1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# OVS kernel module self tests 5 6trap ovs_exit_sig EXIT TERM INT ERR 7 8# Kselftest framework requirement - SKIP code is 4. 9ksft_skip=4 10 11PAUSE_ON_FAIL=no 12VERBOSE=0 13TRACING=0 14WAIT_TIMEOUT=5 15 16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then 17 WAIT_TIMEOUT=10 18fi 19 20tests=" 21 arp_ping eth-arp: Basic arp ping between two NS 22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct 23 connect_v4 ip4-xon: Basic ipv4 ping between two NS 24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT 25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT 26 netlink_checks ovsnl: validate netlink attrs and settings 27 upcall_interfaces ovs: test the upcall interfaces 28 tunnel_metadata ovs: test extraction of tunnel metadata 29 tunnel_refcount ovs: test tunnel vport reference cleanup 30 drop_reason drop: test drop reasons are emitted 31 pop_vlan vlan: POP_VLAN action strips tag 32 dec_ttl ttl: dec_ttl decrements IP TTL 33 flow_set flow-set: Flow modify 34 action_set set: SET action rewrites fields 35 psample psample: Sampling packets with psample" 36 37info() { 38 [ "${ovs_dir}" != "" ] && 39 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log 40 [ $VERBOSE = 0 ] || echo $* 41} 42 43ovs_wait() { 44 info "waiting $WAIT_TIMEOUT s for: $@" 45 46 if "$@" ; then 47 info "wait succeeded immediately" 48 return 0 49 fi 50 51 # A quick re-check helps speed up small races in fast systems. 52 # However, fractional sleeps might not necessarily work. 53 local start=0 54 sleep 0.1 || { sleep 1; start=1; } 55 56 for (( i=start; i<WAIT_TIMEOUT; i++ )); do 57 if "$@" ; then 58 info "wait succeeded after $i seconds" 59 return 0 60 fi 61 sleep 1 62 done 63 info "wait failed after $i seconds" 64 return 1 65} 66 67ovs_base=`pwd` 68sbxs= 69sbx_add () { 70 info "adding sandbox '$1'" 71 72 sbxs="$sbxs $1" 73 74 NO_BIN=0 75 76 # Create sandbox. 77 local d="$ovs_base"/$1 78 if [ -e $d ]; then 79 info "removing $d" 80 rm -rf "$d" 81 fi 82 mkdir "$d" || return 1 83 ovs_setenv $1 84} 85 86ovs_exit_sig() { 87 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup" 88} 89 90on_exit() { 91 echo "$1" > ${ovs_dir}/cleanup.tmp 92 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp 93 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup 94} 95 96ovs_setenv() { 97 sandbox=$1 98 99 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir 100 101 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup 102} 103 104ovs_sbx() { 105 if test "X$2" != X; then 106 (ovs_setenv $1; shift; 107 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log) 108 else 109 ovs_setenv $1 110 fi 111} 112 113ovs_add_dp () { 114 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}" 115 sbxname="$1" 116 shift 117 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $* 118 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;" 119} 120 121ovs_add_if () { 122 info "Adding IF to DP: br:$3 if:$4 ($2)" 123 if [ "$5" != "-u" ]; then 124 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if \ 125 -t "$2" "$3" "$4" || return 1 126 else 127 python3 $ovs_base/ovs-dpctl.py add-if \ 128 -u -t "$2" "$3" "$4" >$ovs_dir/$4.out 2>$ovs_dir/$4.err & 129 pid=$! 130 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null" 131 fi 132} 133 134ovs_del_if () { 135 info "Deleting IF from DP: br:$2 if:$3" 136 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1 137} 138 139ovs_netns_spawn_daemon() { 140 sbx=$1 141 shift 142 netns=$1 143 shift 144 if [ "$netns" == "_default" ]; then 145 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 146 else 147 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 148 fi 149 pid=$! 150 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null" 151} 152 153ovs_spawn_daemon() { 154 sbx=$1 155 shift 156 ovs_netns_spawn_daemon $sbx "_default" $* 157} 158 159ovs_add_netns_and_veths () { 160 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}" 161 ovs_sbx "$1" ip netns add "$3" || return 1 162 on_exit "ovs_sbx $1 ip netns del $3" 163 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1 164 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1" 165 ovs_sbx "$1" ip link set "$4" up || return 1 166 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1 167 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1 168 169 if [ "$6" != "" ]; then 170 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \ 171 || return 1 172 fi 173 174 if [ "$7" != "-u" ]; then 175 ovs_add_if "$1" "netdev" "$2" "$4" || return 1 176 else 177 ovs_add_if "$1" "netdev" "$2" "$4" -u || return 1 178 fi 179 180 if [ $TRACING -eq 1 ]; then 181 ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553 182 ovs_wait grep -q "listening on any" ${ovs_dir}/stderr 183 fi 184 185 return 0 186} 187 188ovs_add_flow () { 189 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4" 190 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4" 191 if [ $? -ne 0 ]; then 192 info "Flow [ $3 : $4 ] failed" 193 return 1 194 fi 195 return 0 196} 197 198ovs_mod_flow () { 199 if [ -n "$4" ]; then 200 info "Modifying flow: sbx:$1 br:$2 flow:$3 act:$4" 201 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py \ 202 mod-flow "$2" "$3" "$4" 203 else 204 info "Modifying flow (no actions): sbx:$1 br:$2 flow:$3" 205 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py \ 206 mod-flow "$2" "$3" 207 fi 208 if [ $? -ne 0 ]; then 209 info "Flow modify [ $3 ] failed" 210 return 1 211 fi 212 return 0 213} 214 215ovs_del_flows () { 216 info "Deleting all flows from DP: sbx:$1 br:$2" 217 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2" 218 return 0 219} 220 221ovs_drop_record_and_run () { 222 local sbx=$1 223 shift 224 225 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \ 226 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr 227 return $? 