tests/system-traffic.at

   1 AT_BANNER([datapath-sanity])
   2
   3 AT_SETUP([datapath - ping between two ports])
   4 OVS_TRAFFIC_VSWITCHD_START()
   5
   6 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
   7
   8 ADD_NAMESPACES(at_ns0, at_ns1)
   9
  10 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
  11 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
  12
  13 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
  14 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  15 ])
  16 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
  17 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  18 ])
  19 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
  20 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  21 ])
  22
  23 OVS_TRAFFIC_VSWITCHD_STOP
  24 AT_CLEANUP
  25
  26 AT_SETUP([datapath - ping between two ports on vlan])
  27 OVS_TRAFFIC_VSWITCHD_START()
  28
  29 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
  30
  31 ADD_NAMESPACES(at_ns0, at_ns1)
  32
  33 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
  34 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
  35
  36 ADD_VLAN(p0, at_ns0, 100, "10.2.2.1/24")
  37 ADD_VLAN(p1, at_ns1, 100, "10.2.2.2/24")
  38
  39 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
  40 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  41 ])
  42 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
  43 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  44 ])
  45 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
  46 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  47 ])
  48
  49 OVS_TRAFFIC_VSWITCHD_STOP
  50 AT_CLEANUP
  51
  52 AT_SETUP([datapath - ping6 between two ports])
  53 OVS_TRAFFIC_VSWITCHD_START()
  54
  55 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
  56
  57 ADD_NAMESPACES(at_ns0, at_ns1)
  58
  59 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
  60 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
  61
  62 dnl Without this sleep, we get occasional failures due to the following error:
  63 dnl "connect: Cannot assign requested address"
  64 sleep 2;
  65
  66 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
  67 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  68 ])
  69 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
  70 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  71 ])
  72 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
  73 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  74 ])
  75
  76 OVS_TRAFFIC_VSWITCHD_STOP
  77 AT_CLEANUP
  78
  79 AT_SETUP([datapath - ping6 between two ports on vlan])
  80 OVS_TRAFFIC_VSWITCHD_START()
  81
  82 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
  83
  84 ADD_NAMESPACES(at_ns0, at_ns1)
  85
  86 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
  87 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
  88
  89 ADD_VLAN(p0, at_ns0, 100, "fc00:1::1/96")
  90 ADD_VLAN(p1, at_ns1, 100, "fc00:1::2/96")
  91
  92 dnl Without this sleep, we get occasional failures due to the following error:
  93 dnl "connect: Cannot assign requested address"
  94 sleep 2;
  95
  96 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00:1::2 | FORMAT_PING], [0], [dnl
  97 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  98 ])
  99 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00:1::2 | FORMAT_PING], [0], [dnl
 100 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 101 ])
 102 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00:1::2 | FORMAT_PING], [0], [dnl
 103 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 104 ])
 105
 106 OVS_TRAFFIC_VSWITCHD_STOP
 107 AT_CLEANUP
 108
 109 AT_SETUP([datapath - ping over vxlan tunnel])
 110 OVS_CHECK_VXLAN()
 111
 112 OVS_TRAFFIC_VSWITCHD_START()
 113 ADD_BR([br-underlay])
 114
 115 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
 116 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
 117
 118 ADD_NAMESPACES(at_ns0)
 119
 120 dnl Set up underlay link from host into the namespace using veth pair.
 121 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
 122 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
 123 AT_CHECK([ip link set dev br-underlay up])
 124
 125 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
 126 dnl linux device inside the namespace.
 127 ADD_OVS_TUNNEL([vxlan], [br0], [at_vxlan0], [172.31.1.1], [10.1.1.100/24])
 128 ADD_NATIVE_TUNNEL([vxlan], [at_vxlan1], [at_ns0], [172.31.1.100], [10.1.1.1/24],
 129                   [id 0 dstport 4789])
 130
 131 dnl First, check the underlay
 132 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
 133 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 134 ])
 135
 136 dnl Okay, now check the overlay with different packet sizes
 137 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 138 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 139 ])
 140 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 141 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 142 ])
 143 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 144 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 145 ])
 146
 147 OVS_TRAFFIC_VSWITCHD_STOP
 148 AT_CLEANUP
 149
 150 AT_SETUP([conntrack - controller])
 151 CHECK_CONNTRACK()
 152 OVS_TRAFFIC_VSWITCHD_START()
 153
 154 ADD_NAMESPACES(at_ns0, at_ns1)
 155
 156 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 157 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 158
 159 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 160 AT_DATA([flows.txt], [dnl
 161 priority=1,action=drop
 162 priority=10,arp,action=normal
 163 priority=100,in_port=1,udp,action=ct(commit),controller
 164 priority=100,in_port=2,ct_state=-trk,udp,action=ct(table=0)
 165 priority=100,in_port=2,ct_state=+trk+est,udp,action=controller
 166 ])
 167
 168 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 169
 170 AT_CAPTURE_FILE([ofctl_monitor.log])
 171 AT_CHECK([ovs-ofctl monitor br0 65534 invalid_ttl --detach --no-chdir --pidfile 2> ofctl_monitor.log])
 172
 173 dnl Send an unsolicited reply from port 2. This should be dropped.
 174 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) '50540000000a50540000000908004500001c00000000001100000a0101020a0101010002000100080000'])
 175
 176 dnl OK, now start a new connection from port 1.
 177 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 1 ct\(commit\),controller '50540000000a50540000000908004500001c00000000001100000a0101010a0101020001000200080000'])
 178
 179 dnl Now try a reply from port 2.
 180 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) '50540000000a50540000000908004500001c00000000001100000a0101020a0101010002000100080000'])
 181
 182 dnl Check this output. We only see the latter two packets, not the first.
 183 AT_CHECK([cat ofctl_monitor.log], [0], [dnl
 184 NXT_PACKET_IN (xid=0x0): total_len=42 in_port=1 (via action) data_len=42 (unbuffered)
 185 udp,vlan_tci=0x0000,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_src=10.1.1.1,nw_dst=10.1.1.2,nw_tos=0,nw_ecn=0,nw_ttl=0,tp_src=1,tp_dst=2 udp_csum:0
 186 NXT_PACKET_IN (xid=0x0): cookie=0x0 total_len=42 ct_state=est|rpl|trk,in_port=2 (via action) data_len=42 (unbuffered)
 187 udp,vlan_tci=0x0000,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_src=10.1.1.2,nw_dst=10.1.1.1,nw_tos=0,nw_ecn=0,nw_ttl=0,tp_src=2,tp_dst=1 udp_csum:0
 188 ])
 189
 190 OVS_TRAFFIC_VSWITCHD_STOP
 191 AT_CLEANUP
 192
 193 AT_SETUP([conntrack - IPv4 HTTP])
 194 CHECK_CONNTRACK()
 195 OVS_TRAFFIC_VSWITCHD_START()
 196
 197 ADD_NAMESPACES(at_ns0, at_ns1)
 198
 199 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 200 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 201
 202 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 203 AT_DATA([flows.txt], [dnl
 204 priority=1,action=drop
 205 priority=10,arp,action=normal
 206 priority=10,icmp,action=normal
 207 priority=100,in_port=1,tcp,action=ct(commit),2
 208 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
 209 priority=100,in_port=2,ct_state=+trk+est,tcp,action=1
 210 ])
 211
 212 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 213
 214 dnl Basic connectivity check.
 215 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.2 >/dev/null])
 216
 217 dnl HTTP requests from ns0->ns1 should work fine.
 218 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 219 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 220
 221 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 222 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
 223 ])
 224
 225 dnl HTTP requests from ns1->ns0 should fail due to network failure.
 226 dnl Try 3 times, in 1 second intervals.
 227 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 228 NS_CHECK_EXEC([at_ns1], [wget 10.1.1.1 -t 3 -T 1 -v -o wget1.log], [4])
 229
 230 OVS_TRAFFIC_VSWITCHD_STOP
 231 AT_CLEANUP
 232
 233 AT_SETUP([conntrack - IPv6 HTTP])
 234 CHECK_CONNTRACK()
 235 OVS_TRAFFIC_VSWITCHD_START()
 236
 237 ADD_NAMESPACES(at_ns0, at_ns1)
 238
 239 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
 240 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
 241
 242 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 243 AT_DATA([flows.txt], [dnl
 244 priority=1,action=drop
 245 priority=10,icmp6,action=normal
 246 priority=100,in_port=1,tcp6,action=ct(commit),2
 247 priority=100,in_port=2,ct_state=-trk,tcp6,action=ct(table=0)
 248 priority=100,in_port=2,ct_state=+trk+est,tcp6,action=1
 249 ])
 250
 251 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 252
 253 dnl Without this sleep, we get occasional failures due to the following error:
 254 dnl "connect: Cannot assign requested address"
 255 sleep 2;
 256
 257 dnl HTTP requests from ns0->ns1 should work fine.
 258 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py http6]], [http0.pid])
 259
 260 NS_CHECK_EXEC([at_ns0], [wget http://[[fc00::2]] -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 261
 262 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(fc00::2)], [0], [dnl
 263 tcp,orig=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),reply=(src=fc00::2,dst=fc00::1,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
 264 ])
 265
 266 dnl HTTP requests from ns1->ns0 should fail due to network failure.
 267 dnl Try 3 times, in 1 second intervals.
 268 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py http6]], [http1.pid])
 269 NS_CHECK_EXEC([at_ns1], [wget http://[[fc00::1]] -t 3 -T 1 -v -o wget1.log], [4])
 270
 271 OVS_TRAFFIC_VSWITCHD_STOP
 272 AT_CLEANUP
 273
 274 AT_SETUP([conntrack - commit, recirc])
 275 CHECK_CONNTRACK()
 276 OVS_TRAFFIC_VSWITCHD_START()
 277
 278 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 279
 280 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 281 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 282 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 283 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 284
 285 dnl Allow any traffic from ns0->ns1, ns2->ns3.
