1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# OVS kernel module self tests 5 6trap ovs_exit_sig EXIT TERM INT ERR 7 8# Kselftest framework requirement - SKIP code is 4. 9ksft_skip=4 10 11PAUSE_ON_FAIL=no 12VERBOSE=0 13TRACING=0 14WAIT_TIMEOUT=5 15 16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then 17 WAIT_TIMEOUT=10 18fi 19 20tests=" 21 arp_ping eth-arp: Basic arp ping between two NS 22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct 23 connect_v4 ip4-xon: Basic ipv4 ping between two NS 24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT 25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT 26 netlink_checks ovsnl: validate netlink attrs and settings 27 upcall_interfaces ovs: test the upcall interfaces 28 tunnel_metadata ovs: test extraction of tunnel metadata 29 drop_reason drop: test drop reasons are emitted 30 psample psample: Sampling packets with psample" 31 32info() { 33 [ "${ovs_dir}" != "" ] && 34 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log 35 [ $VERBOSE = 0 ] || echo $* 36} 37 38ovs_wait() { 39 info "waiting $WAIT_TIMEOUT s for: $@" 40 41 if "$@" ; then 42 info "wait succeeded immediately" 43 return 0 44 fi 45 46 # A quick re-check helps speed up small races in fast systems. 47 # However, fractional sleeps might not necessarily work. 48 local start=0 49 sleep 0.1 || { sleep 1; start=1; } 50 51 for (( i=start; i<WAIT_TIMEOUT; i++ )); do 52 if "$@" ; then 53 info "wait succeeded after $i seconds" 54 return 0 55 fi 56 sleep 1 57 done 58 info "wait failed after $i seconds" 59 return 1 60} 61 62ovs_base=`pwd` 63sbxs= 64sbx_add () { 65 info "adding sandbox '$1'" 66 67 sbxs="$sbxs $1" 68 69 NO_BIN=0 70 71 # Create sandbox. 72 local d="$ovs_base"/$1 73 if [ -e $d ]; then 74 info "removing $d" 75 rm -rf "$d" 76 fi 77 mkdir "$d" || return 1 78 ovs_setenv $1 79} 80 81ovs_exit_sig() { 82 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup" 83} 84 85on_exit() { 86 echo "$1" > ${ovs_dir}/cleanup.tmp 87 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp 88 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup 89} 90 91ovs_setenv() { 92 sandbox=$1 93 94 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir 95 96 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup 97} 98 99ovs_sbx() { 100 if test "X$2" != X; then 101 (ovs_setenv $1; shift; 102 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log) 103 else 104 ovs_setenv $1 105 fi 106} 107 108ovs_add_dp () { 109 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}" 110 sbxname="$1" 111 shift 112 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $* 113 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;" 114} 115 116ovs_add_if () { 117 info "Adding IF to DP: br:$3 if:$4 ($2)" 118 if [ "$5" != "-u" ]; then 119 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if \ 120 -t "$2" "$3" "$4" || return 1 121 else 122 python3 $ovs_base/ovs-dpctl.py add-if \ 123 -u -t "$2" "$3" "$4" >$ovs_dir/$4.out 2>$ovs_dir/$4.err & 124 pid=$! 125 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null" 126 fi 127} 128 129ovs_del_if () { 130 info "Deleting IF from DP: br:$2 if:$3" 131 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1 132} 133 134ovs_netns_spawn_daemon() { 135 sbx=$1 136 shift 137 netns=$1 138 shift 139 if [ "$netns" == "_default" ]; then 140 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 141 else 142 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 143 fi 144 pid=$! 145 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null" 146} 147 148ovs_spawn_daemon() { 149 sbx=$1 150 shift 151 ovs_netns_spawn_daemon $sbx "_default" $* 152} 153 154ovs_add_netns_and_veths () { 155 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}" 156 ovs_sbx "$1" ip netns add "$3" || return 1 157 on_exit "ovs_sbx $1 ip netns del $3" 158 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1 159 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1" 160 ovs_sbx "$1" ip link set "$4" up || return 1 161 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1 162 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1 163 164 if [ "$6" != "" ]; then 165 