1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# OVS kernel module self tests
5
6trap ovs_exit_sig EXIT TERM INT ERR
7
8# Kselftest framework requirement - SKIP code is 4.
9ksft_skip=4
10
11PAUSE_ON_FAIL=no
12VERBOSE=0
13TRACING=0
14WAIT_TIMEOUT=5
15
16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then
17	WAIT_TIMEOUT=10
18fi
19
20tests="
21	arp_ping				eth-arp: Basic arp ping between two NS
22	ct_connect_v4				ip4-ct-xon: Basic ipv4 tcp connection using ct
23	connect_v4				ip4-xon: Basic ipv4 ping between two NS
24	nat_connect_v4				ip4-nat-xon: Basic ipv4 tcp connection via NAT
25	nat_related_v4				ip4-nat-related: ICMP related matches work with SNAT
26	netlink_checks				ovsnl: validate netlink attrs and settings
27	upcall_interfaces			ovs: test the upcall interfaces
28	drop_reason				drop: test drop reasons are emitted
29	psample					psample: Sampling packets with psample"
30
31info() {
32	[ "${ovs_dir}" != "" ] &&
33		echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log
34	[ $VERBOSE = 0 ] || echo $*
35}
36
37ovs_wait() {
38	info "waiting $WAIT_TIMEOUT s for: $@"
39
40	if "$@" ; then
41		info "wait succeeded immediately"
42		return 0
43	fi
44
45	# A quick re-check helps speed up small races in fast systems.
46	# However, fractional sleeps might not necessarily work.
47	local start=0
48	sleep 0.1 || { sleep 1; start=1; }
49
50	for (( i=start; i<WAIT_TIMEOUT; i++ )); do
51		if "$@" ; then
52			info "wait succeeded after $i seconds"
53			return 0
54		fi
55		sleep 1
56	done
57	info "wait failed after $i seconds"
58	return 1
59}
60
61ovs_base=`pwd`
62sbxs=
63sbx_add () {
64	info "adding sandbox '$1'"
65
66	sbxs="$sbxs $1"
67
68	NO_BIN=0
69
70	# Create sandbox.
71	local d="$ovs_base"/$1
72	if [ -e $d ]; then
73		info "removing $d"
74		rm -rf "$d"
75	fi
76	mkdir "$d" || return 1
77	ovs_setenv $1
78}
79
80ovs_exit_sig() {
81	[ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup"
82}
83
84on_exit() {
85	echo "$1" > ${ovs_dir}/cleanup.tmp
86	cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp
87	mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup
88}
89
90ovs_setenv() {
91	sandbox=$1
92
93	ovs_dir=$ovs_base${1:+/$1}; export ovs_dir
94
95	test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup
96}
97
98ovs_sbx() {
99	if test "X$2" != X; then
100		(ovs_setenv $1; shift;
101		 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log)
102	else
103		ovs_setenv $1
104	fi
105}
106
107ovs_add_dp () {
108	info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}"
109	sbxname="$1"
110	shift
111	ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $*
112	on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;"
113}
114
115ovs_add_if () {
116	info "Adding IF to DP: br:$2 if:$3"
117	if [ "$4" != "-u" ]; then
118		ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if "$2" "$3" \
119		    || return 1
120	else
121		python3 $ovs_base/ovs-dpctl.py add-if \
122		    -u "$2" "$3" >$ovs_dir/$3.out 2>$ovs_dir/$3.err &
123		pid=$!
124		on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null"
125	fi
126}
127
128ovs_del_if () {
129	info "Deleting IF from DP: br:$2 if:$3"
130	ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1
131}
132
133ovs_netns_spawn_daemon() {
134	sbx=$1
135	shift
136	netns=$1
137	shift
138	if [ "$netns" == "_default" ]; then
139		$*  >> $ovs_dir/stdout  2>> $ovs_dir/stderr &
140	else
141		ip netns exec $netns $*  >> $ovs_dir/stdout  2>> $ovs_dir/stderr &
142	fi
143	pid=$!
