1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# OVS kernel module self tests 5 6trap ovs_exit_sig EXIT TERM INT ERR 7 8# Kselftest framework requirement - SKIP code is 4. 9ksft_skip=4 10 11PAUSE_ON_FAIL=no 12VERBOSE=0 13TRACING=0 14WAIT_TIMEOUT=5 15 16if test "X$KSFT_MACHINE_SLOW" == "Xyes"; then 17 WAIT_TIMEOUT=10 18fi 19 20tests=" 21 arp_ping eth-arp: Basic arp ping between two NS 22 ct_connect_v4 ip4-ct-xon: Basic ipv4 tcp connection using ct 23 connect_v4 ip4-xon: Basic ipv4 ping between two NS 24 nat_connect_v4 ip4-nat-xon: Basic ipv4 tcp connection via NAT 25 nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT 26 netlink_checks ovsnl: validate netlink attrs and settings 27 upcall_interfaces ovs: test the upcall interfaces 28 tunnel_metadata ovs: test extraction of tunnel metadata 29 tunnel_refcount ovs: test tunnel vport reference cleanup 30 drop_reason drop: test drop reasons are emitted 31 pop_vlan vlan: POP_VLAN action strips tag 32 psample psample: Sampling packets with psample" 33 34info() { 35 [ "${ovs_dir}" != "" ] && 36 echo "`date +"[%m-%d %H:%M:%S]"` $*" >> ${ovs_dir}/debug.log 37 [ $VERBOSE = 0 ] || echo $* 38} 39 40ovs_wait() { 41 info "waiting $WAIT_TIMEOUT s for: $@" 42 43 if "$@" ; then 44 info "wait succeeded immediately" 45 return 0 46 fi 47 48 # A quick re-check helps speed up small races in fast systems. 49 # However, fractional sleeps might not necessarily work. 50 local start=0 51 sleep 0.1 || { sleep 1; start=1; } 52 53 for (( i=start; i<WAIT_TIMEOUT; i++ )); do 54 if "$@" ; then 55 info "wait succeeded after $i seconds" 56 return 0 57 fi 58 sleep 1 59 done 60 info "wait failed after $i seconds" 61 return 1 62} 63 64ovs_base=`pwd` 65sbxs= 66sbx_add () { 67 info "adding sandbox '$1'" 68 69 sbxs="$sbxs $1" 70 71 NO_BIN=0 72 73 # Create sandbox. 74 local d="$ovs_base"/$1 75 if [ -e $d ]; then 76 info "removing $d" 77 rm -rf "$d" 78 fi 79 mkdir "$d" || return 1 80 ovs_setenv $1 81} 82 83ovs_exit_sig() { 84 [ -e ${ovs_dir}/cleanup ] && . "$ovs_dir/cleanup" 85} 86 87on_exit() { 88 echo "$1" > ${ovs_dir}/cleanup.tmp 89 cat ${ovs_dir}/cleanup >> ${ovs_dir}/cleanup.tmp 90 mv ${ovs_dir}/cleanup.tmp ${ovs_dir}/cleanup 91} 92 93ovs_setenv() { 94 sandbox=$1 95 96 ovs_dir=$ovs_base${1:+/$1}; export ovs_dir 97 98 test -e ${ovs_dir}/cleanup || : > ${ovs_dir}/cleanup 99} 100 101ovs_sbx() { 102 if test "X$2" != X; then 103 (ovs_setenv $1; shift; 104 info "run cmd: $@"; "$@" >> ${ovs_dir}/debug.log) 105 else 106 ovs_setenv $1 107 fi 108} 109 110ovs_add_dp () { 111 info "Adding DP/Bridge IF: sbx:$1 dp:$2 {$3, $4, $5}" 112 sbxname="$1" 113 shift 114 ovs_sbx "$sbxname" python3 $ovs_base/ovs-dpctl.py add-dp $* 115 on_exit "ovs_sbx $sbxname python3 $ovs_base/ovs-dpctl.py del-dp $1;" 116} 117 118ovs_add_if () { 119 info "Adding IF to DP: br:$3 if:$4 ($2)" 120 if [ "$5" != "-u" ]; then 121 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if \ 122 -t "$2" "$3" "$4" || return 1 123 else 124 python3 $ovs_base/ovs-dpctl.py add-if \ 125 -u -t "$2" "$3" "$4" >$ovs_dir/$4.out 2>$ovs_dir/$4.err & 126 pid=$! 127 on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null" 128 fi 129} 130 131ovs_del_if () { 132 info "Deleting IF from DP: br:$2 if:$3" 133 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-if "$2" "$3" || return 1 134} 135 136ovs_netns_spawn_daemon() { 137 sbx=$1 138 shift 139 netns=$1 140 shift 141 if [ "$netns" == "_default" ]; then 142 $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 143 else 144 ip netns exec $netns $* >> $ovs_dir/stdout 2>> $ovs_dir/stderr & 145 fi 146 pid=$! 147 ovs_sbx "$sbx" on_exit "kill -TERM $pid 2>/dev/null" 148} 149 150ovs_spawn_daemon() { 151 sbx=$1 152 shift 153 ovs_netns_spawn_daemon $sbx "_default" $* 154} 155 156ovs_add_netns_and_veths () { 157 info "Adding netns attached: sbx:$1 dp:$2 {$3, $4, $5}" 158 ovs_sbx "$1" ip netns add "$3" || return 1 159 on_exit "ovs_sbx $1 ip netns del $3" 160 ovs_sbx "$1" ip link add "$4" type veth peer name "$5" || return 1 161 on_exit "ovs_sbx $1 ip link del $4 >/dev/null 2>&1" 162 ovs_sbx "$1" ip link set "$4" up || return 1 163 ovs_sbx "$1" ip link set "$5" netns "$3" || return 1 164 ovs_sbx "$1" ip netns exec "$3" ip link set "$5" up || return 1 165 166 if [ "$6" != "" ]; then 167 ovs_sbx "$1" ip netns exec "$3" ip addr add "$6" dev "$5" \ 168 || return 1 169 fi 170 171 if [ "$7" != "-u" ]; then 172 ovs_add_if "$1" "netdev" "$2" "$4" || return 1 173 else 174 ovs_add_if "$1" "netdev" "$2" "$4" -u || return 1 175 fi 176 177 if [ $TRACING -eq 1 ]; then 178 ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553 179 ovs_wait grep -q "listening on any" ${ovs_dir}/stderr 180 fi 181 182 return 0 183} 184 185ovs_add_flow () { 186 info "Adding flow to DP: sbx:$1 br:$2 flow:$3 act:$4" 187 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-flow "$2" "$3" "$4" 188 if [ $? -ne 0 ]; then 189 info "Flow [ $3 : $4 ] failed" 190 return 1 191 fi 192 return 0 193} 194 195ovs_del_flows () { 196 info "Deleting all flows from DP: sbx:$1 br:$2" 197 ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py del-flows "$2" 198 return 0 199} 200 201ovs_drop_record_and_run () { 202 local sbx=$1 203 shift 204 205 perf record -a -q -e skb:kfree_skb -o ${ovs_dir}/perf.data $* \ 206 >> ${ovs_dir}/stdout 2>> ${ovs_dir}/stderr 207 return $? 208} 209 210ovs_drop_reason_count() 211{ 212 local reason=$1 213 214 local perf_output=`perf script -i ${ovs_dir}/perf.data -F trace:event,trace` 215 local pattern="skb:kfree_skb:.*reason: $reason" 216 217 return `echo "$perf_output" | grep "$pattern" | wc -l` 218} 219 220ovs_test_flow_fails () { 221 ERR_MSG="Flow actions may not be safe on all matching packets" 222 223 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 224 ovs_add_flow $@ &> /dev/null $@ && return 1 225 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 226 227 if [ "$PRE_TEST" == "$POST_TEST" ]; then 228 return 1 229 fi 230 return 0 231} 232 233usage() { 234 echo 235 echo "$0 [OPTIONS] [TEST]..." 236 echo "If no TEST argument is given, all tests will be run." 237 echo 238 echo "Options" 239 echo " -t: capture traffic via tcpdump" 240 echo " -v: verbose" 241 echo " -p: pause on failure" 242 echo 243 echo "Available tests${tests}" 244 exit 1 245} 246 247 248# psample test 249# - use psample to observe packets 250test_psample() { 251 sbx_add "test_psample" || return $? 252 253 # Add a datapath with per-vport dispatching. 254 ovs_add_dp "test_psample" psample -V 2:1 || return 1 255 256 info "create namespaces" 257 ovs_add_netns_and_veths "test_psample" "psample" \ 258 client c0 c1 172.31.110.10/24 -u || return 1 259 ovs_add_netns_and_veths "test_psample" "psample" \ 260 server s0 s1 172.31.110.20/24 -u || return 1 261 262 # Check if psample actions can be configured. 263 ovs_add_flow "test_psample" psample \ 264 'in_port(1),eth(),eth_type(0x0806),arp()' 'psample(group=1)' &> /dev/null 265 if [ $? == 1 ]; then 266 info "no support for psample - skipping" 267 ovs_exit_sig 268 return $ksft_skip 269 fi 270 271 ovs_del_flows "test_psample" psample 272 273 # Test action verification. 274 OLDIFS=$IFS 275 IFS='*' 276 min_key='in_port(1),eth(),eth_type(0x0800),ipv4()' 277 for testcase in \ 278 "cookie to large"*"psample(group=1,cookie=1615141312111009080706050403020100)" \ 279 "no group with cookie"*"psample(cookie=abcd)" \ 280 "no group"*"psample()"; 281 do 282 set -- $testcase; 283 ovs_test_flow_fails "test_psample" psample $min_key $2 284 if [ $? == 1 ]; then 285 info "failed - $1" 286 return 1 287 fi 288 done 289 IFS=$OLDIFS 290 291 ovs_del_flows "test_psample" psample 292 # Allow ARP 293 ovs_add_flow "test_psample" psample \ 294 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 295 ovs_add_flow "test_psample" psample \ 296 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 297 298 # Sample first 14 bytes of all traffic. 299 ovs_add_flow "test_psample" psample \ 300 "in_port(1),eth(),eth_type(0x0800),ipv4()" \ 301 "trunc(14),psample(group=1,cookie=c0ffee),2" 302 303 # Sample all traffic. In this case, use a sample() action with both 304 # psample and an upcall emulating simultaneous local sampling and 305 # sFlow / IPFIX. 306 nlpid=$(grep -E "listening on upcall packet handler" \ 307 $ovs_dir/s0.out | cut -d ":" -f 2 | tr -d ' ') 308 309 ovs_add_flow "test_psample" psample \ 310 "in_port(2),eth(),eth_type(0x0800),ipv4()" \ 311 "sample(sample=100%,actions(psample(group=2,cookie=eeff0c),userspace(pid=${nlpid},userdata=eeff0c))),1" 312 313 # Record psample data. 314 ovs_spawn_daemon "test_psample" python3 $ovs_base/ovs-dpctl.py psample-events 315 ovs_wait grep -q "listening for psample events" ${ovs_dir}/stdout 316 317 # Send a single ping. 318 ovs_sbx "test_psample" ip netns exec client ping -I c1 172.31.110.20 -c 1 || return 1 319 320 # We should have received one userspace action upcall and 2 psample packets. 