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \ 166 || return 1 167 fi 168 169 if [ "$7" != "-u" ]; then 170 ovs_add_if "$1" "netdev" "$2" "$4" || return 1 171 else 172 ovs_add_if "$1" "netdev" "$2" "$4" -u || return 1 173 fi 174 175 if [ $TRACING -eq 1 ]; then 176 ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553 177 ovs_wait grep -q "listening on any" ${ovs_dir}/stderr 178 fi 179 180 return 0 181} 182 183ovs_add_flow () { 184 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4" 185 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4" 186 if [ $? -ne 0 ]; then 187 info "Flow [ $3 : $4 ] failed" 188 return 1 189 fi 190 return 0 191} 192 193ovs_del_flows () { 194 info "Deleting all flows from DP: sbx:$1 br:$2" 195 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2" 196 return 0 197} 198 199ovs_drop_record_and_run () { 200 local sbx=$1 201 shift 202 203 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \ 204 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr 205 return $? 206} 207 208ovs_drop_reason_count() 209{ 210 local reason=$1 211 212 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace` 213 local pattern="skb:kfree_skb:.*reason: $reason" 214 215 return `echo "$perf_output" | grep "$pattern" | wc -l` 216} 217 218ovs_test_flow_fails () { 219 ERR_MSG="Flow actions may not be safe on all matching packets" 220 221 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 222 ovs_add_flow $@ &> /dev/null $@ && return 1 223 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 224 225 if [ "$PRE_TEST" == "$POST_TEST" ]; then 226 return 1 227 fi 228 return 0 229} 230 231usage() { 232 echo 233 echo "$0 [OPTIONS] [TEST]..." 234 echo "If no TEST argument is given, all tests will be run." 235 echo 236 echo "Options" 237 echo " -t: capture traffic via tcpdump" 238 echo " -v: verbose" 239 echo " -p: pause on failure" 240 echo 241 echo "Available tests${tests}" 242 exit 1 243} 244 245 246# psample test 247# - use psample to observe packets 248test_psample() { 249 sbx_add "test_psample" || return $? 250 251 # Add a datapath with per-vport dispatching. 252 ovs_add_dp "test_psample" psample -V 2:1 || return 1 253 254 info "create namespaces" 255 ovs_add_netns_and_veths "test_psample" "psample" \ 256 client c0 c1 172.31.110.10/24 -u || return 1 257 ovs_add_netns_and_veths "test_psample" "psample" \ 258 server s0 s1 172.31.110.20/24 -u || return 1 259 260 # Check if psample actions can be configured. 261 ovs_add_flow "test_psample" psample \ 262 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null 263 if [ $? == 1 ]; then 264 info "no support for psample - skipping" 265 ovs_exit_sig 266 return $ksft_skip 267 fi 268 269 ovs_del_flows "test_psample" psample 270 271 # Test action verification. 272 OLDIFS=$IFS 273 IFS='*' 274 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()' 275 for testcase in \ 276 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \ 277 "no group with cookie"*"psample(cookie=abcd)" \ 278 "no group"*"psample()"; 279 do 280 set -- $testcase; 281 ovs_test_flow_fails "test_psample" psample $min_key $2 282 if [ $? == 1 ]; then 283 info "failed - $1" 284 return 1 285 fi 286 done 287 IFS=$OLDIFS 288 289 ovs_del_flows "test_psample" psample 290 # Allow ARP 291 ovs_add_flow "test_psample" psample \ 292 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 293 ovs_add_flow "test_psample" psample \ 294 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 295 296 # Sample first 14 bytes of all traffic. 297 ovs_add_flow "test_psample" psample \ 298 "in_port(1),eth(),eth_type(0x0800),ipv4()" \ 299 "trunc(14),psample(group=1,cookie=c0ffee),2" 300 301 # Sample all traffic. In this case, use a sample() action with both 302 # psample and an upcall emulating simultaneous local sampling and 303 # sFlow / IPFIX. 304 nlpid=$(grep -E "listening on upcall packet handler" \ 305 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ') 306 307 ovs_add_flow "test_psample" psample \ 308 "in_port(2),eth(),eth_type(0x0800),ipv4()" \ 309 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1" 310 311 # Record psample data. 312 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events 313 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout 314 315 # Send a single ping. 316 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1 317 318 # We should have received one userspace action upcall and 2 psample packets. 