228} 229 230ovs_drop_reason_count() 231{ 232 local reason=$1 233 234 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace` 235 local pattern="skb:kfree_skb:.*reason: $reason" 236 237 return `echo "$perf_output" | grep "$pattern" | wc -l` 238} 239 240ovs_test_flow_fails () { 241 ERR_MSG="Flow actions may not be safe on all matching packets" 242 243 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 244 ovs_add_flow $@ &> /dev/null $@ && return 1 245 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 246 247 if [ "$PRE_TEST" == "$POST_TEST" ]; then 248 return 1 249 fi 250 return 0 251} 252 253usage() { 254 echo 255 echo "$0 [OPTIONS] [TEST]..." 256 echo "If no TEST argument is given, all tests will be run." 257 echo 258 echo "Options" 259 echo " -t: capture traffic via tcpdump" 260 echo " -v: verbose" 261 echo " -p: pause on failure" 262 echo 263 echo "Available tests${tests}" 264 exit 1 265} 266 267 268test_dec_ttl() { 269 sbx_add "test_dec_ttl" || return $? 270 ovs_add_dp "test_dec_ttl" decttl || return 1 271 272 info "create namespaces" 273 for ns in client server; do 274 ovs_add_netns_and_veths "test_dec_ttl" "decttl" "$ns" \ 275 "${ns:0:1}0" "${ns:0:1}1" || return 1 276 done 277 278 ip netns exec client ip addr add 10.0.0.1/24 dev c1 279 ip netns exec client ip link set c1 up 280 ip netns exec server ip addr add 10.0.0.2/24 dev s1 281 ip netns exec server ip link set s1 up 282 283 # Probe: check if kernel supports dec_ttl action. 284 ovs_add_flow "test_dec_ttl" decttl \ 285 'in_port(1),eth(),eth_type(0x0800),ipv4()' \ 286 'dec_ttl(le_1())' &>/dev/null 287 if [ $? -ne 0 ]; then 288 info "no support for dec_ttl - skipping" 289 ovs_exit_sig 290 return $ksft_skip 291 fi 292 293 ovs_del_flows "test_dec_ttl" decttl 294 295 # ARP flows (bidirectional) 296 ovs_add_flow "test_dec_ttl" decttl \ 297 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 298 ovs_add_flow "test_dec_ttl" decttl \ 299 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 300 301 # IP flows with dec_ttl action 302 ovs_add_flow "test_dec_ttl" decttl \ 303 'in_port(1),eth(),eth_type(0x0800),ipv4()' \ 304 'dec_ttl(le_1()),2' || return 1 305 ovs_add_flow "test_dec_ttl" decttl \ 306 'in_port(2),eth(),eth_type(0x0800),ipv4()' \ 307 'dec_ttl(le_1()),1' || return 1 308 309 info "verify connectivity with dec_ttl" 310 ovs_sbx "test_dec_ttl" ip netns exec client ping -c 1 -W 2 \ 311 10.0.0.2 || return 1 312 313 info "verify TTL=1 is dropped by dec_ttl" 314 ovs_sbx "test_dec_ttl" ip netns exec client ping -c 1 -W 2 \ 315 -t 1 10.0.0.2 >/dev/null 2>&1 \ 316 && { info "FAIL: ping should fail with TTL=1 and dec_ttl" 317 return 1; } 318 319 return 0 320} 321 322test_flow_set() { 323 sbx_add "test_flow_set" || return $? 324 ovs_add_dp "test_flow_set" flowset || return 1 325 326 info "create namespaces" 327 for ns in client server; do 328 ovs_add_netns_and_veths "test_flow_set" "flowset" "$ns" \ 329 "${ns:0:1}0" "${ns:0:1}1" || return 1 330 done 331 332 ip netns exec client ip addr add 10.0.0.1/24 dev c1 333 ip netns exec client ip link set c1 up 334 ip netns exec server ip addr add 10.0.0.2/24 dev s1 335 ip netns exec server ip link set s1 up 336 337 ovs_add_flow "test_flow_set" flowset \ 338 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 339 ovs_add_flow "test_flow_set" flowset \ 340 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 341 342 local fwd_flow="ufid:00000001-0002-0003-0004-000500060007" 343 fwd_flow="$fwd_flow,in_port(1),eth(),eth_type(0x0800),ipv4()" 344 345 ovs_add_flow "test_flow_set" flowset "$fwd_flow" '2' \ 346 || return 1 347 ovs_add_flow "test_flow_set" flowset \ 348 'in_port(2),eth(),eth_type(0x0800),ipv4()' '1' || return 1 349 350 info "verify initial forwarding" 351 ovs_sbx "test_flow_set" ip netns exec client ping -c 1 -W 2 \ 352 10.0.0.2 || return 1 353 354 info "mod-flow with new actions (change to drop)" 355 ovs_mod_flow "test_flow_set" flowset "$fwd_flow" 'drop' \ 356 || return 1 357 358 info "verify traffic is now dropped" 359 ovs_sbx "test_flow_set" ip netns exec client ping -c 1 -W 2 \ 360 10.0.0.2 >/dev/null 2>&1 \ 361 && { info "FAIL: ping should fail after mod-flow to drop" 362 return 1; } 363 364 info "mod-flow without actions" 365 ovs_mod_flow "test_flow_set" flowset "$fwd_flow" || return 1 366 367 info "verify flow retained drop action via dump" 368 python3 "$ovs_base/ovs-dpctl.py" dump-flows flowset \ 369 | grep -q "actions:drop" || \ 370 { info "FAIL: flow not showing drop action"; return 1; } 371 372 info "verify drop actions unchanged" 373 ovs_sbx "test_flow_set" ip netns exec client ping -c 1 -W 2 \ 374 10.0.0.2 >/dev/null 2>&1 \ 375 && { info "FAIL: ping should still fail after no-actions set" 376 return 1; } 377 378 return 0 379} 380 381test_action_set() { 382 sbx_add "test_action_set" || return $? 