321 ovs_wait grep -q "userspace action command" $ovs_dir/s0.out || return 1 322 323 # client -> server samples should only contain the first 14 bytes of the packet. 324 ovs_wait grep -qE "rate:4294967295,group:1,cookie:c0ffee data:[0-9a-f]{28}$" \ 325 $ovs_dir/stdout || return 1 326 327 ovs_wait grep -q "rate:4294967295,group:2,cookie:eeff0c" $ovs_dir/stdout || return 1 328 329 return 0 330} 331 332# drop_reason test 333# - drop packets and verify the right drop reason is reported 334test_drop_reason() { 335 which perf >/dev/null 2>&1 || return $ksft_skip 336 which pahole >/dev/null 2>&1 || return $ksft_skip 337 338 ovs_drop_subsys=$(pahole -C skb_drop_reason_subsys | 339 awk '/OPENVSWITCH/ { print $3; }' | 340 tr -d ,) 341 342 sbx_add "test_drop_reason" || return $? 343 344 ovs_add_dp "test_drop_reason" dropreason || return 1 345 346 info "create namespaces" 347 for ns in client server; do 348 ovs_add_netns_and_veths "test_drop_reason" "dropreason" "$ns" \ 349 "${ns:0:1}0" "${ns:0:1}1" || return 1 350 done 351 352 # Setup client namespace 353 ip netns exec client ip addr add 172.31.110.10/24 dev c1 354 ip netns exec client ip link set c1 up 355 356 # Setup server namespace 357 ip netns exec server ip addr add 172.31.110.20/24 dev s1 358 ip netns exec server ip link set s1 up 359 360 # Check if drop reasons can be sent 361 ovs_add_flow "test_drop_reason" dropreason \ 362 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(10)' 2>/dev/null 363 if [ $? == 1 ]; then 364 info "no support for drop reasons - skipping" 365 ovs_exit_sig 366 return $ksft_skip 367 fi 368 369 ovs_del_flows "test_drop_reason" dropreason 370 371 # Allow ARP 372 ovs_add_flow "test_drop_reason" dropreason \ 373 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 374 ovs_add_flow "test_drop_reason" dropreason \ 375 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 376 377 # Allow client ICMP traffic but drop return path 378 ovs_add_flow "test_drop_reason" dropreason \ 379 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=1),icmp()" '2' 380 ovs_add_flow "test_drop_reason" dropreason \ 381 "in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,proto=1),icmp()" 'drop' 382 383 ovs_drop_record_and_run "test_drop_reason" ip netns exec client ping -c 2 172.31.110.20 384 ovs_drop_reason_count 0x${ovs_drop_subsys}0001 # OVS_DROP_FLOW_ACTION 385 if [[ "$?" -ne "2" ]]; then 386 info "Did not detect expected drops: $?" 387 return 1 388 fi 389 390 # Drop UDP 6000 traffic with an explicit action and an error code. 391 ovs_add_flow "test_drop_reason" dropreason \ 392 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \ 393 'drop(42)' 394 # Drop UDP 7000 traffic with an explicit action with no error code. 395 ovs_add_flow "test_drop_reason" dropreason \ 396 "in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \ 397 'drop(0)' 398 399 ovs_drop_record_and_run \ 400 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000 401 ovs_drop_reason_count 0x${ovs_drop_subsys}0004 # OVS_DROP_EXPLICIT_ACTION_ERROR 402 if [[ "$?" -ne "1" ]]; then 403 info "Did not detect expected explicit error drops: $?" 404 return 1 405 fi 406 407 ovs_drop_record_and_run \ 408 "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000 409 ovs_drop_reason_count 0x${ovs_drop_subsys}0003 # OVS_DROP_EXPLICIT_ACTION 410 if [[ "$?" -ne "1" ]]; then 411 info "Did not detect expected explicit drops: $?" 412 return 1 413 fi 414 415 return 0 416} 417 418# arp_ping test 419# - client has 1500 byte MTU 420# - server has 1500 byte MTU 421# - send ARP ping between two ns 422test_arp_ping () { 423 424 which arping >/dev/null 2>&1 || return $ksft_skip 425 426 sbx_add "test_arp_ping" || return $? 