319 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1 320 321 # client -> server samples should only contain the first 14 bytes of the packet. 322 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \ 323 $ovs_dir/stdout || return 1 324 325 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1 326 327 return 0 328} 329 330# drop_reason test 331# - drop packets and verify the right drop reason is reported 332test_drop_reason() { 333 which perf >/dev/null 2>&1 || return $ksft_skip 334 which pahole >/dev/null 2>&1 || return $ksft_skip 335 336 ovs_drop_subsys=$(pahole -C skb_drop_reason_subsys | 337 awk '/OPENVSWITCH/ { print $3; }' | 338 tr -d ,) 339 340 sbx_add "test_drop_reason" || return $? 341 342 ovs_add_dp "test_drop_reason" dropreason || return 1 343 344 info "create namespaces" 345 for ns in client server; do 346 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \ 347 "${ns:0:1}0" "${ns:0:1}1" || return 1 348 done 349 350 # Setup client namespace 351 ip netns exec client ip addr add 172.31.110.10/24 dev c1 352 ip netns exec client ip link set c1 up 353 354 # Setup server namespace 355 ip netns exec server ip addr add 172.31.110.20/24 dev s1 356 ip netns exec server ip link set s1 up 357 358 # Check if drop reasons can be sent 359 ovs_add_flow "test_drop_reason" dropreason \ 360 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null 361 if [ $? == 1 ]; then 362 info "no support for drop reasons - skipping" 363 ovs_exit_sig 364 return $ksft_skip 365 fi 366 367 ovs_del_flows "test_drop_reason" dropreason 368 369 # Allow ARP 370 ovs_add_flow "test_drop_reason" dropreason \ 371 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 372 ovs_add_flow "test_drop_reason" dropreason \ 373 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 374 375 # Allow client ICMP traffic but drop return path 376 ovs_add_flow "test_drop_reason" dropreason \ 377 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2' 378 ovs_add_flow "test_drop_reason" dropreason \ 379 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop' 380 381 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20 382 ovs_drop_reason_count 0x${ovs_drop_subsys}0001 # OVS_DROP_FLOW_ACTION 383 if [[ "$?" -ne "2" ]]; then 384 info "Did not detect expected drops: $?" 385 return 1 386 fi 387 388 # Drop UDP 6000 traffic with an explicit action and an error code. 389 ovs_add_flow "test_drop_reason" dropreason \ 390 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \ 391 'drop(42)' 392 # Drop UDP 7000 traffic with an explicit action with no error code. 393 ovs_add_flow "test_drop_reason" dropreason \ 394 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \ 395 'drop(0)' 396 397 ovs_drop_record_and_run \ 398 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000 399 ovs_drop_reason_count 0x${ovs_drop_subsys}0004 # OVS_DROP_EXPLICIT_ACTION_ERROR 400 if [[ "$?" -ne "1" ]]; then 401 info "Did not detect expected explicit error drops: $?" 402 return 1 403 fi 404 405 ovs_drop_record_and_run \ 406 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000 407 ovs_drop_reason_count 0x${ovs_drop_subsys}0003 # OVS_DROP_EXPLICIT_ACTION 408 if [[ "$?" -ne "1" ]]; then 409 info "Did not detect expected explicit drops: $?" 410 return 1 411 fi 412 413 return 0 414} 415 416# arp_ping test 417# - client has 1500 byte MTU 418# - server has 1500 byte MTU 419# - send ARP ping between two ns 420test_arp_ping () { 421 422 which arping >/dev/null 2>&1 || return $ksft_skip 423 424 sbx_add "test_arp_ping" || return $? 