383 ovs_add_dp "test_action_set" settest || return 1 384 385 info "create namespaces" 386 for ns in client server; do 387 ovs_add_netns_and_veths "test_action_set" "settest" "$ns" \ 388 "${ns:0:1}0" "${ns:0:1}1" || return 1 389 done 390 391 ip netns exec client ip addr add 10.0.0.1/24 dev c1 392 ip netns exec client ip link set c1 up 393 ip netns exec server ip addr add 10.0.0.2/24 dev s1 394 ip netns exec server ip link set s1 up 395 396 ovs_add_flow "test_action_set" settest \ 397 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 398 ovs_add_flow "test_action_set" settest \ 399 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 400 401 ovs_add_flow "test_action_set" settest \ 402 'in_port(1),eth(),eth_type(0x0800),ipv4()' '2' || return 1 403 ovs_add_flow "test_action_set" settest \ 404 'in_port(2),eth(),eth_type(0x0800),ipv4()' '1' || return 1 405 406 info "verify connectivity without SET" 407 ovs_sbx "test_action_set" ip netns exec client ping -c 1 -W 2 \ 408 10.0.0.2 || return 1 409 410 ovs_del_flows "test_action_set" settest 411 ovs_add_flow "test_action_set" settest \ 412 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 413 ovs_add_flow "test_action_set" settest \ 414 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 415 416 info "set ipv4 dst to unreachable address" 417 ovs_add_flow "test_action_set" settest \ 418 'in_port(1),eth(),eth_type(0x0800),ipv4()' \ 419 'set(ipv4(dst=10.0.0.99)),2' || return 1 420 ovs_add_flow "test_action_set" settest \ 421 'in_port(2),eth(),eth_type(0x0800),ipv4()' '1' || return 1 422 423 info "verify ping fails with rewritten dst" 424 ovs_sbx "test_action_set" ip netns exec client ping -c 1 -W 2 \ 425 10.0.0.2 >/dev/null 2>&1 \ 426 && { info "FAIL: ping should fail with dst rewritten" 427 return 1; } 428 429 ovs_del_flows "test_action_set" settest 430 ovs_add_flow "test_action_set" settest \ 431 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 432 ovs_add_flow "test_action_set" settest \ 433 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 434 ovs_add_flow "test_action_set" settest \ 435 'in_port(1),eth(),eth_type(0x0800),ipv4()' '2' || return 1 436 ovs_add_flow "test_action_set" settest \ 437 'in_port(2),eth(),eth_type(0x0800),ipv4()' '1' || return 1 438 439 info "verify connectivity restored without SET" 440 ovs_sbx "test_action_set" ip netns exec client ping -c 1 -W 2 \ 441 10.0.0.2 || return 1 442 443 return 0 444} 445 446# psample test 447# - use psample to observe packets 448test_psample() { 449 sbx_add "test_psample" || return $? 450 451 # Add a datapath with per-vport dispatching. 452 ovs_add_dp "test_psample" psample -V 2:1 || return 1 453 454 info "create namespaces" 455 ovs_add_netns_and_veths "test_psample" "psample" \ 456 client c0 c1 172.31.110.10/24 -u || return 1 457 ovs_add_netns_and_veths "test_psample" "psample" \ 458 server s0 s1 172.31.110.20/24 -u || return 1 459 460 # Check if psample actions can be configured. 461 ovs_add_flow "test_psample" psample \ 462 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null 463 if [ $? == 1 ]; then 464 info "no support for psample - skipping" 465 ovs_exit_sig 466 return $ksft_skip 467 fi 468 469 ovs_del_flows "test_psample" psample 470 471 # Test action verification. 472 OLDIFS=$IFS 473 IFS='*' 474 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()' 475 for testcase in \ 476 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \ 477 "no group with cookie"*"psample(cookie=abcd)" \ 478 "no group"*"psample()"; 479 do 480 set -- $testcase; 481 ovs_test_flow_fails "test_psample" psample $min_key $2 482 if [ $? == 1 ]; then 483 info "failed - $1" 484 return 1 485 fi 486 done 487 IFS=$OLDIFS 488 489 ovs_del_flows "test_psample" psample 490 # Allow ARP 491 ovs_add_flow "test_psample" psample \ 492 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 493 ovs_add_flow "test_psample" psample \ 494 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 495 496 # Sample first 14 bytes of all traffic. 497 ovs_add_flow "test_psample" psample \ 498 "in_port(1),eth(),eth_type(0x0800),ipv4()" \ 499 "trunc(14),psample(group=1,cookie=c0ffee),2" 500 501 # Sample all traffic. In this case, use a sample() action with both 502 # psample and an upcall emulating simultaneous local sampling and 503 # sFlow / IPFIX. 