1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# OVS kernel module self tests 5 6trap ovs_exit_sig EXIT TERM INT ERR 7 8# Kselftest framework requirement - SKIP code is 4. 9ksft_skip=4 10 11PAUSE_ON_FAIL=no 12VERBOSE=0 13TRACING=0 14WAIT_TIMEOUT=5 15 16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then 17 WAIT_TIMEOUT=10 18fi 19 20tests=" 21 arp_ping eth-arp: Basic arp ping between two NS 22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct 23 connect_v4 ip4-xon: Basic ipv4 ping between two NS 24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT 25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT 26 netlink_checks ovsnl: validate netlink attrs and settings 27 upcall_interfaces ovs: test the upcall interfaces 28 tunnel_metadata ovs: test extraction of tunnel metadata 29 tunnel_refcount ovs: test tunnel vport reference cleanup 30 drop_reason drop: test drop reasons are emitted 31 pop_vlan vlan: POP_VLAN action strips tag 32 dec_ttl ttl: dec_ttl decrements IP TTL 33 psample psample: Sampling packets with psample" 34 35info() { 36 [ "${ovs_dir}" != "" ] && 37 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log 38 [ $VERBOSE = 0 ] || echo $* 39} 40 41ovs_wait() { 42 info "waiting $WAIT_TIMEOUT s for: $@" 43 44 if "$@" ; then 45 info "wait succeeded immediately" 46 return 0 47 fi 48 49 # A quick re-check helps speed up small races in fast systems. 50 # However, fractional sleeps might not necessarily work. 51 local start=0 52 sleep 0.1 || { sleep 1; start=1; } 53 54 for (( i=start; i<WAIT_TIMEOUT; i++ )); do 55 if "$@" ; then 56 info "wait succeeded after $i seconds" 57 return 0 58 fi 59 sleep 1 60 done 61 info "wait failed after $i seconds" 62 return 1 63} 64 65ovs_base=`pwd` 66sbxs= 67sbx_add () { 68 info "adding sandbox '$1'" 69 70 sbxs="$sbxs $1" 71 72 NO_BIN=0 73 74 # Create sandbox. 75 local d="$ovs_base"/$1 76 if [ -e $d ]; then 77 info "removing $d" 78 rm -rf "$d" 79 fi 80 mkdir "$d" || return 1 81 ovs_setenv $1 82} 83 84ovs_exit_sig() { 85 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup" 86} 87 88on_exit() { 89 echo "$1" > ${ovs_dir}/cleanup.tmp 90 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp 91 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup 92} 93 94ovs_setenv() { 95 sandbox=$1 96 97 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir 98 99 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup 100} 101 102ovs_sbx() { 103 if test "X$2" != X; then 104 (ovs_setenv $1; shift; 105 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log) 106 else 107 ovs_setenv $1 108 fi 109} 110 111ovs_add_dp () { 112 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}" 113 sbxname="$1" 114 shift 115 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $* 116 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;" 117} 118 119ovs_add_if () { 120 info "Adding IF to DP: br:$3 if:$4 ($2)" 121 if [ "$5" != "-u" ]; then 122 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if \ 123 -t "$2" "$3" "$4" || return 1 124 else 125 python3 $ovs_base/ovs-dpctl.py add-if \ 126 -u -t "$2" "$3" "$4" >$ovs_dir/$4.out 2>$ovs_dir/$4.err & 127 pid=$! 128 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null" 129 fi 130} 131 132ovs_del_if () { 133 info "Deleting IF from DP: br:$2 if:$3" 134 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1 135} 136 137ovs_netns_spawn_daemon() { 138 sbx=$1 139 shift 140 netns=$1 141 shift 142 if [ "$netns" == "_default" ]; then 143 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 144 else 145 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 146 fi 147 pid=$! 148 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null" 149} 150 151ovs_spawn_daemon() { 152 sbx=$1 153 shift 154 ovs_netns_spawn_daemon $sbx "_default" $* 155} 156 157ovs_add_netns_and_veths () { 158 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}" 159 ovs_sbx "$1" ip netns add "$3" || return 1 160 on_exit "ovs_sbx $1 ip netns del $3" 161 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1 162 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1" 163 ovs_sbx "$1" ip link set "$4" up || return 1 164 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1 165 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1 166 167 if [ "$6" != "" ]; then 168 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \ 169 || return 1 170 fi 171 172 if [ "$7" != "-u" ]; then 173 ovs_add_if "$1" "netdev" "$2" "$4" || return 1 174 else 175 ovs_add_if "$1" "netdev" "$2" "$4" -u || return 1 176 fi 177 178 if [ $TRACING -eq 1 ]; then 179 ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553 180 ovs_wait grep -q "listening on any" ${ovs_dir}/stderr 181 fi 182 183 return 0 184} 185 186ovs_add_flow () { 187 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4" 188 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4" 189 if [ $? -ne 0 ]; then 190 info "Flow [ $3 : $4 ] failed" 191 return 1 192 fi 193 return 0 194} 195 196ovs_del_flows () { 197 info "Deleting all flows from DP: sbx:$1 br:$2" 198 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2" 199 return 0 200} 201 202ovs_drop_record_and_run () { 203 local sbx=$1 204 shift 205 206 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \ 207 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr 208 return $? 209} 210 211ovs_drop_reason_count() 212{ 213 local reason=$1 214 215 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace` 216 local pattern="skb:kfree_skb:.*reason: $reason" 217 218 return `echo "$perf_output" | grep "$pattern" | wc -l` 219} 220 221ovs_test_flow_fails () { 222 ERR_MSG="Flow actions may not be safe on all matching packets" 223 224 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 225 ovs_add_flow $@ &> /dev/null $@ && return 1 226 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 227 228 if [ "$PRE_TEST" == "$POST_TEST" ]; then 229 return 1 230 fi 231 return 0 232} 233 234usage() { 235 echo 236 echo "$0 [OPTIONS] [TEST]..." 237 echo "If no TEST argument is given, all tests will be run." 238 echo 239 echo "Options" 240 echo " -t: capture traffic via tcpdump" 241 echo " -v: verbose" 242 echo " -p: pause on failure" 243 echo 244 echo "Available tests${tests}" 245 exit 1 246} 247 248 249test_dec_ttl() { 250 sbx_add "test_dec_ttl" || return $? 251 ovs_add_dp "test_dec_ttl" decttl || return 1 252 253 info "create namespaces" 254 for ns in client server; do 255 ovs_add_netns_and_veths "test_dec_ttl" "decttl" "$ns" \ 256 "${ns:0:1}0" "${ns:0:1}1" || return 1 257 done 258 259 ip netns exec client ip addr add 10.0.0.1/24 dev c1 260 ip netns exec client ip link set c1 up 261 ip netns exec server ip addr add 10.0.0.2/24 dev s1 262 ip netns exec server ip link set s1 up 263 264 # Probe: check if kernel supports dec_ttl action. 265 ovs_add_flow "test_dec_ttl" decttl \ 266 'in_port(1),eth(),eth_type(0x0800),ipv4()' \ 267 'dec_ttl(le_1())' &>/dev/null 268 if [ $? -ne 0 ]; then 269 info "no support for dec_ttl - skipping" 270 ovs_exit_sig 271 return $ksft_skip 272 fi 273 274 ovs_del_flows "test_dec_ttl" decttl 275 276 # ARP flows (bidirectional) 277 ovs_add_flow "test_dec_ttl" decttl \ 278 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 279 ovs_add_flow "test_dec_ttl" decttl \ 280 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 281 282 # IP flows with dec_ttl action 283 ovs_add_flow "test_dec_ttl" decttl \ 284 'in_port(1),eth(),eth_type(0x0800),ipv4()' \ 285 'dec_ttl(le_1()),2' || return 1 286 ovs_add_flow "test_dec_ttl" decttl \ 287 'in_port(2),eth(),eth_type(0x0800),ipv4()' \ 288 'dec_ttl(le_1()),1' || return 1 289 290 info "verify connectivity with dec_ttl" 291 ovs_sbx "test_dec_ttl" ip netns exec client ping -c 1 -W 2 \ 292 10.0.0.2 || return 1 293 294 info "verify TTL=1 is dropped by dec_ttl" 295 ovs_sbx "test_dec_ttl" ip netns exec client ping -c 1 -W 2 \ 296 -t 1 10.0.0.2 >/dev/null 2>&1 \ 297 && { info "FAIL: ping should fail with TTL=1 and dec_ttl" 298 return 1; } 299 300 return 0 301} 302 303# psample test 304# - use psample to observe packets 305test_psample() { 306 sbx_add "test_psample" || return $? 307 308 # Add a datapath with per-vport dispatching. 309 ovs_add_dp "test_psample" psample -V 2:1 || return 1 310 311 info "create namespaces" 312 ovs_add_netns_and_veths "test_psample" "psample" \ 313 client c0 c1 172.31.110.10/24 -u || return 1 314 ovs_add_netns_and_veths "test_psample" "psample" \ 315 server s0 s1 172.31.110.20/24 -u || return 1 316 317 # Check if psample actions can be configured. 318 ovs_add_flow "test_psample" psample \ 319 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null 320 if [ $? == 1 ]; then 321 info "no support for psample - skipping" 322 ovs_exit_sig 323 return $ksft_skip 324 fi 325 326 ovs_del_flows "test_psample" psample 327 328 # Test action verification. 