1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# OVS kernel module self tests 5 6trap ovs_exit_sig EXIT TERM INT ERR 7 8# Kselftest framework requirement - SKIP code is 4. 9ksft_skip=4 10 11PAUSE_ON_FAIL=no 12VERBOSE=0 13TRACING=0 14WAIT_TIMEOUT=5 15 16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then 17 WAIT_TIMEOUT=10 18fi 19 20tests=" 21 arp_ping eth-arp: Basic arp ping between two NS 22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct 23 connect_v4 ip4-xon: Basic ipv4 ping between two NS 24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT 25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT 26 netlink_checks ovsnl: validate netlink attrs and settings 27 upcall_interfaces ovs: test the upcall interfaces 28 drop_reason drop: test drop reasons are emitted 29 psample psample: Sampling packets with psample" 30 31info() { 32 [ "${ovs_dir}" != "" ] && 33 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log 34 [ $VERBOSE = 0 ] || echo $* 35} 36 37ovs_wait() { 38 info "waiting $WAIT_TIMEOUT s for: $@" 39 40 if "$@" ; then 41 info "wait succeeded immediately" 42 return 0 43 fi 44 45 # A quick re-check helps speed up small races in fast systems. 46 # However, fractional sleeps might not necessarily work. 47 local start=0 48 sleep 0.1 || { sleep 1; start=1; } 49 50 for (( i=start; i<WAIT_TIMEOUT; i++ )); do 51 if "$@" ; then 52 info "wait succeeded after $i seconds" 53 return 0 54 fi 55 sleep 1 56 done 57 info "wait failed after $i seconds" 58 return 1 59} 60 61ovs_base=`pwd` 62sbxs= 63sbx_add () { 64 info "adding sandbox '$1'" 65 66 sbxs="$sbxs $1" 67 68 NO_BIN=0 69 70 # Create sandbox. 71 local d="$ovs_base"/$1 72 if [ -e $d ]; then 73 info "removing $d" 74 rm -rf "$d" 75 fi 76 mkdir "$d" || return 1 77 ovs_setenv $1 78} 79 80ovs_exit_sig() { 81 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup" 82} 83 84on_exit() { 85 echo "$1" > ${ovs_dir}/cleanup.tmp 86 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp 87 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup 88} 89 90ovs_setenv() { 91 sandbox=$1 92 93 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir 94 95 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup 96} 97 98ovs_sbx() { 99 if test "X$2" != X; then 100 (ovs_setenv $1; shift; 101 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log) 102 else 103 ovs_setenv $1 104 fi 105} 106 107ovs_add_dp () { 108 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}" 109 sbxname="$1" 110 shift 111 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $* 112 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;" 113} 114 115ovs_add_if () { 116 info "Adding IF to DP: br:$2 if:$3" 117 if [ "$4" != "-u" ]; then 118 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if "$2" "$3" \ 119 || return 1 120 else 121 python3 $ovs_base/ovs-dpctl.py add-if \ 122 -u "$2" "$3" >$ovs_dir/$3.out 2>$ovs_dir/$3.err & 123 pid=$! 124 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null" 125 fi 126} 127 128ovs_del_if () { 129 info "Deleting IF from DP: br:$2 if:$3" 130 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1 131} 132 133ovs_netns_spawn_daemon() { 134 sbx=$1 135 shift 136 netns=$1 137 shift 138 if [ "$netns" == "_default" ]; then 139 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 140 else 141 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 142 fi 143 pid=$! 144 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null" 145} 146 147ovs_spawn_daemon() { 148 sbx=$1 149 shift 150 ovs_netns_spawn_daemon $sbx "_default" $* 151} 152 153ovs_add_netns_and_veths () { 154 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}" 155 ovs_sbx "$1" ip netns add "$3" || return 1 156 on_exit "ovs_sbx $1 ip netns del $3" 157 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1 158 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1" 159 ovs_sbx "$1" ip link set "$4" up || return 1 160 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1 161 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1 162 163 if [ "$6" != "" ]; then 164 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \ 165 || return 1 166 fi 167 168 if [ "$7" != "-u" ]; then 169 ovs_add_if "$1" "$2" "$4" || return 1 170 else 171 ovs_add_if "$1" "$2" "$4" -u || return 1 172 fi 173 174 if [ $TRACING -eq 1 ]; then 175 ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553 176 ovs_wait grep -q "listening on any" ${ovs_dir}/stderr 177 fi 178 179 return 0 180} 181 182ovs_add_flow () { 183 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4" 184 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4" 185 if [ $? -ne 0 ]; then 186 info "Flow [ $3 : $4 ] failed" 187 return 1 188 fi 189 return 0 190} 191 192ovs_del_flows () { 193 info "Deleting all flows from DP: sbx:$1 br:$2" 194 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2" 195 return 0 196} 197 198ovs_drop_record_and_run () { 199 local sbx=$1 200 shift 201 202 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \ 203 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr 204 return $? 205} 206 207ovs_drop_reason_count() 208{ 209 local reason=$1 210 211 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace` 212 local pattern="skb:kfree_skb:.*reason: $reason" 213 214 return `echo "$perf_output" | grep "$pattern" | wc -l` 215} 216 217ovs_test_flow_fails () { 218 ERR_MSG="Flow actions may not be safe on all matching packets" 219 220 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 221 ovs_add_flow $@ &> /dev/null $@ && return 1 222 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 223 224 if [ "$PRE_TEST" == "$POST_TEST" ]; then 225 return 1 226 fi 227 return 0 228} 229 230usage() { 231 echo 232 echo "$0 [OPTIONS] [TEST]..." 233 echo "If no TEST argument is given, all tests will be run." 234 echo 235 echo "Options" 236 echo " -t: capture traffic via tcpdump" 237 echo " -v: verbose" 238 echo " -p: pause on failure" 239 echo 240 echo "Available tests${tests}" 241 exit 1 242} 243 244 245# psample test 246# - use psample to observe packets 247test_psample() { 248 sbx_add "test_psample" || return $? 249 250 # Add a datapath with per-vport dispatching. 251 ovs_add_dp "test_psample" psample -V 2:1 || return 1 252 253 info "create namespaces" 254 ovs_add_netns_and_veths "test_psample" "psample" \ 255 client c0 c1 172.31.110.10/24 -u || return 1 256 ovs_add_netns_and_veths "test_psample" "psample" \ 257 server s0 s1 172.31.110.20/24 -u || return 1 258 259 # Check if psample actions can be configured. 260 ovs_add_flow "test_psample" psample \ 261 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null 262 if [ $? == 1 ]; then 263 info "no support for psample - skipping" 264 ovs_exit_sig 265 return $ksft_skip 266 fi 267 268 ovs_del_flows "test_psample" psample 269 270 # Test action verification. 271 OLDIFS=$IFS 272 IFS='*' 273 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()' 274 for testcase in \ 275 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \ 276 "no group with cookie"*"psample(cookie=abcd)" \ 277 "no group"*"psample()"; 278 do 279 set -- $testcase; 280 ovs_test_flow_fails "test_psample" psample $min_key $2 281 if [ $? == 1 ]; then 282 info "failed - $1" 283 return 1 284 fi 285 done 286 IFS=$OLDIFS 287 288 ovs_del_flows "test_psample" psample 289 # Allow ARP 290 ovs_add_flow "test_psample" psample \ 291 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 292 ovs_add_flow "test_psample" psample \ 293 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 294 295 # Sample first 14 bytes of all traffic. 296 ovs_add_flow "test_psample" psample \ 297 "in_port(1),eth(),eth_type(0x0800),ipv4()" \ 298 "trunc(14),psample(group=1,cookie=c0ffee),2" 299 300 # Sample all traffic. In this case, use a sample() action with both 301 # psample and an upcall emulating simultaneous local sampling and 302 # sFlow / IPFIX. 303 nlpid=$(grep -E "listening on upcall packet handler" \ 304 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ') 305 306 ovs_add_flow "test_psample" psample \ 307 "in_port(2),eth(),eth_type(0x0800),ipv4()" \ 308 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1" 309 310 # Record psample data. 311 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events 312 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout 313 314 # Send a single ping. 315 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1 316 317 # We should have received one userspace action upcall and 2 psample packets. 318 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1 319 320 # client -> server samples should only contain the first 14 bytes of the packet. 