tests/system-traffic.at

   1 AT_BANNER([datapath-sanity])
   2
   3 AT_SETUP([datapath - ping between two ports])
   4 OVS_TRAFFIC_VSWITCHD_START()
   5
   6 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
   7
   8 ADD_NAMESPACES(at_ns0, at_ns1)
   9
  10 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
  11 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
  12
  13 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
  14 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  15 ])
  16 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
  17 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  18 ])
  19 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
  20 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  21 ])
  22
  23 OVS_TRAFFIC_VSWITCHD_STOP
  24 AT_CLEANUP
  25
  26 AT_SETUP([datapath - http between two ports])
  27 OVS_TRAFFIC_VSWITCHD_START()
  28
  29 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
  30
  31 ADD_NAMESPACES(at_ns0, at_ns1)
  32
  33 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
  34 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
  35
  36 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
  37 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  38 ])
  39
  40 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
  41 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
  42
  43 OVS_TRAFFIC_VSWITCHD_STOP
  44 AT_CLEANUP
  45
  46 AT_SETUP([datapath - ping between two ports on vlan])
  47 OVS_TRAFFIC_VSWITCHD_START()
  48
  49 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
  50
  51 ADD_NAMESPACES(at_ns0, at_ns1)
  52
  53 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
  54 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
  55
  56 ADD_VLAN(p0, at_ns0, 100, "10.2.2.1/24")
  57 ADD_VLAN(p1, at_ns1, 100, "10.2.2.2/24")
  58
  59 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
  60 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  61 ])
  62 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
  63 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  64 ])
  65 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
  66 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  67 ])
  68
  69 OVS_TRAFFIC_VSWITCHD_STOP
  70 AT_CLEANUP
  71
  72 AT_SETUP([datapath - ping6 between two ports])
  73 OVS_TRAFFIC_VSWITCHD_START()
  74
  75 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
  76
  77 ADD_NAMESPACES(at_ns0, at_ns1)
  78
  79 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
  80 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
  81
  82 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
  83 dnl waiting, we get occasional failures due to the following error:
  84 dnl "connect: Cannot assign requested address"
  85 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
  86
  87 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
  88 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  89 ])
  90 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
  91 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  92 ])
  93 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
  94 3 packets transmitted, 3 received, 0% packet loss, time 0ms
  95 ])
  96
  97 OVS_TRAFFIC_VSWITCHD_STOP
  98 AT_CLEANUP
  99
 100 AT_SETUP([datapath - ping6 between two ports on vlan])
 101 OVS_TRAFFIC_VSWITCHD_START()
 102
 103 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
 104
 105 ADD_NAMESPACES(at_ns0, at_ns1)
 106
 107 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
 108 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
 109
 110 ADD_VLAN(p0, at_ns0, 100, "fc00:1::1/96")
 111 ADD_VLAN(p1, at_ns1, 100, "fc00:1::2/96")
 112
 113 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
 114 dnl waiting, we get occasional failures due to the following error:
 115 dnl "connect: Cannot assign requested address"
 116 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
 117
 118 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00:1::2 | FORMAT_PING], [0], [dnl
 119 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 120 ])
 121 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00:1::2 | FORMAT_PING], [0], [dnl
 122 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 123 ])
 124 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00:1::2 | FORMAT_PING], [0], [dnl
 125 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 126 ])
 127
 128 OVS_TRAFFIC_VSWITCHD_STOP
 129 AT_CLEANUP
 130
 131 AT_SETUP([datapath - ping over vxlan tunnel])
 132 OVS_CHECK_VXLAN()
 133
 134 OVS_TRAFFIC_VSWITCHD_START()
 135 ADD_BR([br-underlay])
 136
 137 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
 138 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
 139
 140 ADD_NAMESPACES(at_ns0)
 141
 142 dnl Set up underlay link from host into the namespace using veth pair.
 143 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
 144 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
 145 AT_CHECK([ip link set dev br-underlay up])
 146
 147 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
 148 dnl linux device inside the namespace.