 286 AT_DATA([flows.txt], [dnl
 287 priority=1,action=drop
 288 priority=10,arp,action=normal
 289 priority=10,icmp,action=normal
 290 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(commit,table=0)
 291 priority=100,in_port=1,tcp,ct_state=+trk,action=2
 292 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0)
 293 priority=100,in_port=2,tcp,ct_state=+trk,action=1
 294 priority=100,in_port=3,tcp,ct_state=-trk,action=set_field:0->metadata,ct(table=0)
 295 priority=100,in_port=3,tcp,ct_state=+trk,metadata=0,action=set_field:1->metadata,ct(commit,table=0)
 296 priority=100,in_port=3,tcp,ct_state=+trk,metadata=1,action=4
 297 priority=100,in_port=4,tcp,ct_state=-trk,action=ct(commit,table=0)
 298 priority=100,in_port=4,tcp,ct_state=+trk,action=3
 299 ])
 300
 301 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 302
 303 dnl HTTP requests from p0->p1 should work fine.
 304 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 305 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 306
 307 dnl HTTP requests from p2->p3 should work fine.
 308 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 309 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 --retry-connrefused -v -o wget1.log])
 310
 311 OVS_TRAFFIC_VSWITCHD_STOP
 312 AT_CLEANUP
 313
 314 AT_SETUP([conntrack - preserve registers])
 315 CHECK_CONNTRACK()
 316 OVS_TRAFFIC_VSWITCHD_START()
 317
 318 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 319
 320 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 321 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 322 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 323 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 324
 325 dnl Allow any traffic from ns0->ns1, ns2->ns3.
 326 AT_DATA([flows.txt], [dnl
 327 priority=1,action=drop
 328 priority=10,arp,action=normal
 329 priority=10,icmp,action=normal
 330 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(commit,table=0)
 331 priority=100,in_port=1,tcp,ct_state=+trk,action=2
 332 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0)
 333 priority=100,in_port=2,tcp,ct_state=+trk,action=1
 334 priority=100,in_port=3,tcp,ct_state=-trk,action=load:0->NXM_NX_REG0[[]],ct(table=0)
 335 priority=100,in_port=3,tcp,ct_state=+trk,reg0=0,action=load:1->NXM_NX_REG0[[]],ct(commit,table=0)
 336 priority=100,in_port=3,tcp,ct_state=+trk,reg0=1,action=4
 337 priority=100,in_port=4,tcp,ct_state=-trk,action=ct(commit,table=0)
 338 priority=100,in_port=4,tcp,ct_state=+trk,action=3
 339 ])
 340
 341 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 342
 343 dnl HTTP requests from p0->p1 should work fine.
 344 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 345 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 346
 347 dnl HTTP requests from p2->p3 should work fine.
 348 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 349 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 --retry-connrefused -v -o wget1.log])
 350
 351 OVS_TRAFFIC_VSWITCHD_STOP
 352 AT_CLEANUP
 353
 354 AT_SETUP([conntrack - invalid])
 355 CHECK_CONNTRACK()
 356 OVS_TRAFFIC_VSWITCHD_START()
 357
 358 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 359
 360 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 361 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 362 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 363 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 364
 365 dnl Pass traffic from ns0->ns1 without committing, but attempt to track in
 366 dnl the opposite direction. This should fail.
 367 dnl Pass traffic from ns3->ns4 without committing, and this time match
 368 dnl invalid traffic and allow it through.
 369 AT_DATA([flows.txt], [dnl
 370 priority=1,action=drop
 371 priority=10,arp,action=normal
 372 priority=10,icmp,action=normal
 373 priority=100,in_port=1,tcp,action=ct(),2
 374 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
 375 priority=100,in_port=2,ct_state=+trk+new,tcp,action=1
 376 priority=100,in_port=3,tcp,action=ct(),4
 377 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
 378 priority=100,in_port=4,ct_state=+trk+inv,tcp,action=3
 379 priority=100,in_port=4,ct_state=+trk+new,tcp,action=3
 380 ])
 381
 382 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 383
 384 dnl We set up our rules to allow the request without committing. The return
 385 dnl traffic can't be identified, because the initial request wasn't committed.
 386 dnl For the first pair of ports, this means that the connection fails.
 387 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 388 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log], [4])
 389
 390 dnl For the second pair, we allow packets from invalid connections, so it works.
 391 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 392 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 --retry-connrefused -v -o wget1.log])
 393
 394 OVS_TRAFFIC_VSWITCHD_STOP
 395 AT_CLEANUP
 396
 397 AT_SETUP([conntrack - zones])
 398 CHECK_CONNTRACK()
 399 OVS_TRAFFIC_VSWITCHD_START()
 400
 401 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 402
 403 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 404 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 405 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 406 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 407
 408 dnl Allow any traffic from ns0->ns1. Allow return traffic, matching on zone.
 409 dnl For ns2->ns3, use a different zone and see that the match fails.
 410 AT_DATA([flows.txt], [dnl
 411 priority=1,action=drop
 412 priority=10,arp,action=normal
 413 priority=10,icmp,action=normal
 414 priority=100,in_port=1,tcp,action=ct(commit,zone=1),2
 415 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0,zone=1)
 416 priority=100,in_port=2,ct_state=+trk,ct_zone=1,tcp,action=1
 417 priority=100,in_port=3,tcp,action=ct(commit,zone=2),4
 418 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0,zone=2)
 419 priority=100,in_port=4,ct_state=+trk,ct_zone=1,tcp,action=3
 420 ])
 421
 422 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 423
 424 dnl HTTP requests from p0->p1 should work fine.
 425 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 426 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 427
 428 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 429 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
 430 ])
 431
 432 dnl HTTP requests from p2->p3 should fail due to network failure.
 433 dnl Try 3 times, in 1 second intervals.
 434 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 435 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
 436
 437 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
 438 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=ESTABLISHED)
 439 ])
 440
 441 OVS_TRAFFIC_VSWITCHD_STOP
 442 AT_CLEANUP
 443
 444 AT_SETUP([conntrack - zones from field])
 445 CHECK_CONNTRACK()
 446 OVS_TRAFFIC_VSWITCHD_START()
 447
 448 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 449
 450 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 451 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 452 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 453 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 454
 455 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 456 AT_DATA([flows.txt], [dnl
 457 priority=1,action=drop
 458 priority=10,arp,action=normal
 459 priority=10,icmp,action=normal
 460 priority=100,in_port=1,tcp,action=load:0x1001->NXM_NX_REG0[[0..15]],ct(commit,zone=NXM_NX_REG0[[0..15]]),2
 461 priority=100,in_port=2,ct_state=-trk,tcp,action=load:0x1001->NXM_NX_REG0[[0..15]],ct(table=0,zone=NXM_NX_REG0[[0..15]])
 462 priority=100,in_port=2,ct_state=+trk,ct_zone=0x1001,tcp,action=1
 463 priority=100,in_port=3,tcp,action=load:0x1002->NXM_NX_REG0[[0..15]],ct(commit,zone=NXM_NX_REG0[[0..15]]),4
 464 priority=100,in_port=4,ct_state=-trk,tcp,action=load:0x1002->NXM_NX_REG0[[0..15]],ct(table=0,zone=NXM_NX_REG0[[0..15]])
 465 priority=100,in_port=4,ct_state=+trk,ct_zone=0x1001,tcp,action=3
 466 ])
 467
 468 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 469
 470 dnl HTTP requests from p0->p1 should work fine.
 471 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 472 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 473
 474 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 475 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=4097,protoinfo=(state=TIME_WAIT)
 476 ])
 477
 478 dnl HTTP requests from p2->p3 should fail due to network failure.
 479 dnl Try 3 times, in 1 second intervals.
 480 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 481 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
 482
 483 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
 484 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),zone=4098,protoinfo=(state=ESTABLISHED)
 485 ])
 486
 487 OVS_TRAFFIC_VSWITCHD_STOP
 488 AT_CLEANUP
 489
 490 AT_SETUP([conntrack - multiple bridges])
 491 CHECK_CONNTRACK()
 492 OVS_TRAFFIC_VSWITCHD_START(
 493    [_ADD_BR([br1]) --\
 494     add-port br0 patch+ -- set int patch+ type=patch options:peer=patch- --\
 495     add-port br1 patch- -- set int patch- type=patch options:peer=patch+ --])
 496
 497 ADD_NAMESPACES(at_ns0, at_ns1)
 498
 499 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 500 ADD_VETH(p1, at_ns1, br1, "10.1.1.2/24")
 501
 502 dnl Allow any traffic from ns0->br1, allow established in reverse.
 503 AT_DATA([flows-br0.txt], [dnl
 504 priority=1,action=drop
 505 priority=10,arp,action=normal
 506 priority=10,icmp,action=normal
 507 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(commit,zone=1),1
 508 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(table=0,zone=1)
 509 priority=100,in_port=1,tcp,ct_state=+trk+est,ct_zone=1,action=2
 510 ])
 511
 512 dnl Allow any traffic from br0->ns1, allow established in reverse.
 513 AT_DATA([flows-br1.txt], [dnl
 514 priority=1,action=drop
 515 priority=10,arp,action=normal
 516 priority=10,icmp,action=normal
 517 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(table=0,zone=2)
 518 priority=100,in_port=1,tcp,ct_state=+trk+new,ct_zone=2,action=ct(commit,zone=2),2
 519 priority=100,in_port=1,tcp,ct_state=+trk+est,ct_zone=2,action=2
 520 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0,zone=2)
 521 priority=100,in_port=2,tcp,ct_state=+trk+est,ct_zone=2,action=ct(commit,zone=2),1
 522 ])
 523
 524 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows-br0.txt])
 525 AT_CHECK([ovs-ofctl --bundle add-flows br1 flows-br1.txt])
 526
 527 dnl HTTP requests from p0->p1 should work fine.
 528 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 529 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 530
 531 OVS_TRAFFIC_VSWITCHD_STOP
 532 AT_CLEANUP
 533
 534 AT_SETUP([conntrack - multiple zones])
 535 CHECK_CONNTRACK()
 536 OVS_TRAFFIC_VSWITCHD_START()
 537
 538 ADD_NAMESPACES(at_ns0, at_ns1)
 539
 540 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 541 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 542
 543 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 544 AT_DATA([flows.txt], [dnl
 545 priority=1,action=drop
 546 priority=10,arp,action=normal
 547 priority=10,icmp,action=normal
 548 priority=100,in_port=1,tcp,action=ct(commit,zone=1),ct(commit,zone=2),2
 549 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0,zone=2)
 550 priority=100,in_port=2,ct_state=+trk,ct_zone=2,tcp,action=1
 551 ])
 552
 553 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 554
 555 dnl HTTP requests from p0->p1 should work fine.
 556 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 557 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 558
 559 dnl (again) HTTP requests from p0->p1 should work fine.