144	ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null"
145}
146
147ovs_spawn_daemon() {
148	sbx=$1
149	shift
150	ovs_netns_spawn_daemon $sbx "_default" $*
151}
152
153ovs_add_netns_and_veths () {
154	info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}"
155	ovs_sbx "$1" ip netns add "$3" || return 1
156	on_exit "ovs_sbx $1 ip netns del $3"
157	ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1
158	on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1"
159	ovs_sbx "$1" ip link set "$4" up || return 1
160	ovs_sbx "$1" ip link set "$5" netns "$3" || return 1
161	ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1
162
163	if [ "$6" != "" ]; then
164		ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \
165		    || return 1
166	fi
167
168	if [ "$7" != "-u" ]; then
169		ovs_add_if "$1" "$2" "$4" || return 1
170	else
171		ovs_add_if "$1" "$2" "$4" -u || return 1
172	fi
173
174	if [ $TRACING -eq 1 ]; then
175		ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553
176		ovs_wait grep -q "listening on any" ${ovs_dir}/stderr
177	fi
178
179	return 0
180}
181
182ovs_add_flow () {
183	info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4"
184	ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4"
185	if [ $? -ne 0 ]; then
186		info "Flow [ $3 : $4 ] failed"
187		return 1
188	fi
189	return 0
190}
191
192ovs_del_flows () {
193	info "Deleting all flows from DP: sbx:$1 br:$2"
194	ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2"
195	return 0
196}
197
198ovs_drop_record_and_run () {
199	local sbx=$1
200	shift
201
202	perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \
203		>> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr
204	return $?
205}
206
207ovs_drop_reason_count()
208{
209	local reason=$1
210
211	local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace`
212	local pattern="skb:kfree_skb:.*reason: $reason"
213
214	return `echo "$perf_output" | grep "$pattern" | wc -l`
215}
216
217ovs_test_flow_fails () {
218	ERR_MSG="Flow actions may not be safe on all matching packets"
219
220	PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
221	ovs_add_flow $@ &> /dev/null $@ && return 1
222	POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
223
224	if [ "$PRE_TEST" == "$POST_TEST" ]; then
225		return 1
226	fi
227	return 0
228}
229
230usage() {
231	echo
232	echo "$0 [OPTIONS] [TEST]..."
233	echo "If no TEST argument is given, all tests will be run."
234	echo
235	echo "Options"
236	echo "  -t: capture traffic via tcpdump"
237	echo "  -v: verbose"
238	echo "  -p: pause on failure"
239	echo
240	echo "Available tests${tests}"
241	exit 1
242}
243
244
245# psample test
246# - use psample to observe packets
247test_psample() {
248	sbx_add "test_psample" || return $?
249
250	# Add a datapath with per-vport dispatching.
251	ovs_add_dp "test_psample" psample -V 2:1 || return 1
252
253	info "create namespaces"
254	ovs_add_netns_and_veths "test_psample" "psample" \
255		client c0 c1 172.31.110.10/24 -u || return 1
256	ovs_add_netns_and_veths "test_psample" "psample" \
257		server s0 s1 172.31.110.20/24 -u || return 1
258
259	# Check if psample actions can be configured.
260	ovs_add_flow "test_psample" psample \
261	'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null
262	if [ $? == 1 ]; then
263		info "no support for psample - skipping"
264		ovs_exit_sig
265		return $ksft_skip
266	fi
267
268	ovs_del_flows "test_psample" psample
269
270	# Test action verification.
271	OLDIFS=$IFS
272	IFS='*'
273	min_key='in_port(1),eth(),eth_type(0x0800),ipv4()'
274	for testcase in \
275		"cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \
276		"no group with cookie"*"psample(cookie=abcd)" \
277		"no group"*"psample()";
278	do
279		set -- $testcase;
280		ovs_test_flow_fails "test_psample" psample $min_key $2
281		if [ $? == 1 ]; then
282			info "failed - $1"
283			return 1
284		fi
285	done
286	IFS=$OLDIFS
287
288	ovs_del_flows "test_psample" psample
289	# Allow ARP
290	ovs_add_flow "test_psample" psample \
291		'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
292	ovs_add_flow "test_psample" psample \
293		'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
294
295	# Sample first 14 bytes of all traffic.
296	ovs_add_flow "test_psample" psample \
297	    "in_port(1),eth(),eth_type(0x0800),ipv4()" \
298            "trunc(14),psample(group=1,cookie=c0ffee),2"
299
300	# Sample all traffic. In this case, use a sample() action with both
301	# psample and an upcall emulating simultaneous local sampling and
302	# sFlow / IPFIX.
303	nlpid=$(grep -E "listening on upcall packet handler" \
304            $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ')
305
306	ovs_add_flow "test_psample" psample \
307            "in_port(2),eth(),eth_type(0x0800),ipv4()" \
308            "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1"
309
310	# Record psample data.