425 426 ovs_add_dp "test_arp_ping" arpping || return 1 427 428 info "create namespaces" 429 for ns in client server; do 430 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \ 431 "${ns:0:1}0" "${ns:0:1}1" || return 1 432 done 433 434 # Setup client namespace 435 ip netns exec client ip addr add 172.31.110.10/24 dev c1 436 ip netns exec client ip link set c1 up 437 HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 438 info "Client hwaddr: $HW_CLIENT" 439 440 # Setup server namespace 441 ip netns exec server ip addr add 172.31.110.20/24 dev s1 442 ip netns exec server ip link set s1 up 443 HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 444 info "Server hwaddr: $HW_SERVER" 445 446 ovs_add_flow "test_arp_ping" arpping \ 447 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1 448 ovs_add_flow "test_arp_ping" arpping \ 449 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1 450 451 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1 452 453 return 0 454} 455 456# ct_connect_v4 test 457# - client has 1500 byte MTU 458# - server has 1500 byte MTU 459# - use ICMP to ping in each direction 460# - only allow CT state stuff to pass through new in c -> s 461test_ct_connect_v4 () { 462 463 which nc >/dev/null 2>/dev/null || return $ksft_skip 464 465 sbx_add "test_ct_connect_v4" || return $? 466 467 ovs_add_dp "test_ct_connect_v4" ct4 || return 1 468 info "create namespaces" 469 for ns in client server; do 470 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \ 471 "${ns:0:1}0" "${ns:0:1}1" || return 1 472 done 473 474 ip netns exec client ip addr add 172.31.110.10/24 dev c1 475 ip netns exec client ip link set c1 up 476 ip netns exec server ip addr add 172.31.110.20/24 dev s1 477 ip netns exec server ip link set s1 up 478 479 # Add forwarding for ARP and ip packets - completely wildcarded 480 ovs_add_flow "test_ct_connect_v4" ct4 \ 481 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 482 ovs_add_flow "test_ct_connect_v4" ct4 \ 483 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 484 ovs_add_flow "test_ct_connect_v4" ct4 \ 485 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \ 486 'ct(commit),recirc(0x1)' || return 1 487 ovs_add_flow "test_ct_connect_v4" ct4 \ 488 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 489 '2' || return 1 490 ovs_add_flow "test_ct_connect_v4" ct4 \ 491 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 492 '2' || return 1 493 ovs_add_flow "test_ct_connect_v4" ct4 \ 494 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \ 495 '1' || return 1 496 ovs_add_flow "test_ct_connect_v4" ct4 \ 497 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \ 498 return 1 499 500 # do a ping 501 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 502 503 # create an echo server in 'server' 504 echo "server" | \ 505 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \ 506 nc -lvnp 4443 507 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1 508 509 # Now test in the other direction (should fail) 510 echo "client" | \ 511 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \ 512 nc -lvnp 4443 513 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 514 if [ $? == 0 ]; then 515 info "ct connect to client was successful" 516 return 1 517 fi 518 519 info "done..." 520 return 0 521} 522 523# connect_v4 test 524# - client has 1500 byte MTU 525# - server has 1500 byte MTU 526# - use ICMP to ping in each direction 527test_connect_v4 () { 528 529 sbx_add "test_connect_v4" || return $? 530 531 ovs_add_dp "test_connect_v4" cv4 || return 1 532 533 info "create namespaces" 534 for ns in client server; do 535 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \ 536 "${ns:0:1}0" "${ns:0:1}1" || return 1 537 done 538 539 540 ip netns exec client ip addr add 172.31.110.10/24 dev c1 541 ip netns exec client ip link set c1 up 542 ip netns exec server ip addr add 172.31.110.20/24 dev s1 543 ip netns exec server ip link set s1 up 544 545 # Add forwarding for ARP and ip packets - completely wildcarded 546 ovs_add_flow "test_connect_v4" cv4 \ 547 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 548 ovs_add_flow "test_connect_v4" cv4 \ 549 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 550 ovs_add_flow "test_connect_v4" cv4 \ 551 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1 552 ovs_add_flow "test_connect_v4" cv4 \ 553 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1 554 555 # do a ping 556 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 557 558 info "done..." 559 return 0 560} 561 562# nat_connect_v4 test 563# - client has 1500 byte MTU 564# - server has 1500 byte MTU 565# - use ICMP to ping in each direction 566# - only allow CT state stuff to pass through new in c -> s 567test_nat_connect_v4 () { 568 which nc >/dev/null 2>/dev/null || return $ksft_skip 569 570 sbx_add "test_nat_connect_v4" || return $? 