321 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \ 322 $ovs_dir/stdout || return 1 323 324 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1 325 326 return 0 327} 328 329# drop_reason test 330# - drop packets and verify the right drop reason is reported 331test_drop_reason() { 332 which perf >/dev/null 2>&1 || return $ksft_skip 333 which pahole >/dev/null 2>&1 || return $ksft_skip 334 335 ovs_drop_subsys=$(pahole -C skb_drop_reason_subsys | 336 awk '/OPENVSWITCH/ { print $3; }' | 337 tr -d ,) 338 339 sbx_add "test_drop_reason" || return $? 340 341 ovs_add_dp "test_drop_reason" dropreason || return 1 342 343 info "create namespaces" 344 for ns in client server; do 345 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \ 346 "${ns:0:1}0" "${ns:0:1}1" || return 1 347 done 348 349 # Setup client namespace 350 ip netns exec client ip addr add 172.31.110.10/24 dev c1 351 ip netns exec client ip link set c1 up 352 353 # Setup server namespace 354 ip netns exec server ip addr add 172.31.110.20/24 dev s1 355 ip netns exec server ip link set s1 up 356 357 # Check if drop reasons can be sent 358 ovs_add_flow "test_drop_reason" dropreason \ 359 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null 360 if [ $? == 1 ]; then 361 info "no support for drop reasons - skipping" 362 ovs_exit_sig 363 return $ksft_skip 364 fi 365 366 ovs_del_flows "test_drop_reason" dropreason 367 368 # Allow ARP 369 ovs_add_flow "test_drop_reason" dropreason \ 370 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 371 ovs_add_flow "test_drop_reason" dropreason \ 372 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 373 374 # Allow client ICMP traffic but drop return path 375 ovs_add_flow "test_drop_reason" dropreason \ 376 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2' 377 ovs_add_flow "test_drop_reason" dropreason \ 378 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop' 379 380 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20 381 ovs_drop_reason_count 0x${ovs_drop_subsys}0001 # OVS_DROP_FLOW_ACTION 382 if [[ "$?" -ne "2" ]]; then 383 info "Did not detect expected drops: $?" 384 return 1 385 fi 386 387 # Drop UDP 6000 traffic with an explicit action and an error code. 388 ovs_add_flow "test_drop_reason" dropreason \ 389 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \ 390 'drop(42)' 391 # Drop UDP 7000 traffic with an explicit action with no error code. 392 ovs_add_flow "test_drop_reason" dropreason \ 393 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \ 394 'drop(0)' 395 396 ovs_drop_record_and_run \ 397 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000 398 ovs_drop_reason_count 0x${ovs_drop_subsys}0004 # OVS_DROP_EXPLICIT_ACTION_ERROR 399 if [[ "$?" -ne "1" ]]; then 400 info "Did not detect expected explicit error drops: $?" 401 return 1 402 fi 403 404 ovs_drop_record_and_run \ 405 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000 406 ovs_drop_reason_count 0x${ovs_drop_subsys}0003 # OVS_DROP_EXPLICIT_ACTION 407 if [[ "$?" -ne "1" ]]; then 408 info "Did not detect expected explicit drops: $?" 409 return 1 410 fi 411 412 return 0 413} 414 415# arp_ping test 416# - client has 1500 byte MTU 417# - server has 1500 byte MTU 418# - send ARP ping between two ns 419test_arp_ping () { 420 421 which arping >/dev/null 2>&1 || return $ksft_skip 422 423 sbx_add "test_arp_ping" || return $? 424 425 ovs_add_dp "test_arp_ping" arpping || return 1 426 427 info "create namespaces" 428 for ns in client server; do 429 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \ 430 "${ns:0:1}0" "${ns:0:1}1" || return 1 431 done 432 433 # Setup client namespace 434 ip netns exec client ip addr add 172.31.110.10/24 dev c1 435 ip netns exec client ip link set c1 up 436 HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 437 info "Client hwaddr: $HW_CLIENT" 438 439 # Setup server namespace 440 ip netns exec server ip addr add 172.31.110.20/24 dev s1 441 ip netns exec server ip link set s1 up 442 HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 443 info "Server hwaddr: $HW_SERVER" 444 445 ovs_add_flow "test_arp_ping" arpping \ 446 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1 447 ovs_add_flow "test_arp_ping" arpping \ 448 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1 449 450 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1 451 452 return 0 453} 454 455# ct_connect_v4 test 456# - client has 1500 byte MTU 457# - server has 1500 byte MTU 458# - use ICMP to ping in each direction 459# - only allow CT state stuff to pass through new in c -> s 460test_ct_connect_v4 () { 461 462 which nc >/dev/null 2>/dev/null || return $ksft_skip 463 464 sbx_add "test_ct_connect_v4" || return $? 