504 nlpid=$(grep -E "listening on upcall packet handler" \ 505 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ') 506 [ -z "$nlpid" ] && \ 507 { info "failed to get upcall PID"; return 1; } 508 509 ovs_add_flow "test_psample" psample \ 510 "in_port(2),eth(),eth_type(0x0800),ipv4()" \ 511 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1" 512 513 # Record psample data. 514 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events 515 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout 516 517 # Send a single ping. 518 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1 519 520 # We should have received one userspace action upcall and 2 psample packets. 521 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1 522 523 # client -> server samples should only contain the first 14 bytes of the packet. 524 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \ 525 $ovs_dir/stdout || return 1 526 527 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1 528 529 return 0 530} 531 532# drop_reason test 533# - drop packets and verify the right drop reason is reported 534test_drop_reason() { 535 which perf >/dev/null 2>&1 || return $ksft_skip 536 which pahole >/dev/null 2>&1 || return $ksft_skip 537 538 ovs_drop_subsys=$(pahole -C skb_drop_reason_subsys | 539 awk '/OPENVSWITCH/ { print $3; }' | 540 tr -d ,) 541 if [ -z "$ovs_drop_subsys" ]; then 542 info "failed to get OVS drop subsys ID" 543 return $ksft_skip 544 fi 545 546 sbx_add "test_drop_reason" || return $? 547 548 ovs_add_dp "test_drop_reason" dropreason || return 1 549 550 info "create namespaces" 551 for ns in client server; do 552 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \ 553 "${ns:0:1}0" "${ns:0:1}1" || return 1 554 done 555 556 # Setup client namespace 557 ip netns exec client ip addr add 172.31.110.10/24 dev c1 558 ip netns exec client ip link set c1 up 559 560 # Setup server namespace 561 ip netns exec server ip addr add 172.31.110.20/24 dev s1 562 ip netns exec server ip link set s1 up 563 564 # Check if drop reasons can be sent 565 ovs_add_flow "test_drop_reason" dropreason \ 566 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null 567 if [ $? == 1 ]; then 568 info "no support for drop reasons - skipping" 569 ovs_exit_sig 570 return $ksft_skip 571 fi 572 573 ovs_del_flows "test_drop_reason" dropreason 574 575 # Allow ARP 576 ovs_add_flow "test_drop_reason" dropreason \ 577 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 578 ovs_add_flow "test_drop_reason" dropreason \ 579 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 580 581 # Allow client ICMP traffic but drop return path 582 ovs_add_flow "test_drop_reason" dropreason \ 583 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2' 584 ovs_add_flow "test_drop_reason" dropreason \ 585 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop' 586 587 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20 588 ovs_drop_reason_count 0x${ovs_drop_subsys}0001 # OVS_DROP_FLOW_ACTION 589 if [[ "$?" -ne "2" ]]; then 590 info "Did not detect expected drops: $?" 591 return 1 592 fi 593 594 # Drop UDP 6000 traffic with an explicit action and an error code. 595 ovs_add_flow "test_drop_reason" dropreason \ 596 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \ 597 'drop(42)' 598 # Drop UDP 7000 traffic with an explicit action with no error code. 599 ovs_add_flow "test_drop_reason" dropreason \ 600 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \ 601 'drop(0)' 602 603 ovs_drop_record_and_run \ 604 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000 605 ovs_drop_reason_count 0x${ovs_drop_subsys}0004 # OVS_DROP_EXPLICIT_ACTION_ERROR 606 if [[ "$?" -ne "1" ]]; then 607 info "Did not detect expected explicit error drops: $?" 608 return 1 609 fi 610 611 ovs_drop_record_and_run \ 612 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000 613 ovs_drop_reason_count 0x${ovs_drop_subsys}0003 # OVS_DROP_EXPLICIT_ACTION 614 if [[ "$?" -ne "1" ]]; then 615 info "Did not detect expected explicit drops: $?" 616 return 1 617 fi 618 619 return 0 620} 621 622# arp_ping test 623# - client has 1500 byte MTU 624# - server has 1500 byte MTU 625# - send ARP ping between two ns 626test_arp_ping () { 627 628 which arping >/dev/null 2>&1 || return $ksft_skip 629 630 sbx_add "test_arp_ping" || return $? 631 632 ovs_add_dp "test_arp_ping" arpping || return 1 633 634 info "create namespaces" 635 for ns in client server; do 636 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \ 637 "${ns:0:1}0" "${ns:0:1}1" || return 1 638 done 639 640 # Setup client namespace 641 ip netns exec client ip addr add 172.31.110.10/24 dev c1 642 ip netns exec client ip link set c1 up 643 HW_CLIENT=$(ip netns exec client ip link show dev c1 \ 644 | awk '/link\/ether/ {print $2}') 645 [ -z "$HW_CLIENT" ] && \ 646 { info "failed to get client hwaddr"; return 1; } 647 info "Client hwaddr: $HW_CLIENT" 648 649 # Setup server namespace 650 ip netns exec server ip addr add 172.31.110.20/24 dev s1 651 ip netns exec server ip link set s1 up 652 HW_SERVER=$(ip netns exec server ip link show dev s1 \ 653 | awk '/link\/ether/ {print $2}') 654 [ -z "$HW_SERVER" ] && \ 655 { info "failed to get server hwaddr"; return 1; } 656 info "Server hwaddr: $HW_SERVER" 657 658 ovs_add_flow "test_arp_ping" arpping \ 659 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1 660 ovs_add_flow "test_arp_ping" arpping \ 661 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1 662 663 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1 664 665 return 0 666} 667 668# ct_connect_v4 test 669# - client has 1500 byte MTU 670# - server has 1500 byte MTU 671# - use ICMP to ping in each direction 672# - only allow CT state stuff to pass through new in c -> s 673test_ct_connect_v4 () { 674 675 which nc >/dev/null 2>/dev/null || return $ksft_skip 676 677 sbx_add "test_ct_connect_v4" || return $? 