 149 ADD_OVS_TUNNEL([vxlan], [br0], [at_vxlan0], [172.31.1.1], [10.1.1.100/24])
 150 ADD_NATIVE_TUNNEL([vxlan], [at_vxlan1], [at_ns0], [172.31.1.100], [10.1.1.1/24],
 151                   [id 0 dstport 4789])
 152
 153 dnl First, check the underlay
 154 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
 155 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 156 ])
 157
 158 dnl Okay, now check the overlay with different packet sizes
 159 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 160 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 161 ])
 162 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 163 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 164 ])
 165 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 166 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 167 ])
 168
 169 OVS_TRAFFIC_VSWITCHD_STOP
 170 AT_CLEANUP
 171
 172 AT_SETUP([datapath - ping over gre tunnel])
 173 OVS_CHECK_GRE()
 174
 175 OVS_TRAFFIC_VSWITCHD_START()
 176 ADD_BR([br-underlay])
 177
 178 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
 179 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
 180
 181 ADD_NAMESPACES(at_ns0)
 182
 183 dnl Set up underlay link from host into the namespace using veth pair.
 184 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
 185 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
 186 AT_CHECK([ip link set dev br-underlay up])
 187
 188 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
 189 dnl linux device inside the namespace.
 190 ADD_OVS_TUNNEL([gre], [br0], [at_gre0], [172.31.1.1], [10.1.1.100/24])
 191 ADD_NATIVE_TUNNEL([gretap], [ns_gre0], [at_ns0], [172.31.1.100], [10.1.1.1/24])
 192
 193 dnl First, check the underlay
 194 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
 195 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 196 ])
 197
 198 dnl Okay, now check the overlay with different packet sizes
 199 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 200 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 201 ])
 202 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 203 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 204 ])
 205 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 206 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 207 ])
 208
 209 OVS_TRAFFIC_VSWITCHD_STOP
 210 AT_CLEANUP
 211
 212 AT_SETUP([datapath - ping over geneve tunnel])
 213 OVS_CHECK_GENEVE()
 214
 215 OVS_TRAFFIC_VSWITCHD_START()
 216 ADD_BR([br-underlay])
 217
 218 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
 219 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
 220
 221 ADD_NAMESPACES(at_ns0)
 222
 223 dnl Set up underlay link from host into the namespace using veth pair.
 224 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
 225 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
 226 AT_CHECK([ip link set dev br-underlay up])
 227
 228 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
 229 dnl linux device inside the namespace.
 230 ADD_OVS_TUNNEL([geneve], [br0], [at_gnv0], [172.31.1.1], [10.1.1.100/24])
 231 ADD_NATIVE_TUNNEL([geneve], [ns_gnv0], [at_ns0], [172.31.1.100], [10.1.1.1/24],
 232                   [vni 0])
 233
 234 dnl First, check the underlay
 235 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
 236 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 237 ])
 238
 239 dnl Okay, now check the overlay with different packet sizes
 240 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 241 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 242 ])
 243 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 244 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 245 ])
 246 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
 247 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 248 ])
 249
 250 OVS_TRAFFIC_VSWITCHD_STOP
 251 AT_CLEANUP
 252
 253 AT_SETUP([datapath - basic truncate action])
 254 OVS_TRAFFIC_VSWITCHD_START()
 255 AT_CHECK([ovs-ofctl del-flows br0])
 256
 257 dnl Create p0 and ovs-p0(1)
 258 ADD_NAMESPACES(at_ns0)