329 OLDIFS=$IFS 330 IFS='*' 331 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()' 332 for testcase in \ 333 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \ 334 "no group with cookie"*"psample(cookie=abcd)" \ 335 "no group"*"psample()"; 336 do 337 set -- $testcase; 338 ovs_test_flow_fails "test_psample" psample $min_key $2 339 if [ $? == 1 ]; then 340 info "failed - $1" 341 return 1 342 fi 343 done 344 IFS=$OLDIFS 345 346 ovs_del_flows "test_psample" psample 347 # Allow ARP 348 ovs_add_flow "test_psample" psample \ 349 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 350 ovs_add_flow "test_psample" psample \ 351 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 352 353 # Sample first 14 bytes of all traffic. 354 ovs_add_flow "test_psample" psample \ 355 "in_port(1),eth(),eth_type(0x0800),ipv4()" \ 356 "trunc(14),psample(group=1,cookie=c0ffee),2" 357 358 # Sample all traffic. In this case, use a sample() action with both 359 # psample and an upcall emulating simultaneous local sampling and 360 # sFlow / IPFIX. 361 nlpid=$(grep -E "listening on upcall packet handler" \ 362 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ') 363 364 ovs_add_flow "test_psample" psample \ 365 "in_port(2),eth(),eth_type(0x0800),ipv4()" \ 366 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1" 367 368 # Record psample data. 369 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events 370 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout 371 372 # Send a single ping. 373 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1 374 375 # We should have received one userspace action upcall and 2 psample packets. 376 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1 377 378 # client -> server samples should only contain the first 14 bytes of the packet. 379 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \ 380 $ovs_dir/stdout || return 1 381 382 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1 383 384 return 0 385} 386 387# drop_reason test 388# - drop packets and verify the right drop reason is reported 389test_drop_reason() { 390 which perf >/dev/null 2>&1 || return $ksft_skip 391 which pahole >/dev/null 2>&1 || return $ksft_skip 392 393 ovs_drop_subsys=$(pahole -C skb_drop_reason_subsys | 394 awk '/OPENVSWITCH/ { print $3; }' | 395 tr -d ,) 396 397 sbx_add "test_drop_reason" || return $? 398 399 ovs_add_dp "test_drop_reason" dropreason || return 1 400 401 info "create namespaces" 402 for ns in client server; do 403 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \ 404 "${ns:0:1}0" "${ns:0:1}1" || return 1 405 done 406 407 # Setup client namespace 408 ip netns exec client ip addr add 172.31.110.10/24 dev c1 409 ip netns exec client ip link set c1 up 410 411 # Setup server namespace 412 ip netns exec server ip addr add 172.31.110.20/24 dev s1 413 ip netns exec server ip link set s1 up 414 415 # Check if drop reasons can be sent 416 ovs_add_flow "test_drop_reason" dropreason \ 417 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null 418 if [ $? == 1 ]; then 419 info "no support for drop reasons - skipping" 420 ovs_exit_sig 421 return $ksft_skip 422 fi 423 424 ovs_del_flows "test_drop_reason" dropreason 425 426 # Allow ARP 427 ovs_add_flow "test_drop_reason" dropreason \ 428 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 429 ovs_add_flow "test_drop_reason" dropreason \ 430 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 431 432 # Allow client ICMP traffic but drop return path 433 ovs_add_flow "test_drop_reason" dropreason \ 434 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2' 435 ovs_add_flow "test_drop_reason" dropreason \ 436 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop' 437 438 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20 439 ovs_drop_reason_count 0x${ovs_drop_subsys}0001 # OVS_DROP_FLOW_ACTION 440 if [[ "$?" -ne "2" ]]; then 441 info "Did not detect expected drops: $?" 442 return 1 443 fi 444 445 # Drop UDP 6000 traffic with an explicit action and an error code. 446 ovs_add_flow "test_drop_reason" dropreason \ 447 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \ 448 'drop(42)' 449 # Drop UDP 7000 traffic with an explicit action with no error code. 450 ovs_add_flow "test_drop_reason" dropreason \ 451 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \ 452 'drop(0)' 453 454 ovs_drop_record_and_run \ 455 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000 456 ovs_drop_reason_count 0x${ovs_drop_subsys}0004 # OVS_DROP_EXPLICIT_ACTION_ERROR 457 if [[ "$?" -ne "1" ]]; then 458 info "Did not detect expected explicit error drops: $?" 