 0
676 }
677
678 # netlink_validation
679 # - Create a dp
680 # - check no warning with "old version" simulation
681 test_netlink_checks () {
682 sbx_add "test_netlink_checks" || return 1
683
684 info "setting up new DP"
685 ovs_add_dp "test_netlink_checks" nv0 || return 1
686 # now try again
687 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")
688 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1
689 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")
690 if [ "$PRE_TEST" != "$POST_TEST" ]; then
691 info "failed - gen warning"
692 return 1
693 fi
694
695 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \
696 return 1
697 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \
698 return 1
699 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \
700 wc -l) == 3 ] || \
701 return 1
702 ovs_del_if "test_netlink_checks" nv0 right0 || return 1
703 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \
704 wc -l) == 2 ] || \
705 return 1
706
707 info "Checking clone depth"
708 ERR_MSG="Flow actions may not be safe on all matching packets"
709 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
710 ovs_add_flow "test_netlink_checks" nv0 \
711 'in_port(1),eth(),eth_type(0x800),ipv4()' \
712 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \
713 >/dev/null 2>&1 && return 1
714 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
715
716 if [ "$PRE_TEST" == "$POST_TEST" ]; then
717 info "failed - clone depth too large"
718 return 1
719 fi
720
721 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
722 ovs_add_flow "test_netlink_checks" nv0 \
723 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \
724 &> /dev/null && return 1
725 POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
726 if [ "$PRE_TEST" == "$POST_TEST" ]; then
727 info "failed - error not generated"
728 return 1
729 fi
730 return 0
731 }
732
733 test_upcall_interfaces() {
734 sbx_add "test_upcall_interfaces" || return 1
735
736 info "setting up new DP"
737 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1
738
739 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \
740 172.31.110.1/24 -u || return 1
741
742 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out
743
744 info "sending arping"
745 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \
746 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr
747
748 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1
749 return 0
750 }
751
752 run_test() {
753 (
754 tname="$1"
755 tdesc="$2"
756
757 if python3 ovs-dpctl.py -h 2>&1 | \
758 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then
759 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}"
760 return $ksft_skip
761 fi
762
763 python3 ovs-dpctl.py show >/dev/null 2>&1 || \
764 echo "[DPCTL] show exception."
765
766 if ! lsmod | grep openvswitch >/dev/null 2>&1; then
767 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}"
768 return $ksft_skip
769 fi
770
771 printf "TEST: %-60s [START]\n" "${tname}"
772
773 unset IFS
774
775 eval test_${tname}
776 ret=$?
777
778 if [ $ret -eq 0 ]; then
779 printf "TEST: %-60s [ OK ]\n" "${tdesc}"
780 ovs_exit_sig
781 rm -rf "$ovs_dir"
782 elif [ $ret -eq 1 ]; then
783 printf "TEST: %-60s [FAIL]\n" "${tdesc}"
784 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
785 echo
786 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue"
787 read a
788 fi
789 ovs_exit_sig
790 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir"
791 exit 1
792 elif [ $ret -eq $ksft_skip ]; then
793 printf "TEST: %-60s [SKIP]\n" "${tdesc}"
794 elif [ $ret -eq 2 ]; then
795 rm -rf test_${tname}
796 run_test "$1" "$2"
797 fi
798
799 return $ret
800 )
801 ret=$?
802 case $ret in
803 0)
804 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0
805 all_skipped=false
806 ;;
807 $ksft_skip)
808 [ $all_skipped = true ] && exitcode=$ksft_skip
809 ;;
810 *)
811 all_skipped=false
812 exitcode=1
813 ;;
814 esac
815
816 return $ret
817 }
818
819
820 exitcode=0
821 desc=0
822 all_skipped=true
823
824 while getopts :pvt o
825 do
826 case $o in
827 p) PAUSE_ON_FAIL=yes;;
828 v) VERBOSE=1;;
829 t) if which tcpdump > /dev/null 2>&1; then
830 TRACING=1
831 else
832 echo "=== tcpdump not available, tracing disabled"
833 fi
834 ;;
835 *) usage;;
836 esac
837 done
838 shift $(($OPTIND-1))
839
840 IFS="
841 "
842
843 for arg do
844 # Check first that all requested tests are available before running any
845 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; }
846 done
847
848 name=""
849 desc=""
850 for t in ${tests}; do
851 [ "${name}" = "" ] && name="${t}" && continue
852 [ "${desc}" = "" ] && desc="${t}"
853
854 run_this=1
855 for arg do
856 [ "${arg}" != "${arg#--*}" ] && continue
857 [ "${arg}" = "${name}" ] && run_this=1 && break
858 run_this=0
859 done
860 if [ $run_this -eq 1 ]; then
861 run_test "${name}" "${desc}"
862 fi
863 name=""
864 desc=""
865 done
866
867 exit ${exitcode}
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.