 259 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 260 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address e6:66:c1:11:11:11])
 261 NS_CHECK_EXEC([at_ns0], [arp -s 10.1.1.2 e6:66:c1:22:22:22])
 262
 263 dnl Create p1(3) and ovs-p1(2), packets received from ovs-p1 will appear in p1
 264 AT_CHECK([ip link add p1 type veth peer name ovs-p1])
 265 on_exit 'ip link del ovs-p1'
 266 AT_CHECK([ip link set dev ovs-p1 up])
 267 AT_CHECK([ip link set dev p1 up])
 268 AT_CHECK([ovs-vsctl add-port br0 ovs-p1 -- set interface ovs-p1 ofport_request=2])
 269 dnl Use p1 to check the truncated packet
 270 AT_CHECK([ovs-vsctl add-port br0 p1 -- set interface p1 ofport_request=3])
 271
 272 dnl Create p2(5) and ovs-p2(4)
 273 AT_CHECK([ip link add p2 type veth peer name ovs-p2])
 274 on_exit 'ip link del ovs-p2'
 275 AT_CHECK([ip link set dev ovs-p2 up])
 276 AT_CHECK([ip link set dev p2 up])
 277 AT_CHECK([ovs-vsctl add-port br0 ovs-p2 -- set interface ovs-p2 ofport_request=4])
 278 dnl Use p2 to check the truncated packet
 279 AT_CHECK([ovs-vsctl add-port br0 p2 -- set interface p2 ofport_request=5])
 280
 281 dnl basic test
 282 AT_CHECK([ovs-ofctl del-flows br0])
 283 AT_DATA([flows.txt], [dnl
 284 in_port=3 dl_dst=e6:66:c1:22:22:22 actions=drop
 285 in_port=5 dl_dst=e6:66:c1:22:22:22 actions=drop
 286 in_port=1 dl_dst=e6:66:c1:22:22:22 actions=output(port=2,max_len=100),output:4
 287 ])
 288 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 289
 290 dnl use this file as payload file for ncat
 291 AT_CHECK([dd if=/dev/urandom of=payload200.bin bs=200 count=1 2> /dev/null])
 292 on_exit 'rm -f payload200.bin'
 293 NS_CHECK_EXEC([at_ns0], [nc $NC_EOF_OPT -u 10.1.1.2 1234 < payload200.bin])
 294
 295 dnl packet with truncated size
 296 AT_CHECK([ovs-appctl revalidator/purge], [0])
 297 AT_CHECK([ovs-ofctl dump-flows br0 table=0 | grep "in_port=3" |  sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 298 n_bytes=100
 299 ])
 300 dnl packet with original size
 301 AT_CHECK([ovs-appctl revalidator/purge], [0])
 302 AT_CHECK([ovs-ofctl dump-flows br0 table=0 | grep "in_port=5" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 303 n_bytes=242
 304 ])
 305
 306 dnl more complicated output actions
 307 AT_CHECK([ovs-ofctl del-flows br0])
 308 AT_DATA([flows.txt], [dnl
 309 in_port=3 dl_dst=e6:66:c1:22:22:22 actions=drop
 310 in_port=5 dl_dst=e6:66:c1:22:22:22 actions=drop
 311 in_port=1 dl_dst=e6:66:c1:22:22:22 actions=output(port=2,max_len=100),output:4,output(port=2,max_len=100),output(port=4,max_len=100),output:2,output(port=4,max_len=200),output(port=2,max_len=65535)
 312 ])
 313 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 314
 315 NS_CHECK_EXEC([at_ns0], [nc $NC_EOF_OPT -u 10.1.1.2 1234 < payload200.bin])
 316
 317 dnl 100 + 100 + 242 + min(65535,242) = 684
 318 AT_CHECK([ovs-appctl revalidator/purge], [0])
 319 AT_CHECK([ovs-ofctl dump-flows br0 table=0 | grep "in_port=3" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 320 n_bytes=684
 321 ])
 322 dnl 242 + 100 + min(242,200) = 542
 323 AT_CHECK([ovs-ofctl dump-flows br0 table=0 | grep "in_port=5" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 324 n_bytes=542
 325 ])
 326
 327 dnl SLOW_ACTION: disable kernel datapath truncate support
 328 dnl Repeat the test above, but exercise the SLOW_ACTION code path
 329 AT_CHECK([ovs-appctl dpif/disable-truncate], [0],
 330 [Datapath truncate action diabled
 331 ])
 332
 333 dnl SLOW_ACTION test1: check datapatch actions
 334 AT_CHECK([ovs-ofctl del-flows br0])
 335 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 336
 337 AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=1,dl_type=0x800,dl_src=e6:66:c1:11:11:11,dl_dst=e6:66:c1:22:22:22,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,tp_src=8,tp_dst=9"], [0], [stdout])
 338 AT_CHECK([tail -3 stdout], [0],
 339 [Datapath actions: trunc(100),3,5,trunc(100),3,trunc(100),5,3,trunc(200),5,trunc(65535),3
 340 This flow is handled by the userspace slow path because it:
 341         - Uses action(s) not supported by datapath.