571 572 ovs_add_dp "test_nat_connect_v4" nat4 || return 1 573 info "create namespaces" 574 for ns in client server; do 575 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \ 576 "${ns:0:1}0" "${ns:0:1}1" || return 1 577 done 578 579 ip netns exec client ip addr add 172.31.110.10/24 dev c1 580 ip netns exec client ip link set c1 up 581 ip netns exec server ip addr add 172.31.110.20/24 dev s1 582 ip netns exec server ip link set s1 up 583 584 ip netns exec client ip route add default via 172.31.110.20 585 586 ovs_add_flow "test_nat_connect_v4" nat4 \ 587 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 588 ovs_add_flow "test_nat_connect_v4" nat4 \ 589 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 590 ovs_add_flow "test_nat_connect_v4" nat4 \ 591 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \ 592 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)" 593 ovs_add_flow "test_nat_connect_v4" nat4 \ 594 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 595 "ct(commit,nat),recirc(0x2)" 596 597 ovs_add_flow "test_nat_connect_v4" nat4 \ 598 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2" 599 ovs_add_flow "test_nat_connect_v4" nat4 \ 600 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1" 601 602 # do a ping 603 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1 604 605 # create an echo server in 'server' 606 echo "server" | \ 607 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \ 608 nc -lvnp 4443 609 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1 610 611 # Now test in the other direction (should fail) 612 echo "client" | \ 613 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \ 614 nc -lvnp 4443 615 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 616 if [ $? == 0 ]; then 617 info "connect to client was successful" 618 return 1 619 fi 620 621 info "done..." 622 return 0 623} 624 625# nat_related_v4 test 626# - client->server ip packets go via SNAT 627# - client solicits ICMP destination unreachable packet from server 628# - undo NAT for ICMP reply and test dst ip has been updated 629test_nat_related_v4 () { 630 which nc >/dev/null 2>/dev/null || return $ksft_skip 631 632 sbx_add "test_nat_related_v4" || return $? 633 634 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1 635 info "create namespaces" 636 for ns in client server; do 637 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \ 638 "${ns:0:1}0" "${ns:0:1}1" || return 1 639 done 640 641 ip netns exec client ip addr add 172.31.110.10/24 dev c1 642 ip netns exec client ip link set c1 up 643 ip netns exec server ip addr add 172.31.110.20/24 dev s1 644 ip netns exec server ip link set s1 up 645 646 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10 647 648 # Allow ARP 649 ovs_add_flow "test_nat_related_v4" natrelated4 \ 650 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1 651 ovs_add_flow "test_nat_related_v4" natrelated4 \ 652 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1 653 654 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20 655 ovs_add_flow "test_nat_related_v4" natrelated4 \ 656 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \ 657 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1 658 ovs_add_flow "test_nat_related_v4" natrelated4 \ 659 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \ 660 "2" || return 1 661 662 # Allow related ICMP responses back from server and undo NAT to restore original IP 663 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP 664 ovs_add_flow "test_nat_related_v4" natrelated4 \ 665 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 666 "ct(commit,nat),recirc(0x2)" || return 1 667 ovs_add_flow "test_nat_related_v4" natrelated4 \ 668 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \ 669 "1" || return 1 670 ovs_add_flow "test_nat_related_v4" natrelated4 \ 671 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \ 672 "drop" || return 1 673 674 # Solicit destination unreachable response from server 675 ovs_sbx "test_nat_related_v4" ip netns exec client \ 676 bash -c "echo a | nc -u -w 1 172.31.110.20 10000" 677 678 # Check to make sure no packets matched the drop rule with incorrect dst ip 679 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \ 680 | grep "drop" | grep "packets:0" >/dev/null || return 1 681 682 info "done..." 683 return 0 684} 685 686# netlink_validation 687# - Create a dp 688# - check no warning with "old version" simulation 689test_netlink_checks () { 690 sbx_add "test_netlink_checks" || return 1 691 692 info "setting up new DP" 693 ovs_add_dp "test_netlink_checks" nv0 || return 1 694 # now try again 695 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 696 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1 697 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 698 if [ "$PRE_TEST" != "$POST_TEST" ]; then 699 info "failed - gen warning" 700 return 1 701 fi 702 703 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \ 704 return 1 705 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \ 706 return 1 707 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 708 wc -l) == 3 ] || \ 709 return 1 710 ovs_del_if "test_netlink_checks" nv0 right0 || return 1 711 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 712 wc -l) == 2 ] || \ 713 return 1 714 715 info "Checking clone depth" 716 ERR_MSG="Flow actions may not be safe on all matching packets" 717 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 718 ovs_add_flow "test_netlink_checks" nv0 \ 719 'in_port(1),eth(),eth_type(0x800),ipv4()' \ 720 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \ 721 >/dev/null 2>&1 && return 1 722 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 723 724 if [ "$PRE_TEST" == "$POST_TEST" ]; then 725 info "failed - clone depth too large" 726 return 1 727 fi 728 729 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 730 ovs_add_flow "test_netlink_checks" nv0 \ 731 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \ 732 &> /dev/null && return 1 733 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 734 if [ "$PRE_TEST" == "$POST_TEST" ]; then 735 info "failed - error not generated" 736 return 1 737 fi 738 return 0 739} 740 741test_upcall_interfaces() { 742 sbx_add "test_upcall_interfaces" || return 1 743 744 info "setting up new DP" 745 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1 746 747 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \ 748 172.31.110.1/24 -u || return 1 749 750 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out 751 752 info "sending arping" 753 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \ 754 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr 755 756 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1 757 return 0 758} 759 760ovs_add_kernel_tunnel() { 761 local sbxname=$1; shift 762 local ns=$1; shift 763 local tnl_type=$1; shift 764 local name=$1; shift 765 local addr=$1; shift 766 767 info "setting up kernel ${tnl_type} tunnel ${name}" 768 ovs_sbx "${sbxname}" ip -netns ${ns} link add dev ${name} type ${tnl_type} $* || return 1 769 on_exit "ovs_sbx ${sbxname} ip -netns ${ns} link del ${name} >/dev/null 2>&1" 770 ovs_sbx "${sbxname}" ip -netns ${ns} addr add dev ${name} ${addr} || return 1 771 ovs_sbx "${sbxname}" ip -netns ${ns} link set dev ${name} mtu 1450 up || return 1 772} 773 774test_tunnel_metadata() { 775 which arping >/dev/null 2>&1 || return $ksft_skip 776 777 sbxname="test_tunnel_metadata" 778 sbx_add "${sbxname}" || return 1 779 780 info "setting up new DP" 781 ovs_add_dp "${sbxname}" tdp0 -V 2:1 || return 1 782 783 ovs_add_netns_and_veths "${sbxname}" tdp0 tns left0 l0 \ 784 172.31.110.1/24 || return 1 785 786 info "removing veth interface from openvswitch and setting IP" 787 ovs_del_if "${sbxname}" tdp0 left0 || return 1 788 ovs_sbx "${sbxname}" ip addr add 172.31.110.2/24 dev left0 || return 1 789 ovs_sbx "${sbxname}" ip link