 560 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 561
 562 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 563 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=SYN_SENT)
 564 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=TIME_WAIT)
 565 ])
 566
 567 OVS_TRAFFIC_VSWITCHD_STOP
 568 AT_CLEANUP
 569
 570 AT_SETUP([conntrack - multiple zones, local])
 571 CHECK_CONNTRACK()
 572 OVS_TRAFFIC_VSWITCHD_START()
 573
 574 ADD_NAMESPACES(at_ns0)
 575
 576 AT_CHECK([ip addr add dev br0 "10.1.1.1/24"])
 577 AT_CHECK([ip link set dev br0 up])
 578 on_exit 'ip addr del dev br0 "10.1.1.1/24"'
 579 ADD_VETH(p0, at_ns0, br0, "10.1.1.2/24")
 580
 581 dnl Allow traffic from local stack to ns0. Only allow neighbour discovery,
 582 dnl return traffic from ns0 back to the local stack.
 583 AT_DATA([flows.txt], [dnl
 584 priority=1,action=drop
 585 priority=10,arp,action=normal
 586 priority=100,in_port=LOCAL,ip,ct_state=-trk,action=drop
 587 priority=100,in_port=LOCAL,ip,ct_state=+trk+new,action=ct(commit,zone=1),ct(commit,zone=2),1
 588 priority=100,in_port=LOCAL,ip,ct_state=+trk+est,action=ct(commit,zone=1),ct(commit,zone=2),1
 589 priority=100,in_port=1,ip,ct_state=-trk,action=ct(table=1,zone=1)
 590 table=1,priority=100,in_port=1,ip,ct_state=+trk+est,ct_zone=1,action=ct(table=2,zone=2)
 591 table=2,priority=100,in_port=1,ip,ct_state=+trk+est,ct_zone=2,action=LOCAL
 592 ])
 593
 594 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 595
 596 AT_CHECK([ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
 597 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 598 ])
 599
 600 dnl HTTP requests from root namespace to p0 should work fine.
 601 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 602 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 603
 604 dnl (again) HTTP requests from root namespace to  p0 should work fine.
 605 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 606
 607 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep "zone"], [0], [dnl
 608 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=1
 609 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=2
 610 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
 611 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=TIME_WAIT)
 612 ])
 613
 614 OVS_TRAFFIC_VSWITCHD_STOP
 615 AT_CLEANUP
 616
 617 AT_SETUP([conntrack - multiple namespaces, internal ports])
 618 CHECK_CONNTRACK()
 619 OVS_TRAFFIC_VSWITCHD_START(
 620    [set-fail-mode br0 secure -- ])
 621
 622 ADD_NAMESPACES(at_ns0, at_ns1)
 623
 624 ADD_INT(p0, at_ns0, br0, "10.1.1.1/24")
 625 ADD_INT(p1, at_ns1, br0, "10.1.1.2/24")
 626
 627 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 628 dnl
 629 dnl If skb->nfct is leaking from inside the namespace, this test will fail.
 630 AT_DATA([flows.txt], [dnl
 631 priority=1,action=drop
 632 priority=10,arp,action=normal
 633 priority=10,icmp,action=normal
 634 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=1),2
 635 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0,zone=1)
 636 priority=100,in_port=2,ct_state=+trk,ct_zone=1,tcp,action=1
 637 ])
 638
 639 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 640
 641 dnl HTTP requests from p0->p1 should work fine.
 642 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 643 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 644
 645 dnl (again) HTTP requests from p0->p1 should work fine.
 646 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 647
 648 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 649 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
 650 ])
 651
 652 OVS_TRAFFIC_VSWITCHD_STOP(["dnl
 653 /ioctl(SIOCGIFINDEX) on .* device failed: No such device/d
 654 /removing policing failed: No such device/d"])
 655 AT_CLEANUP
 656
 657 AT_SETUP([conntrack - multi-stage pipeline, local])
 658 CHECK_CONNTRACK()
 659 OVS_TRAFFIC_VSWITCHD_START()
 660
 661 ADD_NAMESPACES(at_ns0)
 662
 663 AT_CHECK([ip addr add dev br0 "10.1.1.1/24"])
 664 AT_CHECK([ip link set dev br0 up])
 665 on_exit 'ip addr del dev br0 "10.1.1.1/24"'
 666 ADD_VETH(p0, at_ns0, br0, "10.1.1.2/24")
 667
 668 dnl Allow traffic from local stack to ns0. Only allow neighbour discovery,
 669 dnl return traffic from ns0 back to the local stack.
 670 AT_DATA([flows.txt], [dnl
 671 dnl default
 672 table=0,priority=1,action=drop
 673 table=0,priority=10,arp,action=normal
 674
 675 dnl Load the output port to REG0
 676 table=0,priority=100,ip,in_port=LOCAL,action=load:1->NXM_NX_REG0[[0..15]],goto_table:1
 677 table=0,priority=100,ip,in_port=1,action=load:65534->NXM_NX_REG0[[0..15]],goto_table:1
 678
 679 dnl Ingress pipeline
 680 dnl - Allow all connections from LOCAL port (commit and proceed to egress)
 681 dnl - All other connections go through conntracker using the input port as
 682 dnl   a connection tracking zone.
 683 table=1,priority=150,in_port=LOCAL,ip,ct_state=+trk+new,action=ct(commit,zone=OXM_OF_IN_PORT[[0..15]]),goto_table:2
 684 table=1,priority=100,ip,action=ct(table=2,zone=OXM_OF_IN_PORT[[0..15]])
 685 table=1,priority=1,action=drop
 686
 687 dnl Egress pipeline
 688 dnl - Allow all connections from LOCAL port (commit and skip to output)
 689 dnl - Allow other established connections to go through conntracker using
 690 dnl   output port as a connection tracking zone.
 691 table=2,priority=150,in_port=LOCAL,ip,ct_state=+trk+new,action=ct(commit,zone=NXM_NX_REG0[[0..15]]),goto_table:4
 692 table=2,priority=100,ip,ct_state=+trk+est,action=ct(table=3,zone=NXM_NX_REG0[[0..15]])
 693 table=2,priority=1,action=drop
 694
 695 dnl Only allow established traffic from egress ct lookup
 696 table=3,priority=100,ip,ct_state=+trk+est,action=goto_table:4
 697 table=3,priority=1,action=drop
 698
 699 dnl output table
 700 table=4,priority=100,ip,action=output:NXM_NX_REG0[[]]
 701 ])
 702
 703 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 704
 705 AT_CHECK([ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
 706 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 707 ])
 708
 709 dnl HTTP requests from root namespace to p0 should work fine.
 710 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 711 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 712
 713 dnl (again) HTTP requests from root namespace to p0 should work fine.
 714 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 715
 716 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep "zone"], [0], [dnl
 717 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=1
 718 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=65534
 719 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
 720 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=65534,protoinfo=(state=TIME_WAIT)
 721 ])
 722
 723 OVS_TRAFFIC_VSWITCHD_STOP
 724 AT_CLEANUP
 725
 726 AT_SETUP([conntrack - ct_mark])
 727 CHECK_CONNTRACK()
 728 OVS_TRAFFIC_VSWITCHD_START()
 729
 730 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 731
 732 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 733 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 734 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 735 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 736
 737 dnl Allow traffic between ns0<->ns1 using the ct_mark.
 738 dnl Check that different marks do not match for traffic between ns2<->ns3.
 739 AT_DATA([flows.txt], [dnl
 740 priority=1,action=drop
 741 priority=10,arp,action=normal
 742 priority=10,icmp,action=normal
 743 priority=100,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_mark)),2
 744 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
 745 priority=100,in_port=2,ct_state=+trk,ct_mark=1,tcp,action=1
 746 priority=100,in_port=3,tcp,action=ct(commit,exec(set_field:2->ct_mark)),4
 747 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
 748 priority=100,in_port=4,ct_state=+trk,ct_mark=1,tcp,action=3
 749 ])
 750
 751 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 752
 753 dnl HTTP requests from p0->p1 should work fine.
 754 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 755 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 756
 757 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep TIME], [0], [dnl
 758 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),mark=1,protoinfo=(state=TIME_WAIT)
 759 ])
 760
 761 dnl HTTP requests from p2->p3 should fail due to network failure.
 762 dnl Try 3 times, in 1 second intervals.
 763 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 764 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
 765
 766 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
 767 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),mark=2,protoinfo=(state=ESTABLISHED)
 768 ])
 769
 770 OVS_TRAFFIC_VSWITCHD_STOP
 771 AT_CLEANUP
 772
 773 AT_SETUP([conntrack - ct_mark from register])
 774 CHECK_CONNTRACK()
 775 OVS_TRAFFIC_VSWITCHD_START()
 776
 777 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 778
 779 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 780 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 781 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 782 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 783
 784 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 785 AT_DATA([flows.txt], [dnl
 786 priority=1,action=drop
 787 priority=10,arp,action=normal
 788 priority=10,icmp,action=normal
 789 priority=100,in_port=1,tcp,action=load:1->NXM_NX_REG0[[0..31]],ct(commit,exec(move:NXM_NX_REG0[[0..31]]->NXM_NX_CT_MARK[[]])),2
 790 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
 791 priority=100,in_port=2,ct_state=+trk,ct_mark=1,tcp,action=1
 792 priority=100,in_port=3,tcp,action=load:2->NXM_NX_REG0[[0..31]],ct(commit,exec(move:NXM_NX_REG0[[0..31]]->NXM_NX_CT_MARK[[]])),4
 793 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
 794 priority=100,in_port=4,ct_state=+trk,ct_mark=1,tcp,action=3
 795 ])
 796
 797 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 798
 799 dnl HTTP requests from p0->p1 should work fine.
 800 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 801 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 802
 803 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep TIME], [0], [dnl
 804 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),mark=1,protoinfo=(state=TIME_WAIT)
 805 ])
 806
 807 dnl HTTP requests from p2->p3 should fail due to network failure.
 808 dnl Try 3 times, in 1 second intervals.
 809 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 810 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
 811
 812 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
 813 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),mark=2,protoinfo=(state=ESTABLISHED)
 814 ])
 815
 816 OVS_TRAFFIC_VSWITCHD_STOP
 817 AT_CLEANUP
 818
 819 AT_SETUP([conntrack - ct_label])
 820 CHECK_CONNTRACK()
 821 OVS_TRAFFIC_VSWITCHD_START()
 822
 823 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 824
 825 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 826 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 827 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 828 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 829
 830 dnl Allow traffic between ns0<->ns1 using the ct_label.