427 428 ovs_add_dp "test_arp_ping" arpping || return 1 429 430 info "create namespaces" 431 for ns in client server; do 432 ovs_add_netns_and_veths "test_arp_ping" "arpping" "$ns" \ 433 "${ns:0:1}0" "${ns:0:1}1" || return 1 434 done 435 436 # Setup client namespace 437 ip netns exec client ip addr add 172.31.110.10/24 dev c1 438 ip netns exec client ip link set c1 up 439 HW_CLIENT=`ip netns exec client ip link show dev c1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 440 info "Client hwaddr: $HW_CLIENT" 441 442 # Setup server namespace 443 ip netns exec server ip addr add 172.31.110.20/24 dev s1 444 ip netns exec server ip link set s1 up 445 HW_SERVER=`ip netns exec server ip link show dev s1 | grep -E 'link/ether [0-9a-f:]+' | awk '{print $2;}'` 446 info "Server hwaddr: $HW_SERVER" 447 448 ovs_add_flow "test_arp_ping" arpping \ 449 "in_port(1),eth(),eth_type(0x0806),arp(sip=172.31.110.10,tip=172.31.110.20,sha=$HW_CLIENT,tha=ff:ff:ff:ff:ff:ff)" '2' || return 1 450 ovs_add_flow "test_arp_ping" arpping \ 451 "in_port(2),eth(),eth_type(0x0806),arp()" '1' || return 1 452 453 ovs_sbx "test_arp_ping" ip netns exec client arping -I c1 172.31.110.20 -c 1 || return 1 454 455 return 0 456} 457 458# ct_connect_v4 test 459# - client has 1500 byte MTU 460# - server has 1500 byte MTU 461# - use ICMP to ping in each direction 462# - only allow CT state stuff to pass through new in c -> s 463test_ct_connect_v4 () { 464 465 which nc >/dev/null 2>/dev/null || return $ksft_skip 466 467 sbx_add "test_ct_connect_v4" || return $? 468 469 ovs_add_dp "test_ct_connect_v4" ct4 || return 1 470 info "create namespaces" 471 for ns in client server; do 472 ovs_add_netns_and_veths "test_ct_connect_v4" "ct4" "$ns" \ 473 "${ns:0:1}0" "${ns:0:1}1" || return 1 474 done 475 476 ip netns exec client ip addr add 172.31.110.10/24 dev c1 477 ip netns exec client ip link set c1 up 478 ip netns exec server ip addr add 172.31.110.20/24 dev s1 479 ip netns exec server ip link set s1 up 480 481 # Add forwarding for ARP and ip packets - completely wildcarded 482 ovs_add_flow "test_ct_connect_v4" ct4 \ 483 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 484 ovs_add_flow "test_ct_connect_v4" ct4 \ 485 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 486 ovs_add_flow "test_ct_connect_v4" ct4 \ 487 'ct_state(-trk),eth(),eth_type(0x0800),ipv4()' \ 488 'ct(commit),recirc(0x1)' || return 1 489 ovs_add_flow "test_ct_connect_v4" ct4 \ 490 'recirc_id(0x1),ct_state(+trk+new),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 491 '2' || return 1 492 ovs_add_flow "test_ct_connect_v4" ct4 \ 493 'recirc_id(0x1),ct_state(+trk+est),in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' \ 494 '2' || return 1 495 ovs_add_flow "test_ct_connect_v4" ct4 \ 496 'recirc_id(0x1),ct_state(+trk+est),in_port(2),eth(),eth_type(0x0800),ipv4(dst=172.31.110.10)' \ 497 '1' || return 1 498 ovs_add_flow "test_ct_connect_v4" ct4 \ 499 'recirc_id(0x1),ct_state(+trk+inv),eth(),eth_type(0x0800),ipv4()' 'drop' || \ 500 return 1 501 502 # do a ping 503 ovs_sbx "test_ct_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 504 505 # create an echo server in 'server' 506 echo "server" | \ 507 ovs_netns_spawn_daemon "test_ct_connect_v4" "server" \ 508 nc -lvnp 4443 509 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.20 4443 || return 1 510 511 # Now test in the other direction (should fail) 512 echo "client" | \ 513 ovs_netns_spawn_daemon "test_ct_connect_v4" "client" \ 514 nc -lvnp 4443 515 ovs_sbx "test_ct_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 516 if [ $? == 0 ]; then 517 info "ct connect to client was successful" 518 return 1 519 fi 520 521 info "done..." 522 return 0 523} 524 525# connect_v4 test 526# - client has 1500 byte MTU 527# - server has 1500 byte MTU 528# - use ICMP to ping in each direction 529test_connect_v4 () { 530 531 sbx_add "test_connect_v4" || return $? 532 533 ovs_add_dp "test_connect_v4" cv4 || return 1 534 535 info "create namespaces" 536 for ns in client server; do 537 ovs_add_netns_and_veths "test_connect_v4" "cv4" "$ns" \ 538 "${ns:0:1}0" "${ns:0:1}1" || return 1 539 done 540 541 542 ip netns exec client ip addr add 172.31.110.10/24 dev c1 543 ip netns exec client ip link set c1 up 544 ip netns exec server ip addr add 172.31.110.20/24 dev s1 545 ip netns exec server ip link set s1 up 546 547 # Add forwarding for ARP and ip packets - completely wildcarded 548 ovs_add_flow "test_connect_v4" cv4 \ 549 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 550 ovs_add_flow "test_connect_v4" cv4 \ 551 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 552 