311	ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events
312	ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout
313
314	# Send a single ping.
315	ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1
316
317	# We should have received one userspace action upcall and 2 psample packets.
318	ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1
319
320	# client -> server samples should only contain the first 14 bytes of the packet.
321	ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \
322		$ovs_dir/stdout || return 1
323
324	ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1
325
326	return 0
327}
328
329# drop_reason test
330# - drop packets and verify the right drop reason is reported
331test_drop_reason() {
332	which perf >/dev/null 2>&1 || return $ksft_skip
333	which pahole >/dev/null 2>&1 || return $ksft_skip
334
335	ovs_drop_subsys=$(pahole -C skb_drop_reason_subsys |
336			      awk '/OPENVSWITCH/ { print $3; }' |
337			      tr -d ,)
338
339	sbx_add "test_drop_reason" || return $?
340
341	ovs_add_dp "test_drop_reason" dropreason || return 1
342
343	info "create namespaces"
344	for ns in client server; do
345		ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \
346			"${ns:0:1}0" "${ns:0:1}1" || return 1
347	done
348
349	# Setup client namespace
350	ip netns exec client ip addr add 172.31.110.10/24 dev c1
351	ip netns exec client ip link set c1 up
352
353	# Setup server namespace
354	ip netns exec server ip addr add 172.31.110.20/24 dev s1
355	ip netns exec server ip link set s1 up
356
357	# Check if drop reasons can be sent
358	ovs_add_flow "test_drop_reason" dropreason \
359		'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null
360	if [ $? == 1 ]; then
361		info "no support for drop reasons - skipping"
362		ovs_exit_sig
363		return $ksft_skip
364	fi
365
366	ovs_del_flows "test_drop_reason" dropreason
367
368	# Allow ARP
369	ovs_add_flow "test_drop_reason" dropreason \
370		'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
371	ovs_add_flow "test_drop_reason" dropreason \
372		'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
373
374	# Allow client ICMP traffic but drop return path
375	ovs_add_flow "test_drop_reason" dropreason \
376		"in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2'
377	ovs_add_flow "test_drop_reason" dropreason \
378		"in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop'
379
380	ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20
381	ovs_drop_reason_count 0x${ovs_drop_subsys}0001 # OVS_DROP_FLOW_ACTION
382	if [[ "$?" -ne "2" ]]; then
383		info "Did not detect expected drops: $?"
384		return 1
385	fi
386
387	# Drop UDP 6000 traffic with an explicit action and an error code.
388	ovs_add_flow "test_drop_reason" dropreason \
389		"in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \
390                'drop(42)'
391	# Drop UDP 7000 traffic with an explicit action with no error code.
392	ovs_add_flow "test_drop_reason" dropreason \
393		"in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \
394                'drop(0)'
395
396	ovs_drop_record_and_run \
397            "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000
398	ovs_drop_reason_count 0x${ovs_drop_subsys}0004 # OVS_DROP_EXPLICIT_ACTION_ERROR
399	if [[ "$?" -ne "1" ]]; then
400		info "Did not detect expected explicit error drops: $?"
401		return 1
402	fi
403
404	ovs_drop_record_and_run \
405            "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000
406	ovs_drop_reason_count 0x${ovs_drop_subsys}0003 # OVS_DROP_EXPLICIT_ACTION
407	if [[ "$?" -ne "1" ]]; then
408		info "Did not detect expected explicit drops: $?"
409		return 1
410	fi
411
412	return 0
413}
414
415# arp_ping test
416# - client has 1500 byte MTU
417# - server has 1500 byte MTU
418# - send ARP ping between two ns
419test_arp_ping () {
420
421	which arping >/dev/null 2>&1 || return $ksft_skip
422
423	sbx_add "test_arp_ping" || return $?