465 466 ovs_add_dp "test_ct_connect_v4" ct4 || return 1 467 info "create namespaces" 468 for ns in client server; do 469 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \ 470 "${ns:0:1}0" "${ns:0:1}1" || return 1 471 done 472 473 ip netns exec client ip addr add 172.31.110.10/24 dev c1 474 ip netns exec client ip link set c1 up 475 ip netns exec server ip addr add 172.31.110.20/24 dev s1 476 ip netns exec server ip link set s1 up 477 478 # Add forwarding for ARP and ip packets - completely wildcarded 479 ovs_add_flow "test_ct_connect_v4" ct4 \ 480 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 481 ovs_add_flow "test_ct_connect_v4" ct4 \ 482 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 483 ovs_add_flow "test_ct_connect_v4" ct4 \ 484 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \ 485 'ct(commit),recirc(0x1)' || return 1 486 ovs_add_flow "test_ct_connect_v4" ct4 \ 487 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 488 '2' || return 1 489 ovs_add_flow "test_ct_connect_v4" ct4 \ 490 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 491 '2' || return 1 492 ovs_add_flow "test_ct_connect_v4" ct4 \ 493 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \ 494 '1' || return 1 495 ovs_add_flow "test_ct_connect_v4" ct4 \ 496 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \ 497 return 1 498 499 # do a ping 500 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 501 502 # create an echo server in 'server' 503 echo "server" | \ 504 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \ 505 nc -lvnp 4443 506 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1 507 508 # Now test in the other direction (should fail) 509 echo "client" | \ 510 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \ 511 nc -lvnp 4443 512 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 513 if [ $? == 0 ]; then 514 info "ct connect to client was successful" 515 return 1 516 fi 517 518 info "done..." 519 return 0 520} 521 522# connect_v4 test 523# - client has 1500 byte MTU 524# - server has 1500 byte MTU 525# - use ICMP to ping in each direction 526test_connect_v4 () { 527 528 sbx_add "test_connect_v4" || return $? 529 530 ovs_add_dp "test_connect_v4" cv4 || return 1 531 532 info "create namespaces" 533 for ns in client server; do 534 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \ 535 "${ns:0:1}0" "${ns:0:1}1" || return 1 536 done 537 538 539 ip netns exec client ip addr add 172.31.110.10/24 dev c1 540 ip netns exec client ip link set c1 up 541 ip netns exec server ip addr add 172.31.110.20/24 dev s1 542 ip netns exec server ip link set s1 up 543 544 # Add forwarding for ARP and ip packets - completely wildcarded 545 ovs_add_flow "test_connect_v4" cv4 \ 546 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 547 ovs_add_flow "test_connect_v4" cv4 \ 548 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 549 ovs_add_flow "test_connect_v4" cv4 \ 550 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1 551 ovs_add_flow "test_connect_v4" cv4 \ 552 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1 553 554 # do a ping 555 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 556 557 info "done..." 558 return 0 559} 560 561# nat_connect_v4 test 562# - client has 1500 byte MTU 563# - server has 1500 byte MTU 564# - use ICMP to ping in each direction 565# - only allow CT state stuff to pass through new in c -> s 566test_nat_connect_v4 () { 567 which nc >/dev/null 2>/dev/null || return $ksft_skip 568 569 sbx_add "test_nat_connect_v4" || return $? 