ovs_add_flow "test_connect_v4" cv4 \ 553 'in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10)' '2' || return 1 554 ovs_add_flow "test_connect_v4" cv4 \ 555 'in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20)' '1' || return 1 556 557 # do a ping 558 ovs_sbx "test_connect_v4" ip netns exec client ping 172.31.110.20 -c 3 || return 1 559 560 info "done..." 561 return 0 562} 563 564# nat_connect_v4 test 565# - client has 1500 byte MTU 566# - server has 1500 byte MTU 567# - use ICMP to ping in each direction 568# - only allow CT state stuff to pass through new in c -> s 569test_nat_connect_v4 () { 570 which nc >/dev/null 2>/dev/null || return $ksft_skip 571 572 sbx_add "test_nat_connect_v4" || return $? 573 574 ovs_add_dp "test_nat_connect_v4" nat4 || return 1 575 info "create namespaces" 576 for ns in client server; do 577 ovs_add_netns_and_veths "test_nat_connect_v4" "nat4" "$ns" \ 578 "${ns:0:1}0" "${ns:0:1}1" || return 1 579 done 580 581 ip netns exec client ip addr add 172.31.110.10/24 dev c1 582 ip netns exec client ip link set c1 up 583 ip netns exec server ip addr add 172.31.110.20/24 dev s1 584 ip netns exec server ip link set s1 up 585 586 ip netns exec client ip route add default via 172.31.110.20 587 588 ovs_add_flow "test_nat_connect_v4" nat4 \ 589 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 590 ovs_add_flow "test_nat_connect_v4" nat4 \ 591 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 592 ovs_add_flow "test_nat_connect_v4" nat4 \ 593 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \ 594 "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)" 595 ovs_add_flow "test_nat_connect_v4" nat4 \ 596 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 597 "ct(commit,nat),recirc(0x2)" 598 599 ovs_add_flow "test_nat_connect_v4" nat4 \ 600 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" "2" 601 ovs_add_flow "test_nat_connect_v4" nat4 \ 602 "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4()" "1" 603 604 # do a ping 605 ovs_sbx "test_nat_connect_v4" ip netns exec client ping 192.168.0.20 -c 3 || return 1 606 607 # create an echo server in 'server' 608 echo "server" | \ 609 ovs_netns_spawn_daemon "test_nat_connect_v4" "server" \ 610 nc -lvnp 4443 611 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 192.168.0.20 4443 || return 1 612 613 # Now test in the other direction (should fail) 614 echo "client" | \ 615 ovs_netns_spawn_daemon "test_nat_connect_v4" "client" \ 616 nc -lvnp 4443 617 ovs_sbx "test_nat_connect_v4" ip netns exec client nc -i 1 -zv 172.31.110.10 4443 618 if [ $? == 0 ]; then 619 info "connect to client was successful" 620 return 1 621 fi 622 623 info "done..." 624 return 0 625} 626 627# nat_related_v4 test 628# - client->server ip packets go via SNAT 629# - client solicits ICMP destination unreachable packet from server 630# - undo NAT for ICMP reply and test dst ip has been updated 631test_nat_related_v4 () { 632 which nc >/dev/null 2>/dev/null || return $ksft_skip 633 634 sbx_add "test_nat_related_v4" || return $? 635 636 ovs_add_dp "test_nat_related_v4" natrelated4 || return 1 637 info "create namespaces" 638 for ns in client server; do 639 ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \ 640 "${ns:0:1}0" "${ns:0:1}1" || return 1 641 done 642 643 ip netns exec client ip addr add 172.31.110.10/24 dev c1 644 ip netns exec client ip link set c1 up 645 ip netns exec server ip addr add 172.31.110.20/24 dev s1 646 ip netns exec server ip link set s1 up 647 648 ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10 649 650 # Allow ARP 651 ovs_add_flow "test_nat_related_v4" natrelated4 \ 652 "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1 653 ovs_add_flow "test_nat_related_v4" natrelated4 \ 654 "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1 655 656 # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20 657 ovs_add_flow "test_nat_related_v4" natrelated4 \ 658 "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \ 659 "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1 660 ovs_add_flow "test_nat_related_v4" natrelated4 \ 661 "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \ 662 "2" || return 1 663 664 # Allow related ICMP responses back from server and undo NAT to restore original IP 665 # Drop any ICMP related packets