 342 ])
 343
 344 dnl SLOW_ACTION test2: check actual packet truncate
 345 AT_CHECK([ovs-ofctl del-flows br0])
 346 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 347 NS_CHECK_EXEC([at_ns0], [nc $NC_EOF_OPT -u 10.1.1.2 1234 < payload200.bin])
 348
 349 dnl 100 + 100 + 242 + min(65535,242) = 684
 350 AT_CHECK([ovs-appctl revalidator/purge], [0])
 351 AT_CHECK([ovs-ofctl dump-flows br0 table=0 | grep "in_port=3" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 352 n_bytes=684
 353 ])
 354
 355 dnl 242 + 100 + min(242,200) = 542
 356 AT_CHECK([ovs-ofctl dump-flows br0 table=0 | grep "in_port=5" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 357 n_bytes=542
 358 ])
 359
 360 OVS_TRAFFIC_VSWITCHD_STOP
 361 AT_CLEANUP
 362
 363 dnl Create 2 bridges and 2 namespaces to test truncate over
 364 dnl GRE tunnel:
 365 dnl   br0: overlay bridge
 366 dnl   ns1: connect to br0, with IP:10.1.1.2
 367 dnl   br-underlay: with IP: 172.31.1.100
 368 dnl   ns0: connect to br-underlay, with IP: 10.1.1.1
 369 AT_SETUP([datapath - truncate and output to gre tunnel])
 370 OVS_CHECK_GRE()
 371 OVS_TRAFFIC_VSWITCHD_START()
 372
 373 ADD_BR([br-underlay])
 374 ADD_NAMESPACES(at_ns0)
 375 ADD_NAMESPACES(at_ns1)
 376 AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
 377 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
 378
 379 dnl Set up underlay link from host into the namespace using veth pair.
 380 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
 381 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
 382 AT_CHECK([ip link set dev br-underlay up])
 383
 384 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
 385 dnl linux device inside the namespace.
 386 ADD_OVS_TUNNEL([gre], [br0], [at_gre0], [172.31.1.1], [10.1.1.100/24])
 387 ADD_NATIVE_TUNNEL([gretap], [ns_gre0], [at_ns0], [172.31.1.100], [10.1.1.1/24])
 388 AT_CHECK([ovs-vsctl -- set interface at_gre0 ofport_request=1])
 389 NS_CHECK_EXEC([at_ns0], [ip link set dev ns_gre0 address e6:66:c1:11:11:11])
 390 NS_CHECK_EXEC([at_ns0], [arp -s 10.1.1.2 e6:66:c1:22:22:22])
 391
 392 dnl Set up (p1 and ovs-p1) at br0
 393 ADD_VETH(p1, at_ns1, br0, '10.1.1.2/24')
 394 AT_CHECK([ovs-vsctl -- set interface ovs-p1 ofport_request=2])
 395 NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address e6:66:c1:22:22:22])
 396 NS_CHECK_EXEC([at_ns1], [arp -s 10.1.1.1 e6:66:c1:11:11:11])
 397
 398 dnl Set up (p2 and ovs-p2) as loopback for verifying packet size
 399 AT_CHECK([ip link add p2 type veth peer name ovs-p2])
 400 on_exit 'ip link del ovs-p2'
 401 AT_CHECK([ip link set dev ovs-p2 up])
 402 AT_CHECK([ip link set dev p2 up])
 403 AT_CHECK([ovs-vsctl add-port br0 ovs-p2 -- set interface ovs-p2 ofport_request=3])
 404 AT_CHECK([ovs-vsctl add-port br0 p2 -- set interface p2 ofport_request=4])
 405
 406 dnl use this file as payload file for ncat
 407 AT_CHECK([dd if=/dev/urandom of=payload200.bin bs=200 count=1 2> /dev/null])
 408 on_exit 'rm -f payload200.bin'
 409
 410 AT_CHECK([ovs-ofctl del-flows br0])
 411 AT_DATA([flows.txt], [dnl
 412 priority=99,in_port=1,actions=output(port=2,max_len=100),output(port=3,max_len=100)