 831 dnl Check that different labels do not match for traffic between ns2<->ns3.
 832 AT_DATA([flows.txt], [dnl
 833 priority=1,action=drop
 834 priority=10,arp,action=normal
 835 priority=10,icmp,action=normal
 836 priority=100,in_port=1,tcp,action=ct(commit,exec(set_field:0x0a000d000005000001->ct_label)),2
 837 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
 838 priority=100,in_port=2,ct_state=+trk,ct_label=0x0a000d000005000001,tcp,action=1
 839 priority=100,in_port=3,tcp,action=ct(commit,exec(set_field:0x2->ct_label)),4
 840 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
 841 priority=100,in_port=4,ct_state=+trk,ct_label=0x0a000d000005000001,tcp,action=3
 842 ])
 843
 844 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 845
 846 dnl HTTP requests from p0->p1 should work fine.
 847 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 848 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 849
 850 dnl HTTP requests from p2->p3 should fail due to network failure.
 851 dnl Try 3 times, in 1 second intervals.
 852 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 853 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
 854
 855 OVS_TRAFFIC_VSWITCHD_STOP
 856 AT_CLEANUP
 857
 858 AT_SETUP([conntrack - ICMP related])
 859 CHECK_CONNTRACK()
 860 OVS_TRAFFIC_VSWITCHD_START()
 861
 862 ADD_NAMESPACES(at_ns0, at_ns1)
 863
 864 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 865 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 866
 867 dnl Allow UDP traffic from ns0->ns1. Only allow related ICMP responses back.
 868 AT_DATA([flows.txt], [dnl
 869 priority=1,action=drop
 870 priority=10,arp,action=normal
 871 priority=100,in_port=1,udp,action=ct(commit,exec(set_field:1->ct_mark)),2
 872 priority=100,in_port=2,icmp,ct_state=-trk,action=ct(table=0)
 873 priority=100,in_port=2,icmp,ct_state=+trk+rel,ct_mark=1,action=1
 874 ])
 875
 876 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 877
 878 dnl UDP packets from ns0->ns1 should solicit "destination unreachable" response.
 879 NS_CHECK_EXEC([at_ns0], [bash -c "echo a | nc $NC_EOF_OPT -u 10.1.1.2 10000"])
 880
 881 AT_CHECK([ovs-appctl revalidator/purge], [0])
 882 AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort | grep -v drop], [0], [dnl
 883  n_packets=1, n_bytes=44, priority=100,udp,in_port=1 actions=ct(commit,exec(load:0x1->NXM_NX_CT_MARK[[]])),output:2
 884  n_packets=1, n_bytes=72, priority=100,ct_state=+rel+trk,ct_mark=0x1,icmp,in_port=2 actions=output:1
 885  n_packets=1, n_bytes=72, priority=100,ct_state=-trk,icmp,in_port=2 actions=ct(table=0)
 886  n_packets=2, n_bytes=84, priority=10,arp actions=NORMAL
 887 NXST_FLOW reply:
 888 ])
 889
 890 OVS_TRAFFIC_VSWITCHD_STOP
 891 AT_CLEANUP
 892
 893 AT_SETUP([conntrack - ICMP related 2])
 894 CHECK_CONNTRACK()
 895 OVS_TRAFFIC_VSWITCHD_START()
 896
 897 ADD_NAMESPACES(at_ns0, at_ns1)
 898
 899 ADD_VETH(p0, at_ns0, br0, "172.16.0.1/24")
 900 ADD_VETH(p1, at_ns1, br0, "172.16.0.2/24")
 901
 902 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 903 AT_DATA([flows.txt], [dnl
 904 priority=1,action=drop
 905 priority=10,arp,action=normal
 906 priority=100,in_port=1,udp,ct_state=-trk,action=ct(commit,table=0)
 907 priority=100,in_port=1,ip,ct_state=+trk,actions=controller
 908 priority=100,in_port=2,ip,ct_state=-trk,action=ct(table=0)
 909 priority=100,in_port=2,ip,ct_state=+trk+rel+rpl,action=controller
 910 ])
 911
 912 AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows.txt])
 913
 914 AT_CAPTURE_FILE([ofctl_monitor.log])
 915 AT_CHECK([ovs-ofctl monitor br0 65534 invalid_ttl --detach --no-chdir --pidfile 2> ofctl_monitor.log])
 916
 917 dnl 1. Send an ICMP port unreach reply for port 8738, without any previous request
 918 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) 'f64c473528c9c6f54ecb72db080045c0003d2e8700004001f355ac100004ac1000030303553f0000000045000021317040004011b138ac100003ac10000411112222000d20966369616f0a'])
 919
 920 dnl 2. Send and UDP packet to port 5555
 921 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 1 ct\(commit,table=0\) 'c6f94ecb72dbe64c473528c9080045000021317040004011b138ac100001ac100002a28e15b3000d20966369616f0a'])
 922
 923 dnl 3. Send an ICMP port unreach reply for port 5555, related to the first packet
 924 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) 'e64c473528c9c6f94ecb72db080045c0003d2e8700004001f355ac100002ac1000010303553f0000000045000021317040004011b138ac100001ac100002a28e15b3000d20966369616f0a'])
 925
 926 dnl Check this output. We only see the latter two packets, not the first.
 927 AT_CHECK([cat ofctl_monitor.log], [0], [dnl
 928 NXT_PACKET_IN (xid=0x0): cookie=0x0 total_len=47 ct_state=new|trk,in_port=1 (via action) data_len=47 (unbuffered)
 929 udp,vlan_tci=0x0000,dl_src=e6:4c:47:35:28:c9,dl_dst=c6:f9:4e:cb:72:db,nw_src=172.16.0.1,nw_dst=172.16.0.2,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=41614,tp_dst=5555 udp_csum:2096
 930 NXT_PACKET_IN (xid=0x0): cookie=0x0 total_len=75 ct_state=rel|rpl|trk,in_port=2 (via action) data_len=75 (unbuffered)
 931 icmp,vlan_tci=0x0000,dl_src=c6:f9:4e:cb:72:db,dl_dst=e6:4c:47:35:28:c9,nw_src=172.16.0.2,nw_dst=172.16.0.1,nw_tos=192,nw_ecn=0,nw_ttl=64,icmp_type=3,icmp_code=3 icmp_csum:553f
 932 ])
 933
 934 OVS_TRAFFIC_VSWITCHD_STOP
 935 AT_CLEANUP
 936
 937 AT_SETUP([conntrack - FTP])
 938 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
 939 CHECK_CONNTRACK()
 940 OVS_TRAFFIC_VSWITCHD_START()
 941
 942 ADD_NAMESPACES(at_ns0, at_ns1)
 943
 944 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 945 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 946
 947 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 948 AT_DATA([flows1.txt], [dnl
 949 priority=1,action=drop
 950 priority=10,arp,action=normal
 951 priority=10,icmp,action=normal
 952 priority=100,in_port=1,tcp,action=ct(alg=ftp,commit),2
 953 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0)
 954 priority=100,in_port=2,tcp,ct_state=+trk+est,action=1
 955 priority=100,in_port=2,tcp,ct_state=+trk+rel,action=1
 956 ])
 957
 958 dnl Similar policy but without allowing all traffic from ns0->ns1.
 959 AT_DATA([flows2.txt], [dnl
 960 priority=1,action=drop
 961 priority=10,arp,action=normal
 962 priority=10,icmp,action=normal
 963 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(table=0)
 964 priority=100,in_port=1,tcp,ct_state=+trk+new,action=ct(commit,alg=ftp),2
 965 priority=100,in_port=1,tcp,ct_state=+trk+est,action=2
 966 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0)
 967 priority=100,in_port=2,tcp,ct_state=+trk+new+rel,action=ct(commit),1
 968 priority=100,in_port=2,tcp,ct_state=+trk+est,action=1
 969 priority=100,in_port=2,tcp,ct_state=+trk-new+rel,action=1
 970 ])
 971
 972 AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows1.txt])
 973
 974 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp1.pid])
 975 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
 976
 977 dnl FTP requests from p1->p0 should fail due to network failure.
 978 dnl Try 3 times, in 1 second intervals.
 979 NS_CHECK_EXEC([at_ns1], [wget ftp://10.1.1.1 --no-passive-ftp  -t 3 -T 1 -v -o wget1.log], [4])
 980 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.1)], [0], [dnl
 981 ])
 982
 983 dnl FTP requests from p0->p1 should work fine.
 984 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 985 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep -v "FIN"], [0], [dnl
 986 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT),helper=ftp
 987 ])
 988
 989 dnl Try the second set of flows.
 990 AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows2.txt])
 991 AT_CHECK([ovs-appctl dpctl/flush-conntrack])
 992
 993 dnl FTP requests from p1->p0 should fail due to network failure.
 994 dnl Try 3 times, in 1 second intervals.
 995 NS_CHECK_EXEC([at_ns1], [wget ftp://10.1.1.1 --no-passive-ftp  -t 3 -T 1 -v -o wget1.log], [4])
 996 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.1)], [0], [dnl
 997 ])
 998
 999 dnl Active FTP requests from p0->p1 should work fine.
1000 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v -o wget0-1.log])
1001 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep -v "FIN"], [0], [dnl
1002 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT),helper=ftp
1003 tcp,orig=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
1004 ])
1005
1006 AT_CHECK([ovs-appctl dpctl/flush-conntrack])
1007
1008 dnl Passive FTP requests from p0->p1 should work fine.
1009 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0-2.log])
1010 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep -v "FIN"], [0], [dnl
1011 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
1012 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT),helper=ftp
1013 ])
1014
1015 OVS_TRAFFIC_VSWITCHD_STOP
1016 AT_CLEANUP
1017
1018
1019 AT_SETUP([conntrack - IPv6 FTP])
1020 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
1021 CHECK_CONNTRACK()
1022 OVS_TRAFFIC_VSWITCHD_START()
1023
1024 ADD_NAMESPACES(at_ns0, at_ns1)
1025
1026 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1027 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1028
1029 dnl Allow any traffic from ns0->ns1.
1030 dnl Only allow nd, return traffic from ns1->ns0.
1031 AT_DATA([flows.txt], [dnl
1032 dnl Track all IPv6 traffic and drop the rest.