424
425	ovs_add_dp "test_arp_ping" arpping || return 1
426
427	info "create namespaces"
428	for ns in client server; do
429		ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \
430		    "${ns:0:1}0" "${ns:0:1}1" || return 1
431	done
432
433	# Setup client namespace
434	ip netns exec client ip addr add 172.31.110.10/24 dev c1
435	ip netns exec client ip link set c1 up
436	HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`
437	info "Client hwaddr: $HW_CLIENT"
438
439	# Setup server namespace
440	ip netns exec server ip addr add 172.31.110.20/24 dev s1
441	ip netns exec server ip link set s1 up
442	HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'`
443	info "Server hwaddr: $HW_SERVER"
444
445	ovs_add_flow "test_arp_ping" arpping \
446		"in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1
447	ovs_add_flow "test_arp_ping" arpping \
448		"in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1
449
450	ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1
451
452	return 0
453}
454
455# ct_connect_v4 test
456#  - client has 1500 byte MTU
457#  - server has 1500 byte MTU
458#  - use ICMP to ping in each direction
459#  - only allow CT state stuff to pass through new in c -> s
460test_ct_connect_v4 () {
461
462	which nc >/dev/null 2>/dev/null || return $ksft_skip
463
464	sbx_add "test_ct_connect_v4" || return $?
465
466	ovs_add_dp "test_ct_connect_v4" ct4 || return 1
467	info "create namespaces"
468	for ns in client server; do
469		ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \
470		    "${ns:0:1}0" "${ns:0:1}1" || return 1
471	done
472
473	ip netns exec client ip addr add 172.31.110.10/24 dev c1
474	ip netns exec client ip link set c1 up
475	ip netns exec server ip addr add 172.31.110.20/24 dev s1
476	ip netns exec server ip link set s1 up
477
478	# Add forwarding for ARP and ip packets - completely wildcarded
479	ovs_add_flow "test_ct_connect_v4" ct4 \
480		'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
481	ovs_add_flow "test_ct_connect_v4" ct4 \
482		'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
483	ovs_add_flow "test_ct_connect_v4" ct4 \
484		     'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \
485		     'ct(commit),recirc(0x1)' || return 1
486	ovs_add_flow "test_ct_connect_v4" ct4 \
487		     'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \
488		     '2' || return 1
489	ovs_add_flow "test_ct_connect_v4" ct4 \
490		     'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \
491		     '2' || return 1
492	ovs_add_flow "test_ct_connect_v4" ct4 \
493		     'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \
494		     '1' || return 1
495	ovs_add_flow "test_ct_connect_v4" ct4 \
496		     'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \
497		     return 1
498
499	# do a ping
500	ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1
501
502	# create an echo server in 'server'
503	echo "server" | \
504		ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \
505				nc -lvnp 4443
506	ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1
507
508	# Now test in the other direction (should fail)
509	echo "client" | \
510		ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \
511				nc -lvnp 4443
512	ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443
513	if [ $? == 0 ]; then
514	   info "ct connect to client was successful"
515	   return 1
516	fi
517
518	info "done..."
519	return 0
520}
521
522# connect_v4 test
523#  - client has 1500 byte MTU
524#  - server has 1500 byte MTU
525#  - use ICMP to ping in each direction
526test_connect_v4 () {
527
528	sbx_add "test_connect_v4" || return $?
529
530	ovs_add_dp "test_connect_v4" cv4 || return 1
531
532	info "create namespaces"
533	for ns in client server; do
534		ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \
535		    "${ns:0:1}0" "${ns:0:1}1" || return 1
536	done
537
538
539	ip netns exec client ip addr add 172.31.110.10/24 dev c1
540	ip netns exec client ip link set c1 up
541	ip netns exec server ip addr add 172.31.110.20/24 dev s1
542	ip netns exec server ip link set s1 up
543
544	# Add forwarding for ARP and ip packets - completely wildcarded
545	ovs_add_flow "test_connect_v4" cv4 \
546		'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
547	ovs_add_flow "test_connect_v4" cv4 \
548		'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
549	ovs_add_flow "test_connect_v4" cv4 \
550		'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1
551	ovs_add_flow "test_connect_v4" cv4 \
552		'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1
553
554	# do a ping
555	ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1
556
557	info "done..."
558	return 0
559}
560
561# nat_connect_v4 test
562#  - client has 1500 byte MTU
563#  - server has 1500 byte MTU
564#  - use ICMP to ping in each direction
565#  - only allow CT state stuff to pass through new in c -> s
566test_nat_connect_v4 () {
567	which nc >/dev/null 2>/dev/null || return $ksft_skip
568
569	sbx_add "test_nat_connect_v4" || return $?