678 679 ovs_add_dp "test_ct_connect_v4" ct4 || return 1 680 info "create namespaces" 681 for ns in client server; do 682 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \ 683 "${ns:0:1}0" "${ns:0:1}1" || return 1 684 done 685 686 ip netns exec client ip addr add 172.31.110.10/24 dev c1 687 ip netns exec client ip link set c1 up 688 ip netns exec server ip addr add 172.31.110.20/24 dev s1 689 ip netns exec server ip link set s1 up 690 691 # Add forwarding for ARP and ip packets - completely wildcarded 692 ovs_add_flow "test_ct_connect_v4" ct4 \ 693 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 694 ovs_add_flow "test_ct_connect_v4" ct4 \ 695 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 696 ovs_add_flow "test_ct_connect_v4" ct4 \ 697 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \ 698 'ct(commit),recirc(0x1)' || return 1 699 ovs_add_flow "test_ct_connect_v4" ct4 \ 700 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 701 '2' || return 1 702 ovs_add_flow "test_ct_connect_v4" ct4 \ 703 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 704 '2' || return 1 705 ovs_add_flow "test_ct_connect_v4" ct4 \ 706 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \ 707 '1' || return 1 708 ovs_add_flow "test_ct_connect_v4" ct4 \ 709 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \ 710 return 1 711 712 # do a ping 713 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 714 715 # create an echo server in 'server' 716 echo "server" | \ 717 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \ 718 nc -lvnp 4443 719 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1 720 721 # Now test in the other direction (should fail) 722 echo "client" | \ 723 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \ 724 nc -lvnp 4443 725 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 726 if [ $? == 0 ]; then 727 info "ct connect to client was successful" 728 return 1 729 fi 730 731 info "done..." 732 return 0 733} 734 735# connect_v4 test 736# - client has 1500 byte MTU 737# - server has 1500 byte MTU 738# - use ICMP to ping in each direction 739test_connect_v4 () { 740 741 sbx_add "test_connect_v4" || return $? 742 743 ovs_add_dp "test_connect_v4" cv4 || return 1 744 745 info "create namespaces" 746 for ns in client server; do 747 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \ 748 "${ns:0:1}0" "${ns:0:1}1" || return 1 749 done 750 751 752 ip netns exec client ip addr add 172.31.110.10/24 dev c1 753 ip netns exec client ip link set c1 up 754 ip netns exec server ip addr add 172.31.110.20/24 dev s1 755 ip netns exec server ip link set s1 up 756 757 # Add forwarding for ARP and ip packets - completely wildcarded 758 ovs_add_flow "test_connect_v4" cv4 \ 759 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 760 ovs_add_flow "test_connect_v4" cv4 \ 761 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 762 ovs_add_flow "test_connect_v4" cv4 \ 763 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1 764 ovs_add_flow "test_connect_v4" cv4 \ 765 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1 766 767 # do a ping 768 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 769 770 info "done..." 771 return 0 772} 773 774# nat_connect_v4 test 775# - client has 1500 byte MTU 776# - server has 1500 byte MTU 777# - use ICMP to ping in each direction 778# - only allow CT state stuff to pass through new in c -> s 779test_nat_connect_v4 () { 780 which nc >/dev/null 2>/dev/null || return $ksft_skip 781 782 sbx_add "test_nat_connect_v4" || return $? 783 784 ovs_add_dp "test_nat_connect_v4" nat4 || return 1 785 info "create namespaces" 786 for ns in client server; do 787 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \ 788 "${ns:0:1}0" "${ns:0:1}1" || return 1 789 done 790 791 ip netns exec client ip addr add 172.31.110.10/24 dev c1 792 ip netns exec client ip link set c1 up 793 ip netns exec server ip addr add 172.31.110.20/24 dev s1 794 ip netns exec server ip link set s1 up 795 796 ip netns exec client ip route add default via 172.31.110.20 797 798 ovs_add_flow "test_nat_connect_v4" nat4 \ 799 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 800 ovs_add_flow "test_nat_connect_v4" nat4 \ 801 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 802 ovs_add_flow "test_nat_connect_v4" nat4 \ 803 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \ 804 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)" 805 ovs_add_flow "test_nat_connect_v4" nat4 \ 806 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 807 "ct(commit,nat),recirc(0x2)" 808 809 ovs_add_flow "test_nat_connect_v4" nat4 \ 810 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2" 811 ovs_add_flow "test_nat_connect_v4" nat4 \ 812 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1" 813 814 # do a ping 815 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1 816 817 # create an echo server in 'server' 818 echo "server" | \ 819 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \ 820 nc -lvnp 4443 821 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1 822 823 # Now test in the other direction (should fail) 824 echo "client" | \ 825 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \ 826 nc -lvnp 4443 827 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 828 if [ $? == 0 ]; then 829 info "connect to client was successful" 830 return 1 831 fi 832 833 info "done..." 834 return 0 835} 836 837# nat_related_v4 test 838# - client->server ip packets go via SNAT 839# - client solicits ICMP destination unreachable packet from server 840# - undo NAT for ICMP reply and test dst ip has been updated 841test_nat_related_v4 () { 842 which nc >/dev/null 2>/dev/null || return $ksft_skip 843 844 sbx_add "test_nat_related_v4" || return $? 845 846 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1 847 info "create namespaces" 848 for ns in client server; do 849 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \ 850 "${ns:0:1}0" "${ns:0:1}1" || return 1 851 done 852 853 ip netns exec client ip addr add 172.31.110.10/24 dev c1 854 ip netns exec client ip link set c1 up 855 ip netns exec server ip addr add 172.31.110.20/24 dev s1 856 ip netns exec server ip link set s1 up 857 858 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10 859 860 # Allow ARP 861 ovs_add_flow "test_nat_related_v4" natrelated4 \ 862 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1 863 ovs_add_flow "test_nat_related_v4" natrelated4 \ 864 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1 865 866 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20 867 ovs_add_flow "test_nat_related_v4" natrelated4 \ 868 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \ 869 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1 870 ovs_add_flow "test_nat_related_v4" natrelated4 \ 871 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \ 872 "2" || return 1 873 874 # Allow related ICMP responses back from server and undo NAT to restore original IP 875 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP 876 ovs_add_flow "test_nat_related_v4" natrelated4 \ 877 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 878 "ct(commit,nat),recirc(0x2)" || return 1 879 ovs_add_flow "test_nat_related_v4" natrelated4 \ 880 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \ 881 "1" || return 1 882 ovs_add_flow "test_nat_related_v4" natrelated4 \ 883 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \ 884 "drop" || return 1 885 886 # Solicit destination unreachable response from server 887 ovs_sbx "test_nat_related_v4" ip netns exec client \ 888 bash -c "echo a | nc -u -w 1 172.31.110.20 10000" 889 890 # Check to make sure no packets matched the drop rule with incorrect dst ip 891 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \ 892 | grep "drop" | grep "packets:0" >/dev/null || return 1 893 894 info "done..." 895 return 0 896} 897 898# netlink_validation 899# - Create a dp 900# - check no warning with "old version" simulation 901test_netlink_checks () { 902 sbx_add "test_netlink_checks" || return 1 903 904 info "setting up new DP" 905 ovs_add_dp "test_netlink_checks" nv0 || return 1 906 # now try again 907 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 908 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1 909 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 910 if [ "$PRE_TEST" != "$POST_TEST" ]; then 911 info "failed - gen warning" 912 return 1 913 fi 914 915 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \ 916 return 1 917 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \ 918 return 1 919 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 920 wc -l) == 3 ] || \ 921 return 1 922 ovs_del_if "test_netlink_checks" nv0 right0 || return 1 923 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 924 wc -l) == 2 ] || \ 925 return 1 926 927 info "Checking clone depth" 928 ERR_MSG="Flow actions may not be safe on all matching packets" 929 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 930 ovs_add_flow "test_netlink_checks" nv0 \ 931 'in_port(1),eth(),eth_type(0x800),ipv4()' \ 932 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \ 933 >/dev/null 2>&1 && return 1 934 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 935 936 if [ "$PRE_TEST" == "$POST_TEST" ]; then 937 info "failed - clone depth too large" 938 return 1 939 fi 940 941 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 942 ovs_add_flow "test_netlink_checks" nv0 \ 943 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \ 944 &> /dev/null && return 1 945 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 946 if [ "$PRE_TEST" == "$POST_TEST" ]; then 947 info "failed - error not generated" 948 return 1 949 fi 950 