 413 priority=99,in_port=2,udp,actions=output(port=1,max_len=100)
 414 priority=1,in_port=4,ip,actions=drop
 415 priority=1,actions=drop
 416 ])
 417 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 418
 419 AT_CHECK([ovs-ofctl del-flows br-underlay])
 420 AT_DATA([flows-underlay.txt], [dnl
 421 priority=99,dl_type=0x0800,nw_proto=47,in_port=1,actions=LOCAL
 422 priority=99,dl_type=0x0800,nw_proto=47,in_port=LOCAL,ip_dst=172.31.1.1/24,actions=1
 423 priority=1,actions=drop
 424 ])
 425
 426 AT_CHECK([ovs-ofctl add-flows br-underlay flows-underlay.txt])
 427
 428 dnl check tunnel push path, from at_ns1 to at_ns0
 429 NS_CHECK_EXEC([at_ns1], [nc $NC_EOF_OPT -u 10.1.1.1 1234 < payload200.bin])
 430 AT_CHECK([ovs-appctl revalidator/purge], [0])
 431
 432 dnl Before truncation = ETH(14) + IP(20) + UDP(8) + 200 = 242B
 433 AT_CHECK([ovs-ofctl dump-flows br0 | grep "in_port=2" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 434 n_bytes=242
 435 ])
 436 dnl After truncation = outer ETH(14) + outer IP(20) + GRE(4) + 100 = 138B
 437 AT_CHECK([ovs-ofctl dump-flows br-underlay | grep "in_port=LOCAL" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 438 n_bytes=138
 439 ])
 440
 441 dnl check tunnel pop path, from at_ns0 to at_ns1
 442 NS_CHECK_EXEC([at_ns0], [nc $NC_EOF_OPT -u 10.1.1.2 5678 < payload200.bin])
 443 dnl After truncation = 100 byte at loopback device p2(4)
 444 AT_CHECK([ovs-appctl revalidator/purge], [0])
 445 AT_CHECK([ovs-ofctl dump-flows br0 | grep "in_port=4" | awk --field-separator=', '  '{print $5}'], [0], [dnl
 446 n_bytes=100
 447 ])
 448
 449 dnl SLOW_ACTION: disable datapath truncate support
 450 dnl Repeat the test above, but exercise the SLOW_ACTION code path
 451 AT_CHECK([ovs-appctl dpif/disable-truncate], [0],
 452 [Datapath truncate action diabled
 453 ])
 454
 455 dnl SLOW_ACTION test1: check datapatch actions
 456 AT_CHECK([ovs-ofctl del-flows br0])
 457 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 458
 459 dnl SLOW_ACTION test2: check actual packet truncate
 460 AT_CHECK([ovs-ofctl del-flows br0])
 461 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 462 AT_CHECK([ovs-ofctl del-flows br-underlay])
 463 AT_CHECK([ovs-ofctl add-flows br-underlay flows-underlay.txt])
 464
 465 dnl check tunnel push path, from at_ns1 to at_ns0
 466 NS_CHECK_EXEC([at_ns1], [nc $NC_EOF_OPT -u 10.1.1.1 1234 < payload200.bin])
 467 AT_CHECK([ovs-appctl revalidator/purge], [0])
 468
 469 dnl Before truncation = ETH(14) + IP(20) + UDP(8) + 200 = 242B
 470 AT_CHECK([ovs-ofctl dump-flows br0 | grep "in_port=2" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 471 n_bytes=242
 472 ])
 473 dnl After truncation = outer ETH(14) + outer IP(20) + GRE(4) + 100 = 138B
 474 AT_CHECK([ovs-ofctl dump-flows br-underlay | grep "in_port=LOCAL" | sed -n 's/.*\(n\_bytes=[[0-9]]*\).*/\1/p'], [0], [dnl
 475 n_bytes=138
 476 ])
 477
 478 dnl check tunnel pop path, from at_ns0 to at_ns1
 479 NS_CHECK_EXEC([at_ns0], [nc $NC_EOF_OPT -u 10.1.1.2 5678 < payload200.bin])
 480 dnl After truncation = 100 byte at loopback device p2(4)
 481 AT_CHECK([ovs-appctl revalidator/purge], [0])