1033 dnl Allow ICMPv6 both ways.  No commit, so pings will not be tracked.
1034 table=0 priority=100 in_port=1 icmp6, action=2
1035 table=0 priority=100 in_port=2 icmp6, action=1
1036 table=0 priority=10 ip6, action=ct(table=1)
1037 table=0 priority=0 action=drop
1038 dnl
1039 dnl Table 1
1040 dnl
1041 dnl Allow new TCPv6 FTP control connections from port 1.
1042 table=1 in_port=1 ct_state=+new, tcp6, tp_dst=21, action=ct(alg=ftp,commit),2
1043 dnl Allow related TCPv6 connections from port 2.
1044 table=1 in_port=2 ct_state=+new+rel, tcp6, action=ct(commit),1
1045 dnl Allow established TCPv6 connections both ways.
1046 table=1 in_port=1 ct_state=+est, tcp6, action=2
1047 table=1 in_port=2 ct_state=+est, tcp6, action=1
1048 dnl Drop everything else.
1049 table=1 priority=0, action=drop
1050 ])
1051
1052 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1053
1054 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
1055
1056 dnl FTP requests from p0->p1 should work fine.
1057 NS_CHECK_EXEC([at_ns0], [wget ftp://[[fc00::2]] -6 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
1058
1059 dnl Discards CLOSE_WAIT and CLOSING
1060 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(fc00::2) | grep -v "FIN" | grep -v "CLOS"], [0], [dnl
1061 tcp,orig=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),reply=(src=fc00::2,dst=fc00::1,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT),helper=ftp
1062 tcp,orig=(src=fc00::2,dst=fc00::1,sport=<cleared>,dport=<cleared>),reply=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
1063 ])
1064
1065 OVS_TRAFFIC_VSWITCHD_STOP
1066 AT_CLEANUP
1067
1068
1069 AT_SETUP([conntrack - FTP with multiple expectations])
1070 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
1071 CHECK_CONNTRACK()
1072 OVS_TRAFFIC_VSWITCHD_START()
1073
1074 ADD_NAMESPACES(at_ns0, at_ns1)
1075
1076 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1077 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1078
1079 dnl Dual-firewall, allow all from ns1->ns2, allow established and ftp ns2->ns1.
1080 AT_DATA([flows.txt], [dnl
1081 priority=1,action=drop
1082 priority=10,arp,action=normal
1083 priority=10,icmp,action=normal
1084 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(table=0,zone=1)
1085 priority=100,in_port=1,tcp,ct_zone=1,ct_state=+trk+new,action=ct(commit,alg=ftp,zone=1),ct(commit,alg=ftp,zone=2),2
1086 priority=100,in_port=1,tcp,ct_zone=1,ct_state=+trk+est,action=ct(table=0,zone=2)
1087 priority=100,in_port=1,tcp,ct_zone=2,ct_state=+trk+new,action=ct(commit,alg=ftp,zone=2)
1088 priority=100,in_port=1,tcp,ct_zone=2,ct_state=+trk+est,action=2
1089 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0,zone=2)
1090 priority=100,in_port=2,tcp,ct_zone=2,ct_state=+trk+rel,action=ct(commit,zone=2),ct(commit,zone=1),1
1091 priority=100,in_port=2,tcp,ct_zone=2,ct_state=+trk+est,action=ct(table=0,zone=1)
1092 priority=100,in_port=2,tcp,ct_zone=1,ct_state=+trk+rel,action=ct(commit,zone=2),ct(commit,zone=1),1
1093 priority=100,in_port=2,tcp,ct_zone=1,ct_state=+trk+est,action=1
1094 ])
1095
1096 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1097
1098 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp1.pid])
1099 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
1100
1101 dnl FTP requests from p1->p0 should fail due to network failure.
1102 dnl Try 3 times, in 1 second intervals.
1103 NS_CHECK_EXEC([at_ns1], [wget ftp://10.1.1.1 --no-passive-ftp  -t 3 -T 1 -v -o wget1.log], [4])
1104 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.1)], [0], [dnl
1105 ])
1106
1107 dnl Active FTP requests from p0->p1 should work fine.
1108 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1109 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep -v "FIN"], [0], [dnl
1110 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT),helper=ftp
1111 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=TIME_WAIT),helper=ftp
1112 tcp,orig=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1113 tcp,orig=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=TIME_WAIT)
1114 ])
1115
1116 AT_CHECK([ovs-appctl dpctl/flush-conntrack])
1117
1118 dnl Passive FTP requests from p0->p1 should work fine.
1119 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1120 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep -v "FIN"], [0], [dnl
1121 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1122 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT),helper=ftp
1123 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=TIME_WAIT)
1124 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=TIME_WAIT),helper=ftp
1125 ])
1126
1127 OVS_TRAFFIC_VSWITCHD_STOP
1128 AT_CLEANUP
1129
1130 AT_SETUP([conntrack - IPv4 fragmentation ])
1131 CHECK_CONNTRACK()
1132 OVS_TRAFFIC_VSWITCHD_START()
1133
1134 ADD_NAMESPACES(at_ns0, at_ns1)
1135
1136 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1137 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1138
1139 dnl Sending ping through conntrack
1140 AT_DATA([flows.txt], [dnl
1141 priority=1,action=drop
1142 priority=10,arp,action=normal
1143 priority=100,in_port=1,icmp,action=ct(commit,zone=9),2
1144 priority=100,in_port=2,ct_state=-trk,icmp,action=ct(table=0,zone=9)
1145 priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1
1146 ])
1147
1148 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1149
1150 dnl Basic connectivity check.
1151 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1152 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1153 ])
1154
1155 dnl Ipv4 fragmentation connectivity check.
1156 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1157 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1158 ])
1159
1160 dnl Ipv4 larger fragmentation connectivity check.
1161 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1162 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1163 ])
1164
1165 OVS_TRAFFIC_VSWITCHD_STOP
1166 AT_CLEANUP
1167
1168 AT_SETUP([conntrack - IPv4 fragmentation expiry])
1169 CHECK_CONNTRACK()
1170 OVS_TRAFFIC_VSWITCHD_START()
1171
1172 ADD_NAMESPACES(at_ns0, at_ns1)
1173
1174 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1175 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1176
1177 AT_DATA([flows.txt], [dnl
1178 priority=1,action=drop
1179 priority=10,arp,action=normal
1180
1181 dnl Only allow non-fragmented messages and 1st fragments of each message
1182 priority=100,in_port=1,icmp,ip_frag=no,action=ct(commit,zone=9),2
1183 priority=100,in_port=1,icmp,ip_frag=firstaction=ct(commit,zone=9),2
1184 priority=100,in_port=2,ct_state=-trk,icmp,action=ct(table=0,zone=9)
1185 priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1
1186 ])
1187
1188 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1189
1190 dnl Basic connectivity check.
1191 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1192 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1193 ])
1194
1195 dnl Ipv4 fragmentation connectivity check.
1196 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 1 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1197 7 packets transmitted, 0 received, 100% packet loss, time 0ms
1198 ])
1199
1200 OVS_TRAFFIC_VSWITCHD_STOP
1201 AT_CLEANUP
1202
1203 AT_SETUP([conntrack - IPv4 fragmentation + vlan])
1204 CHECK_CONNTRACK()
1205 OVS_TRAFFIC_VSWITCHD_START()
1206
1207 ADD_NAMESPACES(at_ns0, at_ns1)
1208
1209 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1210 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1211 ADD_VLAN(p0, at_ns0, 100, "10.2.2.1/24")
1212 ADD_VLAN(p1, at_ns1, 100, "10.2.2.2/24")
1213
1214 dnl Sending ping through conntrack
1215 AT_DATA([flows.txt], [dnl
1216 priority=1,action=drop
1217 priority=10,arp,action=normal
1218 priority=100,in_port=1,icmp,action=ct(commit,zone=9),2
1219 priority=100,in_port=2,ct_state=-trk,icmp,action=ct(table=0,zone=9)
1220 priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1
1221 ])
1222
1223 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1224
1225 dnl Basic connectivity check.
1226 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
1227 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1228 ])
1229
1230 dnl Ipv4 fragmentation connectivity check.
1231 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
1232 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1233 ])
1234
1235 dnl Ipv4 larger fragmentation connectivity check.
1236 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
1237 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1238 ])
1239
1240 OVS_TRAFFIC_VSWITCHD_STOP
1241 AT_CLEANUP
1242
1243 AT_SETUP([conntrack - IPv6 fragmentation])
1244 CHECK_CONNTRACK()
1245 OVS_TRAFFIC_VSWITCHD_START()
1246
1247 ADD_NAMESPACES(at_ns0, at_ns1)
1248
1249 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1250 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1251
1252 dnl Sending ping through conntrack
1253 AT_DATA([flows.txt], [dnl
1254 priority=1,action=drop
1255 priority=10,in_port=1,ipv6,action=ct(commit,zone=9),2
1256 priority=10,in_port=2,ct_state=-trk,ipv6,action=ct(table=0,zone=9)
1257 priority=10,in_port=2,ct_state=+trk+est-new,ipv6,action=1
1258 priority=100,icmp6,icmp_type=135,action=normal
1259 priority=100,icmp6,icmp_type=136,action=normal
1260 ])
1261
1262 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1263
1264 dnl Without this sleep, we get occasional failures due to the following error:
1265 dnl "connect: Cannot assign requested address"
1266 sleep 2;
1267
1268 dnl Basic connectivity check.
1269 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1270 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1271 ])
1272
1273 dnl Ipv6 fragmentation connectivity check.
1274 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1275 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1276 ])
1277
1278 dnl Ipv6 larger fragmentation connectivity check.