return 0 951} 952 953test_upcall_interfaces() { 954 sbx_add "test_upcall_interfaces" || return 1 955 956 info "setting up new DP" 957 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1 958 959 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \ 960 172.31.110.1/24 -u || return 1 961 962 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out 963 964 info "sending arping" 965 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \ 966 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr 967 968 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1 969 return 0 970} 971 972ovs_add_kernel_tunnel() { 973 local sbxname=$1; shift 974 local ns=$1; shift 975 local tnl_type=$1; shift 976 local name=$1; shift 977 local addr=$1; shift 978 979 info "setting up kernel ${tnl_type} tunnel ${name}" 980 ovs_sbx "${sbxname}" ip -netns ${ns} link add dev ${name} type ${tnl_type} $* || return 1 981 on_exit "ovs_sbx ${sbxname} ip -netns ${ns} link del ${name} >/dev/null 2>&1" 982 ovs_sbx "${sbxname}" ip -netns ${ns} addr add dev ${name} ${addr} || return 1 983 ovs_sbx "${sbxname}" ip -netns ${ns} link set dev ${name} mtu 1450 up || return 1 984} 985 986test_tunnel_metadata() { 987 which arping >/dev/null 2>&1 || return $ksft_skip 988 989 sbxname="test_tunnel_metadata" 990 sbx_add "${sbxname}" || return 1 991 992 info "setting up new DP" 993 ovs_add_dp "${sbxname}" tdp0 -V 2:1 || return 1 994 995 ovs_add_netns_and_veths "${sbxname}" tdp0 tns left0 l0 \ 996 172.31.110.1/24 || return 1 997 998 info "removing veth interface from openvswitch and setting IP" 999 ovs_del_if "${sbxname}" tdp0 left0 || return 1 1000 ovs_sbx "${sbxname}" ip addr add 172.31.110.2/24 dev left0 || return 1 1001 ovs_sbx "${sbxname}" ip link set left0 up || return 1 1002 1003 info "setting up tunnel port in openvswitch" 1004 ovs_add_if "${sbxname}" "vxlan" tdp0 ovs-vxlan0 -u || return 1 1005 on_exit "ovs_sbx ${sbxname} ip link del ovs-vxlan0" 1006 ovs_wait ip link show ovs-vxlan0 &>/dev/null || return 1 1007 ovs_sbx "${sbxname}" ip link set ovs-vxlan0 up || return 1 1008 1009 configs=$(echo ' 1010 1 172.31.221.1/24 1155332 32 set udpcsum flags\(df\|csum\) 1011 2 172.31.222.1/24 1234567 45 set noudpcsum flags\(df\) 1012 3 172.31.223.1/24 1020304 23 unset udpcsum flags\(csum\) 1013 4 172.31.224.1/24 1357986 15 unset noudpcsum' | sed '/^$/d') 1014 1015 while read -r i addr id ttl df csum flags; do 1016 ovs_add_kernel_tunnel "${sbxname}" tns vxlan vxlan${i} ${addr} \ 1017 remote 172.31.110.2 id ${id} dstport 4789 \ 1018 ttl ${ttl} df ${df} ${csum} || return 1 1019 done <<< "${configs}" 1020 1021 ovs_wait grep -q 'listening on upcall packet handler' \ 1022 ${ovs_dir}/ovs-vxlan0.out || return 1 1023 1024 info "sending arping" 1025 for i in 1 2 3 4; do 1026 ovs_sbx "${sbxname}" ip netns exec tns \ 1027 arping -I vxlan${i} 172.31.22${i}.2 -c 1 \ 1028 >${ovs_dir}/arping.stdout 2>${ovs_dir}/arping.stderr 1029 done 1030 1031 info "checking that received decapsulated packets carry correct metadata" 1032 while read -r i addr id ttl df csum flags; do 1033 arp_hdr="arp\\(sip=172.31.22${i}.1,tip=172.31.22${i}.2,op=1,sha=" 1034 addrs="src=172.31.110.1,dst=172.31.110.2" 1035 ports="tp_src=[0-9]*,tp_dst=4789" 1036 tnl_md="tunnel\\(tun_id=${id},${addrs},ttl=${ttl},${ports},${flags}\\)" 1037 1038 ovs_sbx "${sbxname}" grep -qE "MISS upcall.*${tnl_md}.*${arp_hdr}" \ 1039 ${ovs_dir}/ovs-vxlan0.out || return 1 1040 done <<< "${configs}" 1041 1042 return 0 1043} 1044 1045test_tunnel_refcount() { 1046 sbxname="test_tunnel_refcount" 1047 sbx_add "${sbxname}" || return 1 1048 1049 ovs_sbx "${sbxname}" ip netns add trefns || return 1 1050 on_exit "ovs_sbx ${sbxname} ip netns del trefns" 1051 1052 for tun_type in gre vxlan geneve; do 1053 info "testing ${tun_type} tunnel vport refcount" 1054 1055 ovs_sbx "${sbxname}" ip netns exec trefns \ 1056 python3 $ovs_base/ovs-dpctl.py \ 1057 add-dp dp-${tun_type} || return 1 1058 1059 ovs_sbx "${sbxname}" ip netns exec trefns \ 1060 python3 $ovs_base/ovs-dpctl.py \ 1061 add-if --no-lwt -t ${tun_type} \ 1062 dp-${tun_type} ovs-${tun_type}0 || return 1 1063 1064 ovs_wait ip -netns trefns link show \ 1065 ovs-${tun_type}0 >/dev/null 2>&1 || return 1 1066 1067 info "deleting dp - may hang if reference counting is broken" 1068 ovs_sbx "${sbxname}" ip netns exec trefns \ 1069 python3 $ovs_base/ovs-dpctl.py \ 1070 del-dp dp-${tun_type} & 1071 1072 dev_removed() { 1073 ! ip -netns trefns link show "$1" >/dev/null 2>&1 1074 } 1075 ovs_wait dev_removed dp-${tun_type} || return 1 1076 ovs_wait dev_removed ovs-${tun_type}0 || return 1 1077 done 1078 1079 return 0 1080} 1081 1082test_pop_vlan() { 1083 local sbx="test_pop_vlan" 1084 sbx_add "$sbx" || return $? 