where dst ip hasn't been restored back to original IP 666 ovs_add_flow "test_nat_related_v4" natrelated4 \ 667 "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ 668 "ct(commit,nat),recirc(0x2)" || return 1 669 ovs_add_flow "test_nat_related_v4" natrelated4 \ 670 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \ 671 "1" || return 1 672 ovs_add_flow "test_nat_related_v4" natrelated4 \ 673 "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \ 674 "drop" || return 1 675 676 # Solicit destination unreachable response from server 677 ovs_sbx "test_nat_related_v4" ip netns exec client \ 678 bash -c "echo a | nc -u -w 1 172.31.110.20 10000" 679 680 # Check to make sure no packets matched the drop rule with incorrect dst ip 681 python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \ 682 | grep "drop" | grep "packets:0" >/dev/null || return 1 683 684 info "done..." 685 return 0 686} 687 688# netlink_validation 689# - Create a dp 690# - check no warning with "old version" simulation 691test_netlink_checks () { 692 sbx_add "test_netlink_checks" || return 1 693 694 info "setting up new DP" 695 ovs_add_dp "test_netlink_checks" nv0 || return 1 696 # now try again 697 PRE_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 698 ovs_add_dp "test_netlink_checks" nv0 -V 0 || return 1 699 POST_TEST=$(dmesg | grep -E "RIP: [0-9a-fA-Fx]+:ovs_dp_cmd_new\+") 700 if [ "$PRE_TEST" != "$POST_TEST" ]; then 701 info "failed - gen warning" 702 return 1 703 fi 704 705 ovs_add_netns_and_veths "test_netlink_checks" nv0 left left0 l0 || \ 706 return 1 707 ovs_add_netns_and_veths "test_netlink_checks" nv0 right right0 r0 || \ 708 return 1 709 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 710 wc -l) == 3 ] || \ 711 return 1 712 ovs_del_if "test_netlink_checks" nv0 right0 || return 1 713 [ $(python3 $ovs_base/ovs-dpctl.py show nv0 | grep port | \ 714 wc -l) == 2 ] || \ 715 return 1 716 717 info "Checking clone depth" 718 ERR_MSG="Flow actions may not be safe on all matching packets" 719 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 720 ovs_add_flow "test_netlink_checks" nv0 \ 721 'in_port(1),eth(),eth_type(0x800),ipv4()' \ 722 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \ 723 >/dev/null 2>&1 && return 1 724 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 725 726 if [ "$PRE_TEST" == "$POST_TEST" ]; then 727 info "failed - clone depth too large" 728 return 1 729 fi 730 731 PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") 732 ovs_add_flow "test_netlink_checks" nv0 \ 733 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \ 734 &> /dev/null && return 1 735 POST_TEST=$(dmesg | grep -c "${ERR_MSG}") 736 if [ "$PRE_TEST" == "$POST_TEST" ]; then 737 info "failed - error not generated" 738 return 1 739 fi 740 return 0 741} 742 743test_upcall_interfaces() { 744 sbx_add "test_upcall_interfaces" || return 1 745 746 info "setting up new DP" 747 ovs_add_dp "test_upcall_interfaces" ui0 -V 2:1 || return 1 748 749 ovs_add_netns_and_veths "test_upcall_interfaces" ui0 upc left0 l0 \ 750 172.31.110.1/24 -u || return 1 751 752 ovs_wait grep -q "listening on upcall packet handler" ${ovs_dir}/left0.out 753 754 info "sending arping" 755 ip netns exec upc arping -I l0 172.31.110.20 -c 1 \ 756 >$ovs_dir/arping.stdout 2>$ovs_dir/arping.stderr 757 758 grep -E "MISS upcall\[0/yes\]: .*arp\(sip=172.31.110.1,tip=172.31.110.20,op=1,sha=" $ovs_dir/left0.out >/dev/null 2>&1 || return 1 759 return 0 760} 761 762ovs_add_kernel_tunnel() { 763 local sbxname=$1; shift 764 local ns=$1; shift 765 local tnl_type=$1; shift 766 local name=$1; shift 767 local addr=$1; shift 768 769 info "setting up kernel ${tnl_type} tunnel ${name}" 770 ovs_sbx "${sbxname}" ip -netns ${ns} link add dev ${name} type ${tnl_type} $* || return 1 771 on_exit "ovs_sbx ${sbxname} ip -netns ${ns} link del ${name} >/dev/null 2>&1" 772 ovs_sbx "${sbxname}" ip -netns ${ns} addr add dev ${name} ${addr} || return 1 773 ovs_sbx "${sbxname}" ip -netns ${ns} link set dev ${name} mtu 1450 up || return 1 774} 775 776test_tunnel_metadata() { 777 which arping >/dev/null 2>&1 || return $ksft_skip 778 779 sbxname="test_tunnel_metadata" 780 sbx_add "${sbxname}" || return 1 781 782 info "setting up new DP" 783 ovs_add_dp "${sbxname}" tdp0 -V 2:1 || return 1 784 785 