459 return 1 460 fi 461 462 ovs_drop_record_and_run \ 463 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000 464 ovs_drop_reason_count 0x${ovs_drop_subsys}0003 # OVS_DROP_EXPLICIT_ACTION 465 if [[ "$?" -ne "1" ]]; then 466 info "Did not detect expected explicit drops: $?" 467 return 1 468 fi 469 470 return 0 471} 472 473# arp_ping test 474# - client has 1500 byte MTU 475# - server has 1500 byte MTU 476# - send ARP ping between two ns 477test_arp_ping () { 478 479 which arping >/dev/null 2>&1 || return $ksft_skip 480 481 sbx_add "test_arp_ping" || return $? 482 483 ovs_add_dp "test_arp_ping" arpping || return 1 484 485 info "create namespaces" 486 for ns in client server; do 487 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \ 488 "${ns:0:1}0" "${ns:0:1}1" || return 1 489 done 490 491 # Setup client namespace 492 ip netns exec client ip addr add 172.31.110.10/24 dev c1 493 ip netns exec client ip link set c1 up 494 HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 495 info "Client hwaddr: $HW_CLIENT" 496 497 # Setup server namespace 498 ip netns exec server ip addr add 172.31.110.20/24 dev s1 499 ip netns exec server ip link set s1 up 500 HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 501 info "Server hwaddr: $HW_SERVER" 502 503 ovs_add_flow "test_arp_ping" arpping \ 504 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1 505 ovs_add_flow "test_arp_ping" arpping \ 506 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1 507 508 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1 509 510 return 0 511} 512 513# ct_connect_v4 test 514# - client has 1500 byte MTU 515# - server has 1500 byte MTU 516# - use ICMP to ping in each direction 517# - only allow CT state stuff to pass through new in c -> s 518test_ct_connect_v4 () { 519 520 which nc >/dev/null 2>/dev/null || return $ksft_skip 521 522 sbx_add "test_ct_connect_v4" || return $? 523 524 ovs_add_dp "test_ct_connect_v4" ct4 || return 1 525 info "create namespaces" 526 for ns in client server; do 527 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \ 528 "${ns:0:1}0" "${ns:0:1}1" || return 1 529 done 530 531 ip netns exec client ip addr add 172.31.110.10/24 dev c1 532 ip netns exec client ip link set c1 up 533 ip netns exec server ip addr add 172.31.110.20/24 dev s1 534 ip netns exec server ip link set s1 up 535 536 # Add forwarding for ARP and ip packets - completely wildcarded 537 ovs_add_flow "test_ct_connect_v4" ct4 \ 538 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 539 ovs_add_flow "test_ct_connect_v4" ct4 \ 540 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 541 ovs_add_flow "test_ct_connect_v4" ct4 \ 542 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \ 543 'ct(commit),recirc(0x1)' || return 1 544 ovs_add_flow "test_ct_connect_v4" ct4 \ 545 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 546 '2' || return 1 547 ovs_add_flow "test_ct_connect_v4" ct4 \ 548 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 549 '2' || return 1 550 ovs_add_flow "test_ct_connect_v4" ct4 \ 551 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \ 552 '1' || return 1 553 ovs_add_flow "test_ct_connect_v4" ct4 \ 554 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \ 555 return 1 556 557 # do a ping 558 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 559 560 # create an echo server in 'server' 561 echo "server" | \ 562 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \ 563 nc -lvnp 4443 564 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1 565 566 # Now test in the other direction (should fail) 567 echo "client" | \ 568 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \ 569 nc -lvnp 4443 570 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 571 if [ $? == 0 ]; then 572 info "ct connect to client was successful" 573 return 1 574 fi 575 576 info "done..." 577 return 0 578} 579 580# connect_v4 test 581# - client has 1500 byte MTU 582# - server has 1500 byte MTU 583# - use ICMP to ping in each direction 584test_connect_v4 () { 585 586 sbx_add "test_connect_v4" || return $? 