 482 AT_CHECK([ovs-ofctl dump-flows br0 | grep "in_port=4" | awk --field-separator=', '  '{print $5}'], [0], [dnl
 483 n_bytes=100
 484 ])
 485
 486 OVS_TRAFFIC_VSWITCHD_STOP
 487 AT_CLEANUP
 488
 489 AT_SETUP([conntrack - controller])
 490 CHECK_CONNTRACK()
 491 OVS_TRAFFIC_VSWITCHD_START()
 492
 493 ADD_NAMESPACES(at_ns0, at_ns1)
 494
 495 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 496 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 497
 498 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 499 AT_DATA([flows.txt], [dnl
 500 priority=1,action=drop
 501 priority=10,arp,action=normal
 502 priority=100,in_port=1,udp,action=ct(commit),controller
 503 priority=100,in_port=2,ct_state=-trk,udp,action=ct(table=0)
 504 priority=100,in_port=2,ct_state=+trk+est,udp,action=controller
 505 ])
 506
 507 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 508
 509 AT_CAPTURE_FILE([ofctl_monitor.log])
 510 AT_CHECK([ovs-ofctl monitor br0 65534 invalid_ttl --detach --no-chdir --pidfile 2> ofctl_monitor.log])
 511
 512 dnl Send an unsolicited reply from port 2. This should be dropped.
 513 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) '50540000000a50540000000908004500001c00000000001100000a0101020a0101010002000100080000'])
 514
 515 dnl OK, now start a new connection from port 1.
 516 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 1 ct\(commit\),controller '50540000000a50540000000908004500001c00000000001100000a0101010a0101020001000200080000'])
 517
 518 dnl Now try a reply from port 2.
 519 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) '50540000000a50540000000908004500001c00000000001100000a0101020a0101010002000100080000'])
 520
 521 dnl Check this output. We only see the latter two packets, not the first.
 522 AT_CHECK([cat ofctl_monitor.log], [0], [dnl
 523 NXT_PACKET_IN2 (xid=0x0): total_len=42 in_port=1 (via action) data_len=42 (unbuffered)
 524 udp,vlan_tci=0x0000,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_src=10.1.1.1,nw_dst=10.1.1.2,nw_tos=0,nw_ecn=0,nw_ttl=0,tp_src=1,tp_dst=2 udp_csum:0
 525 NXT_PACKET_IN2 (xid=0x0): cookie=0x0 total_len=42 ct_state=est|rpl|trk,in_port=2 (via action) data_len=42 (unbuffered)
 526 udp,vlan_tci=0x0000,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_src=10.1.1.2,nw_dst=10.1.1.1,nw_tos=0,nw_ecn=0,nw_ttl=0,tp_src=2,tp_dst=1 udp_csum:0
 527 ])
 528
 529 OVS_TRAFFIC_VSWITCHD_STOP
 530 AT_CLEANUP
 531
 532 AT_SETUP([conntrack - IPv4 HTTP])
 533 CHECK_CONNTRACK()
 534 OVS_TRAFFIC_VSWITCHD_START()
 535
 536 ADD_NAMESPACES(at_ns0, at_ns1)
 537
 538 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 539 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 540
 541 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 542 AT_DATA([flows.txt], [dnl
 543 priority=1,action=drop
 544 priority=10,arp,action=normal
 545 priority=10,icmp,action=normal
 546 priority=100,in_port=1,tcp,action=ct(commit),2
 547 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
 548 priority=100,in_port=2,ct_state=+trk+est,tcp,action=1
 549 ])
 550
 551 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 552
 553 dnl HTTP requests from ns0->ns1 should work fine.