1279 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1280 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1281 ])
1282
1283 OVS_TRAFFIC_VSWITCHD_STOP
1284 AT_CLEANUP
1285
1286 AT_SETUP([conntrack - IPv6 fragmentation expiry])
1287 CHECK_CONNTRACK()
1288 OVS_TRAFFIC_VSWITCHD_START()
1289
1290 ADD_NAMESPACES(at_ns0, at_ns1)
1291
1292 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1293 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1294
1295 AT_DATA([flows.txt], [dnl
1296 priority=1,action=drop
1297
1298 dnl Only allow non-fragmented messages and 1st fragments of each message
1299 priority=10,in_port=1,ipv6,ip_frag=first,action=ct(commit,zone=9),2
1300 priority=10,in_port=1,ipv6,ip_frag=no,action=ct(commit,zone=9),2
1301 priority=10,in_port=2,ct_state=-trk,ipv6,action=ct(table=0,zone=9)
1302 priority=10,in_port=2,ct_state=+trk+est-new,ipv6,action=1
1303
1304 dnl Neighbour Discovery
1305 priority=100,icmp6,icmp_type=135,action=normal
1306 priority=100,icmp6,icmp_type=136,action=normal
1307 ])
1308
1309 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1310
1311 dnl Without this sleep, we get occasional failures due to the following error:
1312 dnl "connect: Cannot assign requested address"
1313 sleep 2;
1314
1315 dnl Basic connectivity check.
1316 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1317 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1318 ])
1319
1320 dnl Send an IPv6 fragment. Some time later, it should expire.
1321 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 1 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1322 7 packets transmitted, 0 received, 100% packet loss, time 0ms
1323 ])
1324
1325 dnl At this point, the kernel will either crash or everything is OK.
1326
1327 OVS_TRAFFIC_VSWITCHD_STOP
1328 AT_CLEANUP
1329
1330 AT_SETUP([conntrack - IPv6 fragmentation + vlan])
1331 CHECK_CONNTRACK()
1332 OVS_TRAFFIC_VSWITCHD_START()
1333
1334 ADD_NAMESPACES(at_ns0, at_ns1)
1335
1336 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1337 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1338
1339 ADD_VLAN(p0, at_ns0, 100, "fc00:1::3/96")
1340 ADD_VLAN(p1, at_ns1, 100, "fc00:1::4/96")
1341
1342 dnl Sending ping through conntrack
1343 AT_DATA([flows.txt], [dnl
1344 priority=1,action=drop
1345 priority=10,in_port=1,ipv6,action=ct(commit,zone=9),2
1346 priority=10,in_port=2,ct_state=-trk,ipv6,action=ct(table=0,zone=9)
1347 priority=10,in_port=2,ct_state=+trk+est-new,ipv6,action=1
1348 priority=100,icmp6,icmp_type=135,action=normal
1349 priority=100,icmp6,icmp_type=136,action=normal
1350 ])
1351
1352 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1353
1354 dnl Without this sleep, we get occasional failures due to the following error:
1355 dnl "connect: Cannot assign requested address"
1356 sleep 2;
1357
1358 dnl Basic connectivity check.
1359 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00:1::4 | FORMAT_PING], [0], [dnl
1360 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1361 ])
1362
1363 dnl Ipv4 fragmentation connectivity check.
1364 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00:1::4 | FORMAT_PING], [0], [dnl
1365 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1366 ])
1367
1368 dnl Ipv4 larger fragmentation connectivity check.
1369 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00:1::4 | FORMAT_PING], [0], [dnl
1370 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1371 ])
1372
1373 OVS_TRAFFIC_VSWITCHD_STOP
1374 AT_CLEANUP
1375
1376 AT_SETUP([conntrack - Fragmentation over vxlan])
1377 OVS_CHECK_VXLAN()
1378 CHECK_CONNTRACK()
1379
1380 OVS_TRAFFIC_VSWITCHD_START()
1381 ADD_BR([br-underlay])
1382 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
1383
1384 ADD_NAMESPACES(at_ns0)
1385
1386 dnl Sending ping through conntrack
1387 AT_DATA([flows.txt], [dnl
1388 priority=1,action=drop
1389 priority=10,arp,action=normal
1390 priority=100,in_port=1,icmp,action=ct(commit,zone=9),LOCAL
1391 priority=100,in_port=LOCAL,icmp,action=ct(table=1,zone=9)
1392 table=1,priority=100,in_port=LOCAL,ct_state=+trk+est,icmp,action=1
1393 ])
1394
1395 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1396
1397 dnl Set up underlay link from host into the namespace using veth pair.
1398 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
1399 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
1400 AT_CHECK([ip link set dev br-underlay up])
1401
1402 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
1403 dnl linux device inside the namespace.
1404 ADD_OVS_TUNNEL([vxlan], [br0], [at_ns0], [172.31.1.1], [10.1.1.100/24])
1405 ADD_NATIVE_TUNNEL([vxlan], [at_vxlan1], [at_ns0], [172.31.1.100], [10.1.1.1/24],
1406                   [id 0 dstport 4789])
1407
1408 dnl First, check the underlay
1409 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
1410 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1411 ])
1412
1413 dnl Okay, now check the overlay with different packet sizes
1414 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
1415 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1416 ])
1417 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
1418 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1419 ])
1420 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
1421 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1422 ])
1423
1424 OVS_TRAFFIC_VSWITCHD_STOP
1425 AT_CLEANUP
1426
1427 AT_SETUP([conntrack - IPv6 Fragmentation over vxlan])
1428 AT_SKIP_IF([! ip link help 2>&1 | grep vxlan >/dev/null])
1429 CHECK_CONNTRACK()
1430
1431 OVS_TRAFFIC_VSWITCHD_START()
1432 ADD_BR([br-underlay])
1433 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
1434
1435 ADD_NAMESPACES(at_ns0)
1436
1437 dnl Sending ping through conntrack
1438 AT_DATA([flows.txt], [dnl
1439 priority=1,action=drop
1440 priority=100,in_port=1,ipv6,action=ct(commit,zone=9),LOCAL
1441 priority=100,in_port=LOCAL,ipv6,action=ct(table=1,zone=9)
1442 table=1,priority=100,in_port=LOCAL,ct_state=+trk+est,ipv6,action=1
1443
1444 dnl Neighbour Discovery
1445 priority=1000,icmp6,icmp_type=135,action=normal
1446 priority=1000,icmp6,icmp_type=136,action=normal
1447 ])
1448
1449 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1450
1451 dnl Set up underlay link from host into the namespace using veth pair.
1452 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
1453 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
1454 AT_CHECK([ip link set dev br-underlay up])
1455
1456 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
1457 dnl linux device inside the namespace.
1458 ADD_OVS_TUNNEL([vxlan], [br0], [at_ns0], [172.31.1.1], ["fc00::2/96"])
1459 ADD_NATIVE_TUNNEL([vxlan], [at_vxlan1], [at_ns0], [172.31.1.100], ["fc00::1/96"],
1460                   [id 0 dstport 4789])
1461
1462 dnl Without this sleep, we get occasional failures due to the following error:
1463 dnl "connect: Cannot assign requested address"
1464 sleep 2;
1465
1466 dnl First, check the underlay
1467 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
1468 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1469 ])
1470
1471 dnl Okay, now check the overlay with different packet sizes
1472 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1473 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1474 ])
1475 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1476 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1477 ])
1478 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1479 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1480 ])
1481
1482 OVS_TRAFFIC_VSWITCHD_STOP
1483 AT_CLEANUP
1484
1485 AT_SETUP([conntrack - resubmit to ct multiple times])
1486 CHECK_CONNTRACK()
1487
1488 OVS_TRAFFIC_VSWITCHD_START(
1489    [set-fail-mode br0 secure -- ])
1490
1491 ADD_NAMESPACES(at_ns0, at_ns1)
1492
1493 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1494 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1495
1496 AT_DATA([flows.txt], [dnl
1497 table=0,priority=150,arp,action=normal
1498 table=0,priority=100,ip,in_port=1,action=resubmit(,1),resubmit(,2)
1499
1500 table=1,priority=100,ip,action=ct(table=3)
1501 table=2,priority=100,ip,action=ct(table=3)
1502
1503 table=3,ip,action=drop
1504 ])
1505
1506 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
1507
1508 NS_CHECK_EXEC([at_ns0], [ping -q -c 1 10.1.1.2 | FORMAT_PING], [0], [dnl
1509 1 packets transmitted, 0 received, 100% packet loss, time 0ms
1510 ])
1511
1512 AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
1513  n_packets=1, n_bytes=98, priority=100,ip,in_port=1 actions=resubmit(,1),resubmit(,2)
1514  n_packets=2, n_bytes=84, priority=150,arp actions=NORMAL
1515  table=1, n_packets=1, n_bytes=98, priority=100,ip actions=ct(table=3)
1516  table=2, n_packets=1, n_bytes=98, priority=100,ip actions=ct(table=3)
1517  table=3, n_packets=2, n_bytes=196, ip actions=drop
1518 NXST_FLOW reply:
1519 ])
1520
1521 OVS_TRAFFIC_VSWITCHD_STOP
1522 AT_CLEANUP
1523
1524
1525 AT_SETUP([conntrack - simple SNAT])
1526 CHECK_CONNTRACK()
1527 OVS_TRAFFIC_VSWITCHD_START()
1528
1529 ADD_NAMESPACES(at_ns0, at_ns1)
1530
1531 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1532 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1533 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1534
1535 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1536 AT_DATA([flows.txt], [dnl
1537 in_port=1,ip,action=ct(commit,zone=1,nat(src=10.1.1.240-10.1.1.255)),2
1538 in_port=2,ct_state=-trk,ip,action=ct(table=0,zone=1,nat)
1539 in_port=2,ct_state=+trk,ct_zone=1,ip,action=1
1540 dnl
1541 dnl ARP
1542 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1543 priority=10 arp action=normal
1544 priority=0,action=drop
1545 dnl
1546 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1547 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1548 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1549 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1550 dnl TPA IP in reg2.
1551 dnl Swaps the fields of the ARP message to turn a query to a response.
1552 table=10 priority=100 arp xreg0=0 action=normal
1553 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1554 table=10 priority=0 action=drop
1555 ])
1556
1557 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1558
1559 dnl HTTP requests from p0->p1 should work fine.
1560 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1561 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
1562
1563 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
1564 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1565 ])
1566
1567 OVS_TRAFFIC_VSWITCHD_STOP
1568 AT_CLEANUP
1569
1570
1571 AT_SETUP([conntrack - SNAT with port range])
1572 CHECK_CONNTRACK()
1573 OVS_TRAFFIC_VSWITCHD_START()
1574
1575 ADD_NAMESPACES(at_ns0, at_ns1)
1576
1577 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1578 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1579 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1580
1581 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1582 AT_DATA([flows.txt], [dnl
1583 in_port=1,tcp,action=ct(commit,zone=1,nat(src=10.1.1.240-10.1.1.255:34567-34568,random)),2
1584 in_port=2,ct_state=-trk,tcp,tp_dst=34567,action=ct(table=0,zone=1,nat)
1585 in_port=2,ct_state=-trk,tcp,tp_dst=34568,action=ct(table=0,zone=1,nat)
1586 in_port=2,ct_state=+trk,ct_zone=1,tcp,action=1
1587 dnl
1588 dnl ARP
1589 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1590 priority=10 arp action=normal
1591 priority=0,action=drop
1592 dnl
1593 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1594 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1595 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1596 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1597 dnl TPA IP in reg2.