570
571	ovs_add_dp "test_nat_connect_v4" nat4 || return 1
572	info "create namespaces"
573	for ns in client server; do
574		ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \
575		    "${ns:0:1}0" "${ns:0:1}1" || return 1
576	done
577
578	ip netns exec client ip addr add 172.31.110.10/24 dev c1
579	ip netns exec client ip link set c1 up
580	ip netns exec server ip addr add 172.31.110.20/24 dev s1
581	ip netns exec server ip link set s1 up
582
583	ip netns exec client ip route add default via 172.31.110.20
584
585	ovs_add_flow "test_nat_connect_v4" nat4 \
586		'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
587	ovs_add_flow "test_nat_connect_v4" nat4 \
588		'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
589	ovs_add_flow "test_nat_connect_v4" nat4 \
590		"ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \
591		"ct(commit,nat(dst=172.31.110.20)),recirc(0x1)"
592	ovs_add_flow "test_nat_connect_v4" nat4 \
593		"ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
594		"ct(commit,nat),recirc(0x2)"
595
596	ovs_add_flow "test_nat_connect_v4" nat4 \
597		"recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2"
598	ovs_add_flow "test_nat_connect_v4" nat4 \
599		"recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1"
600
601	# do a ping
602	ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1
603
604	# create an echo server in 'server'
605	echo "server" | \
606		ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \
607				nc -lvnp 4443
608	ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1
609
610	# Now test in the other direction (should fail)
611	echo "client" | \
612		ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \
613				nc -lvnp 4443
614	ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443
615	if [ $? == 0 ]; then
616	   info "connect to client was successful"
617	   return 1
618	fi
619
620	info "done..."
621	return 0
622}
623
624# nat_related_v4 test
625#  - client->server ip packets go via SNAT
626#  - client solicits ICMP destination unreachable packet from server
627#  - undo NAT for ICMP reply and test dst ip has been updated
628test_nat_related_v4 () {
629	which nc >/dev/null 2>/dev/null || return $ksft_skip
630
631	sbx_add "test_nat_related_v4" || return $?
632
633	ovs_add_dp "test_nat_related_v4" natrelated4 || return 1
634	info "create namespaces"
635	for ns in client server; do
636		ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \
637			"${ns:0:1}0" "${ns:0:1}1" || return 1
638	done
639
640	ip netns exec client ip addr add 172.31.110.10/24 dev c1
641	ip netns exec client ip link set c1 up
642	ip netns exec server ip addr add 172.31.110.20/24 dev s1
643	ip netns exec server ip link set s1 up
644
645	ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10
646
647	# Allow ARP
648	ovs_add_flow "test_nat_related_v4" natrelated4 \
649		"in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1
650	ovs_add_flow "test_nat_related_v4" natrelated4 \
651		"in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1
652
653	# Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20
654	ovs_add_flow "test_nat_related_v4" natrelated4 \
655		"ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \
656		"ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1
657	ovs_add_flow "test_nat_related_v4" natrelated4 \
658		"recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \
659		"2" || return 1
660
661	# Allow related ICMP responses back from server and undo NAT to restore original IP
662	# Drop any ICMP related packets where dst ip hasn't been restored back to original IP
663	ovs_add_flow "test_nat_related_v4" natrelated4 \
664		"ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
665		"ct(commit,nat),recirc(0x2)" || return 1
666	ovs_add_flow "test_nat_related_v4" natrelated4 \
667		"recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \
668		"1" || return 1
669	ovs_add_flow "test_nat_related_v4" natrelated4 \
670		"recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \
671		"drop" || return 1
672
673	# Solicit destination unreachable response from server
674	ovs_sbx "test_nat_related_v4" ip netns exec client \
675		bash -c "echo a | nc -u -w 1 172.31.110.20 10000"
676
677	# Check to make sure no packets matched the drop rule with incorrect dst ip
678	python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \
679		| grep "drop" | grep "packets:0" >/dev/null || return 1
680
681	info "done..."