ovs_add_netns_and_veths "${sbxname}" tdp0 tns left0 l0 \ 786 172.31.110.1/24 || return 1 787 788 info "removing veth interface from openvswitch and setting IP" 789 ovs_del_if "${sbxname}" tdp0 left0 || return 1 790 ovs_sbx "${sbxname}" ip addr add 172.31.110.2/24 dev left0 || return 1 791 ovs_sbx "${sbxname}" ip link set left0 up || return 1 792 793 info "setting up tunnel port in openvswitch" 794 ovs_add_if "${sbxname}" "vxlan" tdp0 ovs-vxlan0 -u || return 1 795 on_exit "ovs_sbx ${sbxname} ip link del ovs-vxlan0" 796 ovs_wait ip link show ovs-vxlan0 &>/dev/null || return 1 797 ovs_sbx "${sbxname}" ip link set ovs-vxlan0 up || return 1 798 799 configs=$(echo ' 800 1 172.31.221.1/24 1155332 32 set udpcsum flags\(df\|csum\) 801 2 172.31.222.1/24 1234567 45 set noudpcsum flags\(df\) 802 3 172.31.223.1/24 1020304 23 unset udpcsum flags\(csum\) 803 4 172.31.224.1/24 1357986 15 unset noudpcsum' | sed '/^$/d') 804 805 while read -r i addr id ttl df csum flags; do 806 ovs_add_kernel_tunnel "${sbxname}" tns vxlan vxlan${i} ${addr} \ 807 remote 172.31.110.2 id ${id} dstport 4789 \ 808 ttl ${ttl} df ${df} ${csum} || return 1 809 done <<< "${configs}" 810 811 ovs_wait grep -q 'listening on upcall packet handler' \ 812 ${ovs_dir}/ovs-vxlan0.out || return 1 813 814 info "sending arping" 815 for i in 1 2 3 4; do 816 ovs_sbx "${sbxname}" ip netns exec tns \ 817 arping -I vxlan${i} 172.31.22${i}.2 -c 1 \ 818 >${ovs_dir}/arping.stdout 2>${ovs_dir}/arping.stderr 819 done 820 821 info "checking that received decapsulated packets carry correct metadata" 822 while read -r i addr id ttl df csum flags; do 823 arp_hdr="arp\\(sip=172.31.22${i}.1,tip=172.31.22${i}.2,op=1,sha=" 824 addrs="src=172.31.110.1,dst=172.31.110.2" 825 ports="tp_src=[0-9]*,tp_dst=4789" 826 tnl_md="tunnel\\(tun_id=${id},${addrs},ttl=${ttl},${ports},${flags}\\)" 827 828 ovs_sbx "${sbxname}" grep -qE "MISS upcall.*${tnl_md}.*${arp_hdr}" \ 829 ${ovs_dir}/ovs-vxlan0.out || return 1 830 done <<< "${configs}" 831 832 return 0 833} 834 835test_tunnel_refcount() { 836 sbxname="test_tunnel_refcount" 837 sbx_add "${sbxname}" || return 1 838 839 ovs_sbx "${sbxname}" ip netns add trefns || return 1 840 on_exit "ovs_sbx ${sbxname} ip netns del trefns" 841 842 for tun_type in gre vxlan geneve; do 843 info "testing ${tun_type} tunnel vport refcount" 844 845 ovs_sbx "${sbxname}" ip netns exec trefns \ 846 python3 $ovs_base/ovs-dpctl.py \ 847 add-dp dp-${tun_type} || return 1 848 849 ovs_sbx "${sbxname}" ip netns exec trefns \ 850 python3 $ovs_base/ovs-dpctl.py \ 851 add-if --no-lwt -t ${tun_type} \ 852 dp-${tun_type} ovs-${tun_type}0 || return 1 853 854 ovs_wait ip -netns trefns link show \ 855 ovs-${tun_type}0 >/dev/null 2>&1 || return 1 856 857 info "deleting dp - may hang if reference counting is broken" 858 ovs_sbx "${sbxname}" ip netns exec trefns \ 859 python3 $ovs_base/ovs-dpctl.py \ 860 del-dp dp-${tun_type} & 861 862 dev_removed() { 863 ! ip -netns trefns link show "$1" >/dev/null 2>&1 864 } 865 ovs_wait dev_removed dp-${tun_type} || return 1 866 ovs_wait dev_removed ovs-${tun_type}0 || return 1 867 done 868 869 return 0 870} 871 872test_pop_vlan() { 873 local sbx="test_pop_vlan" 874 sbx_add "$sbx" || return $? 875 ovs_add_dp "$sbx" vlandp || return 1 876 877 ovs_add_netns_and_veths "$sbx" vlandp \ 878 ns1 veth1 ns1veth 192.0.2.1/24 || return 1 879 ovs_add_netns_and_veths "$sbx" vlandp \ 880 ns2 veth2 ns2veth 192.0.2.2/24 || return 1 881 882 # Baseline: untagged bidirectional forwarding 883 ovs_add_flow "$sbx" vlandp \ 884 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 885 ovs_add_flow "$sbx" vlandp \ 886 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 887 ovs_add_flow "$sbx" vlandp \ 888 'in_port(1),eth(),eth_type(0x0800),ipv4()' '2' || return 1 889 ovs_add_flow "$sbx" vlandp \ 890 'in_port(2),eth(),eth_type(0x0800),ipv4()' '1' || return 1 891 ovs_sbx "$sbx" ip netns exec ns1 ping -c 3 -W 2 \ 892 192.0.2.2 || return 1 893 894 # VLAN topology: ns1 uses VLAN sub-interface, ns2 is plain 895 ip -n ns1 link add link ns1veth name ns1veth.10 \ 896 type vlan id 10 || return 1 897 on_exit "ip -n ns1 link del ns1veth.10 2>/dev/null" 898 ip -n ns1 addr add 198.51.100.1/24 dev ns1veth.10 || return 1 899 ip -n ns1 link set ns1veth.10 up || return 1 900 ip -n ns2 addr add 198.51.100.2/24 