587 588 ovs_add_dp "test_connect_v4" cv4 || return 1 589 590 info "create namespaces" 591 for ns in client server; do 592 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \ 593 "${ns:0:1}0" "${ns:0:1}1" || return 1 594 done 595 596 597 ip netns exec client ip addr add 172.31.110.10/24 dev c1 598 ip netns exec client ip link set c1 up 599 ip netns exec server ip addr add 172.31.110.20/24 dev s1 600 ip netns exec server ip link set s1 up 601 602 # Add forwarding for ARP and ip packets - completely wildcarded 603 ovs_add_flow "test_connect_v4" cv4 \ 604 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 605 ovs_add_flow "test_connect_v4" cv4 \ 606 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 607 ovs_add_flow "test_connect_v4" cv4 \ 608 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1 609 ovs_add_flow "test_connect_v4" cv4 \ 610 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1 611 612 # do a ping 613 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 614 615 info "done..." 616 return 0 617} 618 619# nat_connect_v4 test 620# - client has 1500 byte MTU 621# - server has 1500 byte MTU 622# - use ICMP to ping in each direction 623# - only allow CT state stuff to pass through new in c -> s 624test_nat_connect_v4 () { 625 which nc >/dev/null 2>/dev/null || return $ksft_skip 626 627 sbx_add "test_nat_connect_v4" || return $? 628 629 ovs_add_dp "test_nat_connect_v4" nat4 || return 1 630 info "create namespaces" 631 for ns in client server; do 632 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \ 633 "${ns:0:1}0" "${ns:0:1}1" || return 1 634 done 635 636 ip netns exec client ip addr add 172.31.110.10/24 dev c1 637 ip netns exec client ip link set c1 up 638 ip netns exec server ip addr add 172.31.110.20/24 dev s1 639 ip netns exec server ip link set s1 up 640 641 ip netns exec client ip route add default via 172.31.110.20 642 643 ovs_add_flow "test_nat_connect_v4" nat4 \ 644 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 645 ovs_add_flow "test_nat_connect_v4" nat4 \ 646 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 647 ovs_add_flow "test_nat_connect_v4" nat4 \ 648 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \ 649 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)" 650 ovs_add_flow "test_nat_connect_v4" nat4 \ 651 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 652 "ct(commit,nat),recirc(0x2)" 653 654 ovs_add_flow "test_nat_connect_v4" nat4 \ 655 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2" 656 ovs_add_flow "test_nat_connect_v4" nat4 \ 657 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1" 658 659 # do a ping 660 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1 661 662 # create an echo server in 'server' 663 echo "server" | \ 664 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \ 665 nc -lvnp 4443 666 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1 667 668 # Now test in the other direction (should fail) 669 echo "client" | \ 670 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \ 671 nc -lvnp 4443 672 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 673 if [ $? == 0 ]; then 674 info "connect to client was successful" 675 return 1 676 fi 677 678 info "done..." 679 return 0 680} 681 682# nat_related_v4 test 683# - client->server ip packets go via SNAT 684# - client solicits ICMP destination unreachable packet from server 685# - undo NAT for ICMP reply and test dst ip has been updated 686test_nat_related_v4 () { 687 which nc >/dev/null 2>/dev/null || return $ksft_skip 688 689 sbx_add "test_nat_related_v4" || return $? 690 691 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1 692 info "create namespaces" 693 for ns in client server; do 694 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \ 695 "${ns:0:1}0" "${ns:0:1}1" || return 1 696 done 697 698 ip netns exec client ip addr add 172.31.110.10/24 dev c1 699 ip netns exec client ip link set c1 up 700 ip netns exec server ip addr add 172.31.110.20/24 dev s1 701 ip netns exec server ip link set s1 up 702 703 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10 704 705 # Allow ARP 706 ovs_add_flow "test_nat_related_v4" natrelated4 \ 707 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1 708 ovs_add_flow "test_nat_related_v4" natrelated4 \ 709 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1 710 711 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20 712 ovs_add_flow "test_nat_related_v4" natrelated4 \ 713 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \ 714 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1 715 ovs_add_flow "test_nat_related_v4" natrelated4 \ 716 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \ 717 "2" || return 1 718 719 # Allow related ICMP responses back from server and undo NAT to restore original IP 720 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP 721 ovs_add_flow "test_nat_related_v4" natrelated4 \ 722 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 723 "ct(commit,nat),recirc(0x2)" || return 1 724 ovs_add_flow "test_nat_related_v4" natrelated4 \ 725 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \ 726 "1" || return 1 727 ovs_add_flow "test_nat_related_v4" natrelated4 \ 728 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \ 729 "drop" || return 1 730 731 # Solicit destination unreachable response from server 732 ovs_sbx "test_nat_related_v4" ip netns exec client \ 733 bash -c "echo a | nc -u -w 1 172.31.110.20 10000" 734 735 # Check to make sure no packets matched the drop rule with incorrect dst ip 736 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \ 737 | grep "drop" | grep "packets:0" >/dev/null || return 1 738 739 info "done..." 740 return 0 741} 742 743# netlink_validation 744# - Create a dp 745# - check no warning with "old version" simulation 746test_netlink_checks () { 747 sbx_add "test_netlink_checks" || return 1 748 749 info "setting up new DP" 750 ovs_add_dp "test_netlink_checks" nv0 || return 1 751 # now try again 752 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 753 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1 754 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 755 if [ "$PRE_TEST" != "$POST_TEST" ]; then 756 info "failed - gen warning" 757 return 1 758 fi 759 760 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \ 761 return 1 762 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \ 763 return 1 764 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 765 wc -l) == 3 ] || \ 766 return 1 767 ovs_del_if "test_netlink_checks" nv0 right0 || return 1 768 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 769 wc -l) == 2 ] || \ 770 return 1 771 772 info "Checking clone depth" 773 ERR_MSG="Flow actions may not be safe on all matching packets" 774 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 775 ovs_add_flow "test_netlink_checks" nv0 \ 776 'in_port(1),eth(),eth_type(0x800),ipv4()' \ 777 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \ 778 >/dev/null 2>&1 && return 1 779 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 780 781 if [ "$PRE_TEST" == "$POST_TEST" ]; then 782 info "failed - clone depth too large" 783 return 1 784 fi 785 786 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 787 ovs_add_flow "test_netlink_checks" nv0 \ 788 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \ 789 &> /dev/null && return 1 790 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 791 if [ "$PRE_TEST" == "$POST_TEST" ]; then 792 info "failed - error not generated" 793 return 1 794 fi 795 return 0 796} 797 798test_upcall_interfaces() { 799 sbx_add "test_upcall_interfaces" || return 1 800 801 info "setting up new DP" 802 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1 803 804 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \ 805 172.31.110.1/24 -u || return 1 806 807 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out 808 809 info "sending arping" 810 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \ 811 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr 812 813 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1 814 return 0 815} 816 817ovs_add_kernel_tunnel() { 818 local sbxname=$1; shift 819 local ns=$1; shift 820 local tnl_type=$1; shift 821 local name=$1; shift 822 local addr=$1; shift 823 824 info "setting up kernel ${tnl_type} tunnel ${name}" 825 ovs_sbx "${sbxname}" ip -netns ${ns} link add dev ${name} type ${tnl_type} $* || return 1 826 on_exit "ovs_sbx ${sbxname} ip -netns ${ns} link del ${name} >/dev/null 2>&1" 827 ovs_sbx "${sbxname}" ip -netns ${ns} addr add dev ${name} ${addr} || return 1 828 ovs_sbx "${sbxname}" ip -netns ${ns} link set dev ${name} mtu 1450 up || return 1 829} 830 831test_tunnel_metadata() { 832 which arping >/dev/null 2>&1 || return $ksft_skip 833 834 sbxname="test_tunnel_metadata" 