set left0 up || return 1 790 791 info "setting up tunnel port in openvswitch" 792 ovs_add_if "${sbxname}" "vxlan" tdp0 ovs-vxlan0 -u || return 1 793 on_exit "ovs_sbx ${sbxname} ip link del ovs-vxlan0" 794 ovs_wait ip link show ovs-vxlan0 &>/dev/null || return 1 795 ovs_sbx "${sbxname}" ip link set ovs-vxlan0 up || return 1 796 797 configs=$(echo ' 798 1 172.31.221.1/24 1155332 32 set udpcsum flags\(df\|csum\) 799 2 172.31.222.1/24 1234567 45 set noudpcsum flags\(df\) 800 3 172.31.223.1/24 1020304 23 unset udpcsum flags\(csum\) 801 4 172.31.224.1/24 1357986 15 unset noudpcsum' | sed '/^$/d') 802 803 while read -r i addr id ttl df csum flags; do 804 ovs_add_kernel_tunnel "${sbxname}" tns vxlan vxlan${i} ${addr} \ 805 remote 172.31.110.2 id ${id} dstport 4789 \ 806 ttl ${ttl} df ${df} ${csum} || return 1 807 done <<< "${configs}" 808 809 ovs_wait grep -q 'listening on upcall packet handler' \ 810 ${ovs_dir}/ovs-vxlan0.out || return 1 811 812 info "sending arping" 813 for i in 1 2 3 4; do 814 ovs_sbx "${sbxname}" ip netns exec tns \ 815 arping -I vxlan${i} 172.31.22${i}.2 -c 1 \ 816 >${ovs_dir}/arping.stdout 2>${ovs_dir}/arping.stderr 817 done 818 819 info "checking that received decapsulated packets carry correct metadata" 820 while read -r i addr id ttl df csum flags; do 821 arp_hdr="arp\\(sip=172.31.22${i}.1,tip=172.31.22${i}.2,op=1,sha=" 822 addrs="src=172.31.110.1,dst=172.31.110.2" 823 ports="tp_src=[0-9]*,tp_dst=4789" 824 tnl_md="tunnel\\(tun_id=${id},${addrs},ttl=${ttl},${ports},${flags}\\)" 825 826 ovs_sbx "${sbxname}" grep -qE "MISS upcall.*${tnl_md}.*${arp_hdr}" \ 827 ${ovs_dir}/ovs-vxlan0.out || return 1 828 done <<< "${configs}" 829 830 return 0 831} 832 833run_test() { 834 ( 835 tname="$1" 836 tdesc="$2" 837 838 if python3 ovs-dpctl.py -h 2>&1 | \ 839 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then 840 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}" 841 return $ksft_skip 842 fi 843 844 python3 ovs-dpctl.py show >/dev/null 2>&1 || \ 845 echo "[DPCTL] show exception." 846 847 if ! lsmod | grep openvswitch >/dev/null 2>&1; then 848 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}" 849 return $ksft_skip 850 fi 851 852 printf "TEST: %-60s [START]\n" "${tname}" 853 854 unset IFS 855 856 eval test_${tname} 857 ret=$? 858 859 if [ $ret -eq 0 ]; then 860 printf "TEST: %-60s [ OK ]\n" "${tdesc}" 861 ovs_exit_sig 862 rm -rf "$ovs_dir" 863 elif [ $ret -eq 1 ]; then 864 printf "TEST: %-60s [FAIL]\n" "${tdesc}" 865 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 866 echo 867 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue" 868 read a 869 fi 870 ovs_exit_sig 871 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir" 872 exit 1 873 elif [ $ret -eq $ksft_skip ]; then 874 printf "TEST: %-60s [SKIP]\n" "${tdesc}" 875 elif [ $ret -eq 2 ]; then 876 rm -rf test_${tname} 877 run_test "$1" "$2" 878 fi 879 880 return $ret 881 ) 882 ret=$? 883 case $ret in 884 0) 885 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0 886 all_skipped=false 887 ;; 888 $ksft_skip) 889 [ $all_skipped = true ] && exitcode=$ksft_skip 890 ;; 891 *) 892 all_skipped=false 893 exitcode=1 894 ;; 895 esac 896 897 return $ret 898} 899 900 901exitcode=0 902desc=0 903all_skipped=true 904 905while getopts :pvt o 906do 907 case $o in 908 p) PAUSE_ON_FAIL=yes;; 909 v) VERBOSE=1;; 910 t) if which tcpdump > /dev/null 2>&1; then 911 TRACING=1 912 else 913 echo "=== tcpdump not available, tracing disabled" 914 fi 915 ;; 916 *) usage;; 917 esac 918done 919shift $(($OPTIND-1)) 920 921IFS=" 922" 923 924for arg do 925 # Check first that all requested tests are available before running any 926 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; } 927done 928 929name="" 930desc="" 931for t in ${tests}; do 932 [ "${name}" = "" ] && name="${t}" && continue 933 [ "${desc}" = "" ] && desc="${t}" 934 935 run_this=1 936 for arg do 937 [ "${arg}" != "${arg#--*}" ] && continue 938 [ "${arg}" = "${name}" ] && run_this=1 && break 939 run_this=0 940 done 941 if [ $run_this -eq 1 ]; then 942 run_test "${name}" "${desc}" 943 fi 944 name="" 945 desc="" 946done 947 948exit ${exitcode} 949