1085 ovs_add_dp "$sbx" vlandp || return 1 1086 1087 ovs_add_netns_and_veths "$sbx" vlandp \ 1088 ns1 veth1 ns1veth 192.0.2.1/24 || return 1 1089 ovs_add_netns_and_veths "$sbx" vlandp \ 1090 ns2 veth2 ns2veth 192.0.2.2/24 || return 1 1091 1092 # Baseline: untagged bidirectional forwarding 1093 ovs_add_flow "$sbx" vlandp \ 1094 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 1095 ovs_add_flow "$sbx" vlandp \ 1096 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 1097 ovs_add_flow "$sbx" vlandp \ 1098 'in_port(1),eth(),eth_type(0x0800),ipv4()' '2' || return 1 1099 ovs_add_flow "$sbx" vlandp \ 1100 'in_port(2),eth(),eth_type(0x0800),ipv4()' '1' || return 1 1101 ovs_sbx "$sbx" ip netns exec ns1 ping -c 3 -W 2 \ 1102 192.0.2.2 || return 1 1103 1104 # VLAN topology: ns1 uses VLAN sub-interface, ns2 is plain 1105 ip -n ns1 link add link ns1veth name ns1veth.10 \ 1106 type vlan id 10 || return 1 1107 on_exit "ip -n ns1 link del ns1veth.10 2>/dev/null" 1108 ip -n ns1 addr add 198.51.100.1/24 dev ns1veth.10 || return 1 1109 ip -n ns1 link set ns1veth.10 up || return 1 1110 ip -n ns2 addr add 198.51.100.2/24 dev ns2veth || return 1 1111 1112 ovs_del_flows "$sbx" vlandp 1113 1114 # Static ARP: avoids VLAN-tagged ARP complexity 1115 local ns1veth10mac ns2mac 1116 ns1veth10mac=$(ip -n ns1 link show ns1veth.10 \ 1117 | awk '/link\/ether/ {print $2}') 1118 [ -z "$ns1veth10mac" ] && \ 1119 { info "failed to get ns1veth10mac"; return 1; } 1120 ns2mac=$(ip -n ns2 link show ns2veth \ 1121 | awk '/link\/ether/ {print $2}') 1122 [ -z "$ns2mac" ] && \ 1123 { info "failed to get ns2mac"; return 1; } 1124 ip -n ns1 neigh replace 198.51.100.2 lladdr "$ns2mac" \ 1125 dev ns1veth.10 nud permanent || return 1 1126 ip -n ns2 neigh replace 198.51.100.1 \ 1127 lladdr "$ns1veth10mac" \ 1128 dev ns2veth nud permanent || return 1 1129 1130 local vlan_match='in_port(1),eth(),eth_type(0x8100),' 1131 vlan_match+='vlan(vid=10),' 1132 vlan_match+='encap(eth_type(0x0800),' 1133 vlan_match+='ipv4(src=198.51.100.1,proto=1),icmp())' 1134 1135 # Negative: forward without pop_vlan -- tagged frame 1136 # is invisible to ns2 (no VLAN sub-interface), ping fails 1137 ovs_add_flow "$sbx" vlandp "$vlan_match" '2' || return 1 1138 ovs_sbx "$sbx" ip netns exec ns1 ping -I ns1veth.10 \ 1139 -c 3 -W 1 198.51.100.2 >/dev/null 2>&1 \ 1140 && { info "FAIL: ping should fail without pop_vlan" 1141 return 1; } 1142 1143 ovs_del_flows "$sbx" vlandp 1144 1145 # Positive: pop_vlan strips tag on forward path, 1146 # push_vlan restores tag on return path -- ping succeeds 1147 ovs_add_flow "$sbx" vlandp \ 1148 "$vlan_match" 'pop_vlan,2' || return 1 1149 ovs_add_flow "$sbx" vlandp \ 1150 'in_port(2),eth(),eth_type(0x0800),ipv4()' \ 1151 'push_vlan(vid=10,pcp=0,tpid=0x8100),1' || return 1 1152 ovs_sbx "$sbx" ip netns exec ns1 ping -I ns1veth.10 \ 1153 -c 3 -W 2 198.51.100.2 || return 1 1154 1155 return 0 1156} 1157 1158run_test() { 1159 ( 1160 tname="$1" 1161 tdesc="$2" 1162 1163 if python3 ovs-dpctl.py -h 2>&1 | \ 1164 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then 1165 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}" 1166 return $ksft_skip 1167 fi 1168 1169 python3 ovs-dpctl.py show >/dev/null 2>&1 || \ 1170 echo "[DPCTL] show exception." 1171 1172 if ! lsmod | grep openvswitch >/dev/null 2>&1; then 1173 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}" 1174 return $ksft_skip 1175 fi 1176 1177 printf "TEST: %-60s [START]\n" "${tname}" 1178 1179 unset IFS 1180 1181 eval test_${tname} 1182 ret=$? 1183 1184 if [ $ret -eq 0 ]; then 1185 printf "TEST: %-60s [ OK ]\n" "${tdesc}" 1186 ovs_exit_sig 1187 rm -rf "$ovs_dir" 1188 elif [ $ret -eq 1 ]; then 1189 printf "TEST: %-60s [FAIL]\n" "${tdesc}" 1190 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 1191 echo 1192 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue" 1193 read a 1194 fi 1195 ovs_exit_sig 1196 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir" 1197 exit 1 1198 elif [ $ret -eq $ksft_skip ]; then 1199 printf "TEST: %-60s [SKIP]\n" "${tdesc}" 1200 elif [ $ret -eq 2 ]; then 1201 rm -rf test_${tname} 1202 run_test "$1" "$2" 1203 fi 1204 1205 return $ret 1206 ) 1207 ret=$? 1208 case $ret in 1209 0) 1210 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0 1211 all_skipped=false 1212 ;; 1213 $ksft_skip) 1214 [ $all_skipped = true ] && exitcode=$ksft_skip 1215 ;; 1216 *) 1217 all_skipped=false 1218 exitcode=1 1219 ;; 1220 esac 1221 1222 return $ret 1223} 1224 1225 1226exitcode=0 1227desc=0 1228all_skipped=true 1229 1230while getopts :pvt o 1231do 1232 case $o in 1233 p) PAUSE_ON_FAIL=yes;; 1234 v) VERBOSE=1;; 1235 t) if which tcpdump > /dev/null 2>&1; then 1236 TRACING=1 1237 else 1238 echo "=== tcpdump not available, tracing disabled" 1239 fi 1240 ;; 1241 *) usage;; 1242 esac 1243done 1244shift $(($OPTIND-1)) 1245 1246IFS=" 1247" 1248 1249for arg do 1250 # Check first that all requested tests are available before running any 1251 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; } 1252done 1253 1254name="" 1255desc="" 1256for t in ${tests}; do 1257 [ "${name}" = "" ] && name="${t}" && continue 1258 [ "${desc}" = "" ] && desc="${t}" 1259 1260 run_this=1 1261 for arg do 1262 [ "${arg}" != "${arg#--*}" ] && continue 1263 [ "${arg}" = "${name}" ] && run_this=1 && break 1264 run_this=0 1265 done 1266 if [ $run_this -eq 1 ]; then 1267 run_test "${name}" "${desc}" 1268 fi 1269 name="" 1270 desc="" 1271done 1272 1273exit ${exitcode} 1274