835 sbx_add "${sbxname}" || return 1 836 837 info "setting up new DP" 838 ovs_add_dp "${sbxname}" tdp0 -V 2:1 || return 1 839 840 ovs_add_netns_and_veths "${sbxname}" tdp0 tns left0 l0 \ 841 172.31.110.1/24 || return 1 842 843 info "removing veth interface from openvswitch and setting IP" 844 ovs_del_if "${sbxname}" tdp0 left0 || return 1 845 ovs_sbx "${sbxname}" ip addr add 172.31.110.2/24 dev left0 || return 1 846 ovs_sbx "${sbxname}" ip link set left0 up || return 1 847 848 info "setting up tunnel port in openvswitch" 849 ovs_add_if "${sbxname}" "vxlan" tdp0 ovs-vxlan0 -u || return 1 850 on_exit "ovs_sbx ${sbxname} ip link del ovs-vxlan0" 851 ovs_wait ip link show ovs-vxlan0 &>/dev/null || return 1 852 ovs_sbx "${sbxname}" ip link set ovs-vxlan0 up || return 1 853 854 configs=$(echo ' 855 1 172.31.221.1/24 1155332 32 set udpcsum flags\(df\|csum\) 856 2 172.31.222.1/24 1234567 45 set noudpcsum flags\(df\) 857 3 172.31.223.1/24 1020304 23 unset udpcsum flags\(csum\) 858 4 172.31.224.1/24 1357986 15 unset noudpcsum' | sed '/^$/d') 859 860 while read -r i addr id ttl df csum flags; do 861 ovs_add_kernel_tunnel "${sbxname}" tns vxlan vxlan${i} ${addr} \ 862 remote 172.31.110.2 id ${id} dstport 4789 \ 863 ttl ${ttl} df ${df} ${csum} || return 1 864 done <<< "${configs}" 865 866 ovs_wait grep -q 'listening on upcall packet handler' \ 867 ${ovs_dir}/ovs-vxlan0.out || return 1 868 869 info "sending arping" 870 for i in 1 2 3 4; do 871 ovs_sbx "${sbxname}" ip netns exec tns \ 872 arping -I vxlan${i} 172.31.22${i}.2 -c 1 \ 873 >${ovs_dir}/arping.stdout 2>${ovs_dir}/arping.stderr 874 done 875 876 info "checking that received decapsulated packets carry correct metadata" 877 while read -r i addr id ttl df csum flags; do 878 arp_hdr="arp\\(sip=172.31.22${i}.1,tip=172.31.22${i}.2,op=1,sha=" 879 addrs="src=172.31.110.1,dst=172.31.110.2" 880 ports="tp_src=[0-9]*,tp_dst=4789" 881 tnl_md="tunnel\\(tun_id=${id},${addrs},ttl=${ttl},${ports},${flags}\\)" 882 883 ovs_sbx "${sbxname}" grep -qE "MISS upcall.*${tnl_md}.*${arp_hdr}" \ 884 ${ovs_dir}/ovs-vxlan0.out || return 1 885 done <<< "${configs}" 886 887 return 0 888} 889 890test_tunnel_refcount() { 891 sbxname="test_tunnel_refcount" 892 sbx_add "${sbxname}" || return 1 893 894 ovs_sbx "${sbxname}" ip netns add trefns || return 1 895 on_exit "ovs_sbx ${sbxname} ip netns del trefns" 896 897 for tun_type in gre vxlan geneve; do 898 info "testing ${tun_type} tunnel vport refcount" 899 900 ovs_sbx "${sbxname}" ip netns exec trefns \ 901 python3 $ovs_base/ovs-dpctl.py \ 902 add-dp dp-${tun_type} || return 1 903 904 ovs_sbx "${sbxname}" ip netns exec trefns \ 905 python3 $ovs_base/ovs-dpctl.py \ 906 add-if --no-lwt -t ${tun_type} \ 907 dp-${tun_type} ovs-${tun_type}0 || return 1 908 909 ovs_wait ip -netns trefns link show \ 910 ovs-${tun_type}0 >/dev/null 2>&1 || return 1 911 912 info "deleting dp - may hang if reference counting is broken" 913 ovs_sbx "${sbxname}" ip netns exec trefns \ 914 python3 $ovs_base/ovs-dpctl.py \ 915 del-dp dp-${tun_type} & 916 917 dev_removed() { 918 ! ip -netns trefns link show "$1" >/dev/null 2>&1 919 } 920 ovs_wait dev_removed dp-${tun_type} || return 1 921 ovs_wait dev_removed ovs-${tun_type}0 || return 1 922 done 923 924 return 0 925} 926 927test_pop_vlan() { 928 local sbx="test_pop_vlan" 929 sbx_add "$sbx" || return $? 930 ovs_add_dp "$sbx" vlandp || return 1 931 932 ovs_add_netns_and_veths "$sbx" vlandp \ 933 ns1 veth1 ns1veth 192.0.2.1/24 || return 1 934 ovs_add_netns_and_veths "$sbx" vlandp \ 935 ns2 veth2 ns2veth 192.0.2.2/24 || return 1 936 937 # Baseline: untagged bidirectional forwarding 938 ovs_add_flow "$sbx" vlandp \ 939 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 940 ovs_add_flow "$sbx" vlandp \ 941 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 942 ovs_add_flow "$sbx" vlandp \ 943 'in_port(1),eth(),eth_type(0x0800),ipv4()' '2' || return 1 944 ovs_add_flow "$sbx" vlandp \ 945 'in_port(2),eth(),eth_type(0x0800),ipv4()' '1' || return 1 946 ovs_sbx "$sbx" ip netns exec ns1 ping -c 3 -W 2 \ 947 192.0.2.2 || return 1 948 949 # VLAN topology: ns1 uses VLAN sub-interface, ns2 is plain 950 ip -n ns1 link add link ns1veth name ns1veth.10 \ 951 type vlan id 10 || return 1 952 on_exit "ip -n ns1 link del ns1veth.10 2>/dev/null" 953 ip -n ns1 addr add 198.51.100.1/24 dev ns1veth.10 || return 1 954 ip -n ns1 