682	return 0
683}
684
685# netlink_validation
686# - Create a dp
687# - check no warning with "old version" simulation
688test_netlink_checks () {
689	sbx_add "test_netlink_checks" || return 1
690
691	info "setting up new DP"
692	ovs_add_dp "test_netlink_checks" nv0 || return 1
693	# now try again
694	PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")
695	ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1
696	POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+")
697	if [ "$PRE_TEST" != "$POST_TEST" ]; then
698		info "failed - gen warning"
699		return 1
700	fi
701
702	ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \
703	    return 1
704	ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \
705	    return 1
706	[ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \
707	    wc -l) == 3 ] || \
708	      return 1
709	ovs_del_if "test_netlink_checks" nv0 right0 || return 1
710	[ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \
711	    wc -l) == 2 ] || \
712	      return 1
713
714	info "Checking clone depth"
715	ERR_MSG="Flow actions may not be safe on all matching packets"
716	PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
717	ovs_add_flow "test_netlink_checks" nv0 \
718		'in_port(1),eth(),eth_type(0x800),ipv4()' \
719		'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \
720		>/dev/null 2>&1 && return 1
721	POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
722
723	if [ "$PRE_TEST" == "$POST_TEST" ]; then
724		info "failed - clone depth too large"
725		return 1
726	fi
727
728	PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
729	ovs_add_flow "test_netlink_checks" nv0 \
730		'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \
731		&> /dev/null && return 1
732	POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
733	if [ "$PRE_TEST" == "$POST_TEST" ]; then
734		info "failed - error not generated"
735		return 1
736	fi
737	return 0
738}
739
740test_upcall_interfaces() {
741	sbx_add "test_upcall_interfaces" || return 1
742
743	info "setting up new DP"
744	ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1
745
746	ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \
747	    172.31.110.1/24 -u || return 1
748
749	ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out
750
751	info "sending arping"
752	ip netns exec upc arping -I l0 172.31.110.20 -c 1 \
753	    >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr
754
755	grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1
756	return 0
757}
758
759run_test() {
760	(
761	tname="$1"
762	tdesc="$2"
763
764	if python3 ovs-dpctl.py -h 2>&1 | \
765	     grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then
766		stdbuf -o0 printf "TEST: %-60s  [PYLIB]\n" "${tdesc}"
767		return $ksft_skip
768	fi
769
770	python3 ovs-dpctl.py show >/dev/null 2>&1 || \
771		echo "[DPCTL] show exception."
772
773	if ! lsmod | grep openvswitch >/dev/null 2>&1; then
774		stdbuf -o0 printf "TEST: %-60s  [NOMOD]\n" "${tdesc}"
775		return $ksft_skip
776	fi
777
778	printf "TEST: %-60s  [START]\n" "${tname}"
779
780	unset IFS
781
782	eval test_${tname}
783	ret=$?
784
785	if [ $ret -eq 0 ]; then
786		printf "TEST: %-60s  [ OK ]\n" "${tdesc}"
787		ovs_exit_sig
788		rm -rf "$ovs_dir"
789	elif [ $ret -eq 1 ]; then
790		printf "TEST: %-60s  [FAIL]\n" "${tdesc}"
791		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
792			echo
793			echo "Pausing. Logs in $ovs_dir/. Hit enter to continue"
794			read a
795		fi
796		ovs_exit_sig
797		[ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir"
798		exit 1
799	elif [ $ret -eq $ksft_skip ]; then
800		printf "TEST: %-60s  [SKIP]\n" "${tdesc}"
801	elif [ $ret -eq 2 ]; then
802		rm -rf test_${tname}
803		run_test "$1" "$2"
804	fi
805
806	return $ret
807	)
808	ret=$?
809	case $ret in
810		0)
811			[ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0
812			all_skipped=false
813		;;
814		$ksft_skip)
815			[ $all_skipped = true ] && exitcode=$ksft_skip
816		;;
817		*)
818			all_skipped=false
819			exitcode=1
820		;;
821	esac
822
823	return $ret
824}
825
826
827exitcode=0
828desc=0
829all_skipped=true
830
831while getopts :pvt o
832do
833	case $o in
834	p) PAUSE_ON_FAIL=yes;;
835	v) VERBOSE=1;;
836	t) if which tcpdump > /dev/null 2>&1; then
837		TRACING=1
838	   else
839		echo "=== tcpdump not available, tracing disabled"
840	   fi
841	   ;;
842	*) usage;;
843	esac
844done
845shift $(($OPTIND-1))
846
847IFS="
848"
849
850for arg do
851	# Check first that all requested tests are available before running any
852	command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; }
853done
854
855name=""
856desc=""
857for t in ${tests}; do
858	[ "${name}" = "" ]	&& name="${t}"	&& continue
859	[ "${desc}" = "" ]	&& desc="${t}"
860
861	run_this=1
862	for arg do
863		[ "${arg}" != "${arg#--*}" ] && continue
864		[ "${arg}" = "${name}" ] && run_this=1 && break
865		run_this=0
866	done
867	if [ $run_this -eq 1 ]; then
868		run_test "${name}" "${desc}"
869	fi
870	name=""
871	desc=""
872done
873
874exit ${exitcode}
875