dev ns2veth || return 1 901 902 ovs_del_flows "$sbx" vlandp 903 904 # Static ARP: avoids VLAN-tagged ARP complexity 905 local ns1veth10mac ns2mac 906 ns1veth10mac=$(ip -n ns1 link show ns1veth.10 \ 907 | awk '/link\/ether/ {print $2}') 908 [ -z "$ns1veth10mac" ] && \ 909 { info "failed to get ns1veth10mac"; return 1; } 910 ns2mac=$(ip -n ns2 link show ns2veth \ 911 | awk '/link\/ether/ {print $2}') 912 [ -z "$ns2mac" ] && \ 913 { info "failed to get ns2mac"; return 1; } 914 ip -n ns1 neigh replace 198.51.100.2 lladdr "$ns2mac" \ 915 dev ns1veth.10 nud permanent || return 1 916 ip -n ns2 neigh replace 198.51.100.1 \ 917 lladdr "$ns1veth10mac" \ 918 dev ns2veth nud permanent || return 1 919 920 local vlan_match='in_port(1),eth(),eth_type(0x8100),' 921 vlan_match+='vlan(vid=10),' 922 vlan_match+='encap(eth_type(0x0800),' 923 vlan_match+='ipv4(src=198.51.100.1,proto=1),icmp())' 924 925 # Negative: forward without pop_vlan -- tagged frame 926 # is invisible to ns2 (no VLAN sub-interface), ping fails 927 ovs_add_flow "$sbx" vlandp "$vlan_match" '2' || return 1 928 ovs_sbx "$sbx" ip netns exec ns1 ping -I ns1veth.10 \ 929 -c 3 -W 1 198.51.100.2 >/dev/null 2>&1 \ 930 && { info "FAIL: ping should fail without pop_vlan" 931 return 1; } 932 933 ovs_del_flows "$sbx" vlandp 934 935 # Positive: pop_vlan strips tag on forward path, 936 # push_vlan restores tag on return path -- ping succeeds 937 ovs_add_flow "$sbx" vlandp \ 938 "$vlan_match" 'pop_vlan,2' || return 1 939 ovs_add_flow "$sbx" vlandp \ 940 'in_port(2),eth(),eth_type(0x0800),ipv4()' \ 941 'push_vlan(vid=10,pcp=0,tpid=0x8100),1' || return 1 942 ovs_sbx "$sbx" ip netns exec ns1 ping -I ns1veth.10 \ 943 -c 3 -W 2 198.51.100.2 || return 1 944 945 return 0 946} 947 948run_test() { 949 ( 950 tname="$1" 951 tdesc="$2" 952 953 if python3 ovs-dpctl.py -h 2>&1 | \ 954 grep -E "Need to (install|upgrade) the python" >/dev/null 2>&1; then 955 stdbuf -o0 printf "TEST: %-60s [PYLIB]\n" "${tdesc}" 956 return $ksft_skip 957 fi 958 959 python3 ovs-dpctl.py show >/dev/null 2>&1 || \ 960 echo "[DPCTL] show exception." 961 962 if ! lsmod | grep openvswitch >/dev/null 2>&1; then 963 stdbuf -o0 printf "TEST: %-60s [NOMOD]\n" "${tdesc}" 964 return $ksft_skip 965 fi 966 967 printf "TEST: %-60s [START]\n" "${tname}" 968 969 unset IFS 970 971 eval test_${tname} 972 ret=$? 973 974 if [ $ret -eq 0 ]; then 975 printf "TEST: %-60s [ OK ]\n" "${tdesc}" 976 ovs_exit_sig 977 rm -rf "$ovs_dir" 978 elif [ $ret -eq 1 ]; then 979 printf "TEST: %-60s [FAIL]\n" "${tdesc}" 980 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 981 echo 982 echo "Pausing. Logs in $ovs_dir/. Hit enter to continue" 983 read a 984 fi 985 ovs_exit_sig 986 [ "${PAUSE_ON_FAIL}" = "yes" ] || rm -rf "$ovs_dir" 987 exit 1 988 elif [ $ret -eq $ksft_skip ]; then 989 printf "TEST: %-60s [SKIP]\n" "${tdesc}" 990 elif [ $ret -eq 2 ]; then 991 rm -rf test_${tname} 992 run_test "$1" "$2" 993 fi 994 995 return $ret 996 ) 997 ret=$? 998 case $ret in 999 0) 1000 [ $all_skipped = true ] && [ $exitcode=$ksft_skip ] && exitcode=0 1001 all_skipped=false 1002 ;; 1003 $ksft_skip) 1004 [ $all_skipped = true ] && exitcode=$ksft_skip 1005 ;; 1006 *) 1007 all_skipped=false 1008 exitcode=1 1009 ;; 1010 esac 1011 1012 return $ret 1013} 1014 1015 1016exitcode=0 1017desc=0 1018all_skipped=true 1019 1020while getopts :pvt o 1021do 1022 case $o in 1023 p) PAUSE_ON_FAIL=yes;; 1024 v) VERBOSE=1;; 1025 t) if which tcpdump > /dev/null 2>&1; then 1026 TRACING=1 1027 else 1028 echo "=== tcpdump not available, tracing disabled" 1029 fi 1030 ;; 1031 *) usage;; 1032 esac 1033done 1034shift $(($OPTIND-1)) 1035 1036IFS=" 1037" 1038 1039for arg do 1040 # Check first that all requested tests are available before running any 1041 command -v > /dev/null "test_${arg}" || { echo "=== Test ${arg} not found"; usage; } 1042done 1043 1044name="" 1045desc="" 1046for t in ${tests}; do 1047 [ "${name}" = "" ] && name="${t}" && continue 1048 [ "${desc}" = "" ] && desc="${t}" 1049 1050 run_this=1 1051 for arg do 1052 [ "${arg}" != "${arg#--*}" ] && continue 1053 [ "${arg}" = "${name}" ] && run_this=1 && break 1054 run_this=0 1055 done 1056 if [ $run_this -eq 1 ]; then 1057 run_test "${name}" "${desc}" 1058 fi 1059 name="" 1060 desc="" 1061done 1062 1063exit ${exitcode} 1064