1598 dnl Swaps the fields of the ARP message to turn a query to a response.
1599 table=10 priority=100 arp xreg0=0 action=normal
1600 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1601 table=10 priority=0 action=drop
1602 ])
1603
1604 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1605
1606 dnl HTTP requests from p0->p1 should work fine.
1607 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1608 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
1609
1610 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
1611 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1612 ])
1613
1614 OVS_TRAFFIC_VSWITCHD_STOP
1615 AT_CLEANUP
1616
1617
1618 AT_SETUP([conntrack - more complex SNAT])
1619 CHECK_CONNTRACK()
1620 OVS_TRAFFIC_VSWITCHD_START()
1621
1622 ADD_NAMESPACES(at_ns0, at_ns1)
1623
1624 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1625 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1626 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1627
1628 AT_DATA([flows.txt], [dnl
1629 dnl Track all IP traffic, NAT existing connections.
1630 priority=100 ip action=ct(table=1,zone=1,nat)
1631 dnl
1632 dnl Allow ARP, but generate responses for NATed addresses
1633 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1634 priority=10 arp action=normal
1635 priority=0 action=drop
1636 dnl
1637 dnl Allow any traffic from ns0->ns1. SNAT ns0 to 10.1.1.240-10.1.1.255
1638 table=1 priority=100 in_port=1 ip ct_state=+trk+new-est action=ct(commit,zone=1,nat(src=10.1.1.240-10.1.1.255)),2
1639 table=1 priority=100 in_port=1 ip ct_state=+trk-new+est action=2
1640 dnl Only allow established traffic from ns1->ns0.
1641 table=1 priority=100 in_port=2 ip ct_state=+trk-new+est action=1
1642 table=1 priority=0 action=drop
1643 dnl
1644 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1645 table=8 priority=100 reg2=0x0a0101f0/0xfffffff0 action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1646 dnl Zero result means not found.
1647 table=8 priority=0 action=load:0->OXM_OF_PKT_REG0[[]]
1648 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1649 dnl ARP TPA IP in reg2.
1650 table=10 priority=100 arp xreg0=0 action=normal
1651 dnl Swaps the fields of the ARP message to turn a query to a response.
1652 table=10 priority=10 arp arp_op=1 action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1653 table=10 priority=0 action=drop
1654 ])
1655
1656 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1657
1658 dnl HTTP requests from p0->p1 should work fine.
1659 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1660 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
1661
1662 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
1663 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1664 ])
1665
1666 OVS_TRAFFIC_VSWITCHD_STOP
1667 AT_CLEANUP
1668
1669 AT_SETUP([conntrack - simple DNAT])
1670 CHECK_CONNTRACK()
1671 OVS_TRAFFIC_VSWITCHD_START()
1672
1673 ADD_NAMESPACES(at_ns0, at_ns1)
1674
1675 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1676 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1677 NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address 80:88:88:88:88:88])
1678
1679 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1680 AT_DATA([flows.txt], [dnl
1681 priority=100 in_port=1,ip,nw_dst=10.1.1.64,action=ct(zone=1,nat(dst=10.1.1.2),commit),2
1682 priority=10 in_port=1,ip,action=ct(commit,zone=1),2
1683 priority=100 in_port=2,ct_state=-trk,ip,action=ct(table=0,nat,zone=1)
1684 priority=100 in_port=2,ct_state=+trk+est,ct_zone=1,ip,action=1
1685 dnl
1686 dnl ARP
1687 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1688 priority=10 arp action=normal
1689 priority=0,action=drop
1690 dnl
1691 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1692 table=8,reg2=0x0a010140,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1693 dnl Zero result means not found.
1694 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1695 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1696 dnl TPA IP in reg2.
1697 table=10 priority=100 arp xreg0=0 action=normal
1698 dnl Swaps the fields of the ARP message to turn a query to a response.
1699 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1700 table=10 priority=0 action=drop
1701 ])
1702
1703 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1704
1705 dnl Should work with the virtual IP address through NAT
1706 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1707 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.64 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
1708
1709 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.64) ], [0], [dnl
1710 tcp,orig=(src=10.1.1.1,dst=10.1.1.64,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1711 ])
1712
1713 dnl Should work with the assigned IP address as well
1714 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1715
1716 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) ], [0], [dnl
1717 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1718 ])
1719
1720 OVS_TRAFFIC_VSWITCHD_STOP
1721 AT_CLEANUP
1722
1723 AT_SETUP([conntrack - more complex DNAT])
1724 CHECK_CONNTRACK()
1725 OVS_TRAFFIC_VSWITCHD_START()
1726
1727 ADD_NAMESPACES(at_ns0, at_ns1)
1728
1729 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1730 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1731 NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address 80:88:88:88:88:88])
1732
1733 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1734 AT_DATA([flows.txt], [dnl
1735 dnl Track all IP traffic
1736 table=0 priority=100 ip action=ct(table=1,zone=1,nat)
1737 dnl
1738 dnl Allow ARP, but generate responses for NATed addresses
1739 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1740 table=0 priority=10 arp action=normal
1741 table=0 priority=0 action=drop
1742 dnl
1743 dnl Allow any IP traffic from ns0->ns1. DNAT ns0 from 10.1.1.64 to 10.1.1.2
1744 table=1 priority=100 in_port=1 ct_state=+new ip nw_dst=10.1.1.64 action=ct(zone=1,nat(dst=10.1.1.2),commit),2
1745 table=1 priority=10 in_port=1 ct_state=+new ip action=ct(commit,zone=1),2
1746 table=1 priority=100 in_port=1 ct_state=+est ct_zone=1 action=2
1747 dnl Only allow established traffic from ns1->ns0.
1748 table=1 priority=100 in_port=2 ct_state=+est ct_zone=1 action=1
1749 table=1 priority=0 action=drop
1750 dnl
1751 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1752 table=8,reg2=0x0a010140,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1753 dnl Zero result means not found.
1754 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1755 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1756 dnl TPA IP in reg2.
1757 table=10 priority=100 arp xreg0=0 action=normal
1758 dnl Swaps the fields of the ARP message to turn a query to a response.
1759 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1760 table=10 priority=0 action=drop
1761 ])
1762
1763 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1764
1765 dnl Should work with the virtual IP address through NAT
1766 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1767 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.64 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
1768
1769 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.64) ], [0], [dnl
1770 tcp,orig=(src=10.1.1.1,dst=10.1.1.64,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1771 ])
1772
1773 dnl Should work with the assigned IP address as well
1774 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1775
1776 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) ], [0], [dnl
1777 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=TIME_WAIT)
1778 ])
1779
1780 OVS_TRAFFIC_VSWITCHD_STOP
1781 AT_CLEANUP
1782
1783 AT_SETUP([conntrack - ICMP related with NAT])
1784 CHECK_CONNTRACK()
1785 OVS_TRAFFIC_VSWITCHD_START()
1786
1787 ADD_NAMESPACES(at_ns0, at_ns1)
1788
1789 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1790 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1791 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1792
1793 dnl Allow UDP traffic from ns0->ns1. Only allow related ICMP responses back.
1794 dnl Make sure ICMP responses are reverse-NATted.
1795 AT_DATA([flows.txt], [dnl
1796 in_port=1,udp,action=ct(commit,nat(src=10.1.1.240-10.1.1.255),exec(set_field:1->ct_mark)),2
1797 in_port=2,icmp,ct_state=-trk,action=ct(table=0,nat)
1798 in_port=2,icmp,nw_dst=10.1.1.1,ct_state=+trk+rel,ct_mark=1,action=1
1799 dnl
1800 dnl ARP
1801 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1802 priority=10 arp action=normal
1803 priority=0,action=drop
1804 dnl
1805 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1806 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1807 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1808 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1809 dnl TPA IP in reg2.
1810 dnl Swaps the fields of the ARP message to turn a query to a response.
1811 table=10 priority=100 arp xreg0=0 action=normal
1812 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1813 table=10 priority=0 action=drop
1814 ])
1815
1816 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1817
1818 dnl UDP packets from ns0->ns1 should solicit "destination unreachable" response.
1819 NS_CHECK_EXEC([at_ns0], [bash -c "echo a | nc $NC_EOF_OPT -u 10.1.1.2 10000"])
1820
1821 AT_CHECK([ovs-appctl revalidator/purge], [0])
1822 AT_CHECK([ovs-ofctl -O OpenFlow15 dump-flows br0 | ofctl_strip | sort | grep -v drop], [0], [dnl
1823  n_packets=1, n_bytes=42, priority=10,arp actions=NORMAL
1824  n_packets=1, n_bytes=44, udp,in_port=1 actions=ct(commit,nat(src=10.1.1.240-10.1.1.255),exec(set_field:0x1->ct_mark)),output:2
1825  n_packets=1, n_bytes=72, ct_state=+rel+trk,ct_mark=0x1,icmp,in_port=2,nw_dst=10.1.1.1 actions=output:1
1826  n_packets=1, n_bytes=72, ct_state=-trk,icmp,in_port=2 actions=ct(table=0,nat)
1827  n_packets=2, n_bytes=84, priority=100,arp,arp_op=1 actions=move:NXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1828  table=10, n_packets=1, n_bytes=42, priority=10,arp,arp_op=1 actions=set_field:2->arp_op,move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_NX_ARP_SHA[[]],move:NXM_OF_ARP_SPA[[]]->NXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->NXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],set_field:0->in_port,output:NXM_NX_REG3[[0..15]]
1829  table=10, n_packets=1, n_bytes=42, priority=100,arp,reg0=0,reg1=0 actions=NORMAL
1830  table=8, n_packets=1, n_bytes=42, priority=0 actions=set_field:0->xreg0
1831  table=8, n_packets=1, n_bytes=42, reg2=0xa0101f0/0xfffffff0 actions=set_field:0x808888888888->xreg0
1832 OFPST_FLOW reply (OF1.5):
1833 ])
1834
1835 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
1836 udp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),mark=1
1837 ])
1838
1839 OVS_TRAFFIC_VSWITCHD_STOP
1840 AT_CLEANUP
1841
1842
1843 AT_SETUP([conntrack - FTP with NAT])
1844 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
1845 CHECK_CONNTRACK()
1846
1847 OVS_TRAFFIC_VSWITCHD_START()
1848
1849 ADD_NAMESPACES(at_ns0, at_ns1)
1850
1851 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1852 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1853 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1854
1855 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1856
1857 AT_DATA([flows.txt], [dnl
1858 dnl track all IP traffic, de-mangle non-NEW connections
1859 table=0 in_port=1, ip, action=ct(table=1,nat)
1860 table=0 in_port=2, ip, action=ct(table=2,nat)
1861 dnl
1862 dnl ARP
1863 dnl
1864 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1865 table=0 priority=10 arp action=normal
1866 table=0 priority=0 action=drop
1867 dnl
1868 dnl Table 1: port 1 -> 2
1869 dnl
1870 dnl Allow new FTP connections. These need to be commited.