link set ns1veth.10 up || return 1 955 ip -n ns2 addr add 198.51.100.2/24 dev ns2veth || return 1 956 957 ovs_del_flows "$sbx" vlandp 958 959 # Static ARP: avoids VLAN-tagged ARP complexity 960 local ns1veth10mac ns2mac 961 ns1veth10mac=$(ip -n ns1 link show ns1veth.10 \ 962 | awk '/link\/ether/ {print $2}') 963 [ -z "$ns1veth10mac" ] && \ 964 { info "failed to get ns1veth10mac"; return 1; } 965 ns2mac=$(ip -n ns2 link show ns2veth \ 966 | awk '/link\/ether/ {print $2}') 967 [ -z "$ns2mac" ] && \ 968 { info "failed to get ns2mac"; return 1; } 969 ip -n ns1 neigh replace 198.51.100.2 lladdr "$ns2mac" \ 970 dev ns1veth.10 nud permanent || return 1 971 ip -n ns2 neigh replace 198.51.100.1 \ 972 lladdr "$ns1veth10mac" \ 973 dev ns2veth nud permanent || return 1 974 975 local vlan_match='in_port(1),eth(),eth_type(0x8100),' 976 vlan_match+='vlan(vid=10),' 977 vlan_match+='encap(eth_type(0x0800),' 978 vlan_match+='ipv4(src=198.51.100.1,proto=1),icmp())' 979 980 # Negative: forward without pop_vlan -- tagged frame 981 # is invisible to ns2 (no VLAN sub-interface), ping fails 982 ovs_add_flow "$sbx" vlandp "$vlan_match" '2' || return 1 983 ovs_sbx "$sbx" ip netns exec ns1 ping -I ns1veth.10 \ 984 -c 3 -W 1 198.51.100.2 >/dev/null 2>&1 \ 985 && { info "FAIL: ping should fail without pop_vlan" 986 return 1; } 987 988 ovs_del_flows "$sbx" vlandp 989 990 # Positive: pop_vlan strips tag on forward path, 991 # push_vlan restores tag on return path -- ping succeeds 992 ovs_add_flow "$sbx" vlandp \ 993 "$vlan_match" 'pop_vlan,2' || return 1 994 ovs_add_flow "$sbx" vlandp \ 995 'in_port(2),eth(),eth_type(0x0800),ipv4()' \ 996 'push_vlan(vid=10,pcp=0,tpid=0x8100),1' || return 1 997 ovs_sbx "$sbx" ip netns exec ns1 ping -I ns1veth.10 \ 998 -c 3 -W 2 198.51.100.2 || return 1 999 1000 return 0 1001} 1002 1003run_test() { 1004 ( 1005 tname="$1" 1006 tdesc="$2" 1007 1008 if python3 ovs-dpctl.py -h 2>&1 | \ 1009 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then 1010 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}" 1011 return $ksft_skip 1012 fi 1013 1014 python3 ovs-dpctl.py show >/dev/null 2>&1 || \ 1015 echo "[DPCTL] show exception." 1016 1017 if ! lsmod | grep openvswitch >/dev/null 2>&1; then 1018 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}" 1019 return $ksft_skip 1020 fi 1021 1022 printf "TEST: %-60s [START]\n" "${tname}" 1023 1024 unset IFS 1025 1026 eval test_${tname} 1027 ret=$? 1028 1029 if [ $ret -eq 0 ]; then 1030 printf "TEST: %-60s [ OK ]\n" "${tdesc}" 1031 ovs_exit_sig 1032 rm -rf "$ovs_dir" 1033 elif [ $ret -eq 1 ]; then 1034 printf "TEST: %-60s [FAIL]\n" "${tdesc}" 1035 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 1036 echo 1037 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue" 1038 read a 1039 fi 1040 ovs_exit_sig 1041 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir" 1042 exit 1 1043 elif [ $ret -eq $ksft_skip ]; then 1044 printf "TEST: %-60s [SKIP]\n" "${tdesc}" 1045 elif [ $ret -eq 2 ]; then 1046 rm -rf test_${tname} 1047 run_test "$1" "$2" 1048 fi 1049 1050 return $ret 1051 ) 1052 ret=$? 1053 case $ret in 1054 0) 1055 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0 1056 all_skipped=false 1057 ;; 1058 $ksft_skip) 1059 [ $all_skipped = true ] && exitcode=$ksft_skip 1060 ;; 1061 *) 1062 all_skipped=false 1063 exitcode=1 1064 ;; 1065 esac 1066 1067 return $ret 1068} 1069 1070 1071exitcode=0 1072desc=0 1073all_skipped=true 1074 1075while getopts :pvt o 1076do 1077 case $o in 1078 p) PAUSE_ON_FAIL=yes;; 1079 v) VERBOSE=1;; 1080 t) if which tcpdump > /dev/null 2>&1; then 1081 TRACING=1 1082 else 1083 echo "=== tcpdump not available, tracing disabled" 1084 fi 1085 ;; 1086 *) usage;; 1087 esac 1088done 1089shift $(($OPTIND-1)) 1090 1091IFS=" 1092" 1093 1094for arg do 1095 # Check first that all requested tests are available before running any 1096 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; } 1097done 1098 1099name="" 1100desc="" 1101for t in ${tests}; do 1102 [ "${name}" = "" ] && name="${t}" && continue 1103 [ "${desc}" = "" ] && desc="${t}" 1104 1105 run_this=1 1106 for arg do 1107 [ "${arg}" != "${arg#--*}" ] && continue 1108 [ "${arg}" = "${name}" ] && run_this=1 && break 1109 run_this=0 1110 done 1111 if [ $run_this -eq 1 ]; then 1112 run_test "${name}" "${desc}" 1113 fi 1114 name="" 1115 desc="" 1116done 1117 1118exit ${exitcode} 1119