 554 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 555 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 556
 557 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 558 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
 559 ])
 560
 561 dnl HTTP requests from ns1->ns0 should fail due to network failure.
 562 dnl Try 3 times, in 1 second intervals.
 563 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 564 NS_CHECK_EXEC([at_ns1], [wget 10.1.1.1 -t 3 -T 1 -v -o wget1.log], [4])
 565
 566 OVS_TRAFFIC_VSWITCHD_STOP
 567 AT_CLEANUP
 568
 569 AT_SETUP([conntrack - IPv6 HTTP])
 570 CHECK_CONNTRACK()
 571 OVS_TRAFFIC_VSWITCHD_START()
 572
 573 ADD_NAMESPACES(at_ns0, at_ns1)
 574
 575 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
 576 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
 577
 578 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 579 AT_DATA([flows.txt], [dnl
 580 priority=1,action=drop
 581 priority=10,icmp6,action=normal
 582 priority=100,in_port=1,tcp6,action=ct(commit),2
 583 priority=100,in_port=2,ct_state=-trk,tcp6,action=ct(table=0)
 584 priority=100,in_port=2,ct_state=+trk+est,tcp6,action=1
 585 ])
 586
 587 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 588
 589 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
 590 dnl waiting, we get occasional failures due to the following error:
 591 dnl "connect: Cannot assign requested address"
 592 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
 593
 594 dnl HTTP requests from ns0->ns1 should work fine.
 595 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py http6]], [http0.pid])
 596
 597 NS_CHECK_EXEC([at_ns0], [wget http://[[fc00::2]] -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 598
 599 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(fc00::2)], [0], [dnl
 600 tcp,orig=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),reply=(src=fc00::2,dst=fc00::1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
 601 ])
 602
 603 dnl HTTP requests from ns1->ns0 should fail due to network failure.
 604 dnl Try 3 times, in 1 second intervals.
 605 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py http6]], [http1.pid])
 606 NS_CHECK_EXEC([at_ns1], [wget http://[[fc00::1]] -t 3 -T 1 -v -o wget1.log], [4])
 607
 608 OVS_TRAFFIC_VSWITCHD_STOP
 609 AT_CLEANUP
 610
 611 AT_SETUP([conntrack - commit, recirc])
 612 CHECK_CONNTRACK()
 613 OVS_TRAFFIC_VSWITCHD_START()
 614
 615 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 616
 617 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 618 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 619 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 620 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 621
 622 dnl Allow any traffic from ns0->ns1, ns2->ns3.
 623 AT_DATA([flows.txt], [dnl
 624 priority=1,action=drop
 625 priority=10,arp,action=normal
 626 priority=10,icmp,action=normal
 627 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(commit,table=0)
 628 priority=100,in_port=1,tcp,ct_state=+trk,action=2
 629 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0)
 630 priority=100,in_port=2,tcp,ct_state=+trk,action=1
 631 priority=100,in_port=3,tcp,ct_state=-trk,action=set_field:0->metadata,ct(table=0)
 632 priority=100,in_port=3,tcp,ct_state=+trk,metadata=0,action=set_field:1->metadata,ct(commit,table=0)
 633 priority=100,in_port=3,tcp,ct_state=+trk,metadata=1,action=4
 634 priority=100,in_port=4,tcp,ct_state=-trk,action=ct(commit,table=0)
 635 priority=100,in_port=4,tcp,ct_state=+trk,action=3
 636 ])
 637
 638 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 639
 640 dnl HTTP requests from p0->p1 should work fine.
 641 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 642 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 643
 644 dnl HTTP requests from p2->p3 should work fine.
 645 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 646 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 --retry-connrefused -v -o wget1.log])
 647
 648 OVS_TRAFFIC_VSWITCHD_STOP
 649 AT_CLEANUP
 650
 651 AT_SETUP([conntrack - preserve registers])
 652 CHECK_CONNTRACK()
 653 OVS_TRAFFIC_VSWITCHD_START()
 654
 655 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 656
 657 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 658 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 659 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 660 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 661
 662 dnl Allow any traffic from ns0->ns1, ns2->ns3.