1871 table=1 ct_state=+new, tcp, tp_dst=21, nw_src=10.1.1.1, action=ct(alg=ftp,commit,nat(src=10.1.1.240)),2
1872 dnl Allow established TCP connections, make sure they are NATted already.
1873 table=1 ct_state=+est, tcp, nw_src=10.1.1.240,     action=2
1874 dnl
1875 dnl Table 1: droppers
1876 dnl
1877 table=1 priority=10, tcp, action=drop
1878 table=1 priority=0,action=drop
1879 dnl
1880 dnl Table 2: port 2 -> 1
1881 dnl
1882 dnl Allow established TCP connections, make sure they are reverse NATted
1883 table=2 ct_state=+est, tcp, nw_dst=10.1.1.1, action=1
1884 dnl Allow (new) related (data) connections.  These need to be commited.
1885 table=2 ct_state=+new+rel, tcp, nw_dst=10.1.1.240, action=ct(commit,nat),1
1886 dnl Allow related ICMP packets, make sure they are reverse NATted
1887 table=2 ct_state=+rel, icmp, nw_dst=10.1.1.1, action=1
1888 dnl
1889 dnl Table 2: droppers
1890 dnl
1891 table=2 priority=10, tcp, action=drop
1892 table=2 priority=0, action=drop
1893 dnl
1894 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1895 dnl
1896 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1897 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1898 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1899 dnl TPA IP in reg2.
1900 dnl Swaps the fields of the ARP message to turn a query to a response.
1901 table=10 priority=100 arp xreg0=0 action=normal
1902 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1903 table=10 priority=0 action=drop
1904 ])
1905
1906 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1907
1908 dnl NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp1.pid])
1909 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
1910
1911 dnl FTP requests from p0->p1 should work fine.
1912 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -4 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
1913
1914 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep -v "FIN"], [0], [dnl
1915 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT),helper=ftp
1916 tcp,orig=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
1917 ])
1918
1919 OVS_TRAFFIC_VSWITCHD_STOP
1920 AT_CLEANUP
1921
1922
1923 AT_SETUP([conntrack - FTP with NAT 2])
1924 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
1925 CHECK_CONNTRACK()
1926 OVS_TRAFFIC_VSWITCHD_START()
1927
1928 ADD_NAMESPACES(at_ns0, at_ns1)
1929
1930 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1931 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1932 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1933
1934 dnl Allow any traffic from ns0->ns1.
1935 dnl Only allow nd, return traffic from ns1->ns0.
1936 AT_DATA([flows.txt], [dnl
1937 dnl track all IP traffic (this includes a helper call to non-NEW packets.)
1938 table=0 ip, action=ct(table=1)
1939 dnl
1940 dnl ARP
1941 dnl
1942 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1943 table=0 priority=10 arp action=normal
1944 table=0 priority=0 action=drop
1945 dnl
1946 dnl Table 1
1947 dnl
1948 dnl Allow new FTP connections. These need to be commited.
1949 dnl This does helper for new packets.
1950 table=1 in_port=1 ct_state=+new, tcp, tp_dst=21, action=ct(alg=ftp,commit,nat(src=10.1.1.240)),2
1951 dnl Allow and NAT established TCP connections
1952 table=1 in_port=1 ct_state=+est, tcp,     action=ct(nat),2
1953 table=1 in_port=2 ct_state=+est, tcp,     action=ct(nat),1
1954 dnl Allow and NAT (new) related active (data) connections.
1955 dnl These need to be commited.
1956 table=1 in_port=2 ct_state=+new+rel, tcp, action=ct(commit,nat),1
1957 dnl Allow related ICMP packets.
1958 table=1 in_port=2 ct_state=+rel, icmp,    action=ct(nat),1
1959 dnl Drop everything else.
1960 table=1 priority=0, action=drop
1961 dnl
1962 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1963 dnl
1964 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1965 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1966 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1967 dnl TPA IP in reg2.
1968 dnl Swaps the fields of the ARP message to turn a query to a response.
1969 table=10 priority=100 arp xreg0=0 action=normal
1970 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1971 table=10 priority=0 action=drop
1972 ])
1973
1974 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1975
1976 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
1977
1978 dnl FTP requests from p0->p1 should work fine.
1979 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -4 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
1980
1981 dnl Discards CLOSE_WAIT and CLOSING
1982 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep -v "FIN" | grep -v "CLOS"], [0], [dnl
1983 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT),helper=ftp
1984 tcp,orig=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
1985 ])
1986
1987 OVS_TRAFFIC_VSWITCHD_STOP
1988 AT_CLEANUP
1989
1990 AT_SETUP([conntrack - IPv6 HTTP with NAT])
1991 CHECK_CONNTRACK()
1992 OVS_TRAFFIC_VSWITCHD_START()
1993
1994 ADD_NAMESPACES(at_ns0, at_ns1)
1995
1996 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1997 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1998 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1999 NS_CHECK_EXEC([at_ns1], [ip -6 neigh add fc00::240 lladdr 80:88:88:88:88:88 dev p1])
2000
2001 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
2002 AT_DATA([flows.txt], [dnl
2003 priority=1,action=drop
2004 priority=10,icmp6,action=normal
2005 priority=100,in_port=1,ip6,action=ct(commit,nat(src=fc00::240)),2
2006 priority=100,in_port=2,ct_state=-trk,ip6,action=ct(nat,table=0)
2007 priority=100,in_port=2,ct_state=+trk+est,ip6,action=1
2008 priority=200,in_port=2,ct_state=+trk+new,icmp6,icmpv6_code=0,icmpv6_type=135,nd_target=fc00::240,action=ct(commit,nat(dst=fc00::1)),1
2009 ])
2010
2011 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2012
2013 dnl Without this sleep, we get occasional failures due to the following error:
2014 dnl "connect: Cannot assign requested address"
2015 sleep 2;
2016
2017 dnl HTTP requests from ns0->ns1 should work fine.
2018 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py http6]], [http0.pid])
2019
2020 NS_CHECK_EXEC([at_ns0], [wget http://[[fc00::2]] -t 3 -T 1 --retry-connrefused -v -o wget0.log])
2021
2022 dnl HTTP requests from ns1->ns0 should fail due to network failure.
2023 dnl Try 3 times, in 1 second intervals.
2024 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py http6]], [http1.pid])
2025 NS_CHECK_EXEC([at_ns1], [wget http://[[fc00::1]] -t 3 -T 1 -v -o wget1.log], [4])
2026
2027 OVS_TRAFFIC_VSWITCHD_STOP
2028 AT_CLEANUP
2029
2030
2031 AT_SETUP([conntrack - IPv6 FTP with NAT])
2032 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
2033 CHECK_CONNTRACK()
2034 OVS_TRAFFIC_VSWITCHD_START()
2035
2036 ADD_NAMESPACES(at_ns0, at_ns1)
2037
2038 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
2039 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2040 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
2041 dnl Would be nice if NAT could translate neighbor discovery messages, too.
2042 NS_CHECK_EXEC([at_ns1], [ip -6 neigh add fc00::240 lladdr 80:88:88:88:88:88 dev p1])
2043
2044 dnl Allow any traffic from ns0->ns1.
2045 dnl Only allow nd, return traffic from ns1->ns0.
2046 AT_DATA([flows.txt], [dnl
2047 dnl Allow other ICMPv6 both ways (without commit).
2048 table=1 priority=100 in_port=1 icmp6, action=2
2049 table=1 priority=100 in_port=2 icmp6, action=1
2050 dnl track all IPv6 traffic (this includes NAT & help to non-NEW packets.)
2051 table=0 priority=10 ip6, action=ct(nat,table=1)
2052 table=0 priority=0 action=drop
2053 dnl
2054 dnl Table 1
2055 dnl
2056 dnl Allow new TCPv6 FTP control connections.
2057 table=1 in_port=1 ct_state=+new tcp6 ipv6_src=fc00::1 tp_dst=21  action=ct(alg=ftp,commit,nat(src=fc00::240)),2
2058 dnl Allow related TCPv6 connections from port 2 to the NATted address.
2059 table=1 in_port=2 ct_state=+new+rel tcp6 ipv6_dst=fc00::240 action=ct(commit,nat),1
2060 dnl Allow established TCPv6 connections both ways, enforce NATting
2061 table=1 in_port=1 ct_state=+est tcp6 ipv6_src=fc00::240   action=2
2062 table=1 in_port=2 ct_state=+est tcp6 ipv6_dst=fc00::1     action=1
2063 dnl Drop everything else.
2064 table=1 priority=0, action=drop
2065 ])
2066
2067 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2068
2069 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
2070
2071 dnl FTP requests from p0->p1 should work fine.
2072 NS_CHECK_EXEC([at_ns0], [wget ftp://[[fc00::2]] -6 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
2073
2074 dnl Discards CLOSE_WAIT and CLOSING
2075 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(fc00::2) | grep -v "FIN" | grep -v "CLOS"], [0], [dnl
2076 tcp,orig=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),reply=(src=fc00::2,dst=fc00::240,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT),helper=ftp
2077 tcp,orig=(src=fc00::2,dst=fc00::240,sport=<cleared>,dport=<cleared>),reply=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),protoinfo=(state=TIME_WAIT)
2078 ])
2079
2080 OVS_TRAFFIC_VSWITCHD_STOP
2081 AT_CLEANUP