570 571 ovs_add_dp "test_nat_connect_v4" nat4 || return 1 572 info "create namespaces" 573 for ns in client server; do 574 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \ 575 "${ns:0:1}0" "${ns:0:1}1" || return 1 576 done 577 578 ip netns exec client ip addr add 172.31.110.10/24 dev c1 579 ip netns exec client ip link set c1 up 580 ip netns exec server ip addr add 172.31.110.20/24 dev s1 581 ip netns exec server ip link set s1 up 582 583 ip netns exec client ip route add default via 172.31.110.20 584 585 ovs_add_flow "test_nat_connect_v4" nat4 \ 586 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 587 ovs_add_flow "test_nat_connect_v4" nat4 \ 588 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 589 ovs_add_flow "test_nat_connect_v4" nat4 \ 590 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \ 591 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)" 592 ovs_add_flow "test_nat_connect_v4" nat4 \ 593 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 594 "ct(commit,nat),recirc(0x2)" 595 596 ovs_add_flow "test_nat_connect_v4" nat4 \ 597 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2" 598 ovs_add_flow "test_nat_connect_v4" nat4 \ 599 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1" 600 601 # do a ping 602 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1 603 604 # create an echo server in 'server' 605 echo "server" | \ 606 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \ 607 nc -lvnp 4443 608 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1 609 610 # Now test in the other direction (should fail) 611 echo "client" | \ 612 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \ 613 nc -lvnp 4443 614 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 615 if [ $? == 0 ]; then 616 info "connect to client was successful" 617 return 1 618 fi 619 620 info "done..." 621 return 0 622} 623 624# nat_related_v4 test 625# - client->server ip packets go via SNAT 626# - client solicits ICMP destination unreachable packet from server 627# - undo NAT for ICMP reply and test dst ip has been updated 628test_nat_related_v4 () { 629 which nc >/dev/null 2>/dev/null || return $ksft_skip 630 631 sbx_add "test_nat_related_v4" || return $? 632 633 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1 634 info "create namespaces" 635 for ns in client server; do 636 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \ 637 "${ns:0:1}0" "${ns:0:1}1" || return 1 638 done 639 640 ip netns exec client ip addr add 172.31.110.10/24 dev c1 641 ip netns exec client ip link set c1 up 642 ip netns exec server ip addr add 172.31.110.20/24 dev s1 643 ip netns exec server ip link set s1 up 644 645 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10 646 647 # Allow ARP 648 ovs_add_flow "test_nat_related_v4" natrelated4 \ 649 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1 650 ovs_add_flow "test_nat_related_v4" natrelated4 \ 651 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1 652 653 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20 654 ovs_add_flow "test_nat_related_v4" natrelated4 \ 655 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \ 656 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1 657 ovs_add_flow "test_nat_related_v4" natrelated4 \ 658 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \ 659 "2" || return 1 660 661 # Allow related ICMP responses back from server and undo NAT to restore original IP 662 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP 663 ovs_add_flow "test_nat_related_v4" natrelated4 \ 664 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 665 "ct(commit,nat),recirc(0x2)" || return 1 666 ovs_add_flow "test_nat_related_v4" natrelated4 \ 667 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \ 668 "1" || return 1 669 ovs_add_flow "test_nat_related_v4" natrelated4 \ 670 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \ 671 "drop" || return 1 672 673 # Solicit destination unreachable response from server 674 ovs_sbx "test_nat_related_v4" ip netns exec client \ 675 bash -c "echo a | nc -u -w 1 172.31.110.20 10000" 676 677 # Check to make sure no packets matched the drop rule with incorrect dst ip 678 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \ 679 | grep "drop" | grep "packets:0" >/dev/null || return 1 680 681 info "done..." 682 return 0 683} 684 685# netlink_validation 686# - Create a dp 687# - check no warning with "old version" simulation 688test_netlink_checks () { 689 sbx_add "test_netlink_checks" || return 1 690 691 info "setting up new DP" 692 ovs_add_dp "test_netlink_checks" nv0 || return 1 693 # now try again 694 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 695 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1 696 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 697 if [ "$PRE_TEST" != "$POST_TEST" ]; then 698 info "failed - gen warning" 699 return 1 700 fi 701 702 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \ 703 return 1 704 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \ 705 return 1 706 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 707 wc -l) == 3 ] || \ 708 return 1 709 ovs_del_if "test_netlink_checks" nv0 right0 || return 1 710 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 711 wc -l) == 2 ] || \ 712 return 1 713 714 info "Checking clone depth" 715 ERR_MSG="Flow actions may not be safe on all matching packets" 716 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 717 ovs_add_flow "test_netlink_checks" nv0 \ 718 'in_port(1),eth(),eth_type(0x800),ipv4()' \ 719 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \ 720 >/dev/null 2>&1 && return 1 721 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 722 723 if [ "$PRE_TEST" == "$POST_TEST" ]; then 724 info "failed - clone depth too large" 725 return 1 726 fi 727 728 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 729 ovs_add_flow "test_netlink_checks" nv0 \ 730 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \ 731 &> /dev/null && return 1 732 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 733 if [ "$PRE_TEST" == "$POST_TEST" ]; then 734 info "failed - error not generated" 735 return 1 736 fi 737 return 0 738} 739 740test_upcall_interfaces() { 741 sbx_add "test_upcall_interfaces" || return 1 742 743 info "setting up new DP" 744 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1 745 746 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \ 747 172.31.110.1/24 -u || return 1 748 749 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out 750 751 info "sending arping" 752 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \ 753 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr 754 755 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1 756 return 0 757} 758 759run_test() { 760 ( 761 tname="$1" 762 tdesc="$2" 763 764 if python3 ovs-dpctl.py -h 2>&1 | \ 765 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then 766 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}" 767 return $ksft_skip 768 fi 769 770 python3 ovs-dpctl.py show >/dev/null 2>&1 || \ 771 echo "[DPCTL] show exception." 772 773 if ! lsmod | grep openvswitch >/dev/null 2>&1; then 774 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}" 775 return $ksft_skip 776 fi 777 778 printf "TEST: %-60s [START]\n" "${tname}" 779 780 unset IFS 781 782 eval test_${tname} 783 ret=$? 784 785 if [ $ret -eq 0 ]; then 786 printf "TEST: %-60s [ OK ]\n" "${tdesc}" 787 ovs_exit_sig 788 rm -rf "$ovs_dir" 789 elif [ $ret -eq 1 ]; then 790 printf "TEST: %-60s [FAIL]\n" "${tdesc}" 791 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 792 echo 793 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue" 794 read a 795 fi 796 ovs_exit_sig 797 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir" 798 exit 1 799 elif [ $ret -eq $ksft_skip ]; then 800 printf "TEST: %-60s [SKIP]\n" "${tdesc}" 801 elif [ $ret -eq 2 ]; then 802 rm -rf test_${tname} 803 run_test "$1" "$2" 804 fi 805 806 return $ret 807 ) 808 ret=$? 809 case $ret in 810 0) 811 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0 812 all_skipped=false 813 ;; 814 $ksft_skip) 815 [ $all_skipped = true ] && exitcode=$ksft_skip 816 ;; 817 *) 818 all_skipped=false 819 exitcode=1 820 ;; 821 esac 822 823 return $ret 824} 825 826 827exitcode=0 828desc=0 829all_skipped=true 830 831while getopts :pvt o 832do 833 case $o in 834 p) PAUSE_ON_FAIL=yes;; 835 v) VERBOSE=1;; 836 t) if which tcpdump > /dev/null 2>&1; then 837 TRACING=1 838 else 839 echo "=== tcpdump not available, tracing disabled" 840 fi 841 ;; 842 *) usage;; 843 esac 844done 845shift $(($OPTIND-1)) 846 847IFS=" 848" 849 850for arg do 851 # Check first that all requested tests are available before running any 852 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; } 853done 854 855name="" 856desc="" 857for t in ${tests}; do 858 [ "${name}" = "" ] && name="${t}" && continue 859 [ "${desc}" = "" ] && desc="${t}" 860 861 run_this=1 862 for arg do 863 [ "${arg}" != "${arg#--*}" ] && continue 864 [ "${arg}" = "${name}" ] && run_this=1 && break 865 run_this=0 866 done 867 if [ $run_this -eq 1 ]; then 868 run_test "${name}" "${desc}" 869 fi 870 name="" 871 desc="" 872done 873 874exit ${exitcode} 875