 663 AT_DATA([flows.txt], [dnl
 664 priority=1,action=drop
 665 priority=10,arp,action=normal
 666 priority=10,icmp,action=normal
 667 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(commit,table=0)
 668 priority=100,in_port=1,tcp,ct_state=+trk,action=2
 669 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0)
 670 priority=100,in_port=2,tcp,ct_state=+trk,action=1
 671 priority=100,in_port=3,tcp,ct_state=-trk,action=load:0->NXM_NX_REG0[[]],ct(table=0)
 672 priority=100,in_port=3,tcp,ct_state=+trk,reg0=0,action=load:1->NXM_NX_REG0[[]],ct(commit,table=0)
 673 priority=100,in_port=3,tcp,ct_state=+trk,reg0=1,action=4
 674 priority=100,in_port=4,tcp,ct_state=-trk,action=ct(commit,table=0)
 675 priority=100,in_port=4,tcp,ct_state=+trk,action=3
 676 ])
 677
 678 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 679
 680 dnl HTTP requests from p0->p1 should work fine.
 681 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 682 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 683
 684 dnl HTTP requests from p2->p3 should work fine.
 685 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 686 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 --retry-connrefused -v -o wget1.log])
 687
 688 OVS_TRAFFIC_VSWITCHD_STOP
 689 AT_CLEANUP
 690
 691 AT_SETUP([conntrack - invalid])
 692 CHECK_CONNTRACK()
 693 OVS_TRAFFIC_VSWITCHD_START()
 694
 695 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 696
 697 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 698 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 699 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 700 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 701
 702 dnl Pass traffic from ns0->ns1 without committing, but attempt to track in
 703 dnl the opposite direction. This should fail.
 704 dnl Pass traffic from ns3->ns4 without committing, and this time match
 705 dnl invalid traffic and allow it through.
 706 AT_DATA([flows.txt], [dnl
 707 priority=1,action=drop
 708 priority=10,arp,action=normal
 709 priority=10,icmp,action=normal
 710 priority=100,in_port=1,tcp,action=ct(),2
 711 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
 712 priority=100,in_port=2,ct_state=+trk+new,tcp,action=1
 713 priority=100,in_port=3,tcp,action=ct(),4
 714 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
 715 priority=100,in_port=4,ct_state=+trk+inv,tcp,action=3
 716 priority=100,in_port=4,ct_state=+trk+new,tcp,action=3
 717 ])
 718
 719 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 720
 721 dnl We set up our rules to allow the request without committing. The return
 722 dnl traffic can't be identified, because the initial request wasn't committed.
 723 dnl For the first pair of ports, this means that the connection fails.
 724 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 725 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log], [4])
 726
 727 dnl For the second pair, we allow packets from invalid connections, so it works.
 728 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 729 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 --retry-connrefused -v -o wget1.log])
 730
 731 OVS_TRAFFIC_VSWITCHD_STOP
 732 AT_CLEANUP
 733
 734 AT_SETUP([conntrack - zones])
 735 CHECK_CONNTRACK()
 736 OVS_TRAFFIC_VSWITCHD_START()
 737
 738 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 739
 740 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 741 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 742 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 743 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 744
 745 dnl Allow any traffic from ns0->ns1. Allow return traffic, matching on zone.
 746 dnl For ns2->ns3, use a different zone and see that the match fails.
 747 AT_DATA([flows.txt], [dnl
 748 priority=1,action=drop
 749 priority=10,arp,action=normal
 750 priority=10,icmp,action=normal
 751 priority=100,in_port=1,tcp,action=ct(commit,zone=1),2
 752 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0,zone=1)
 753 priority=100,in_port=2,ct_state=+trk,ct_zone=1,tcp,action=1
 754 priority=100,in_port=3,tcp,action=ct(commit,zone=2),4
 755 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0,zone=2)
 756 priority=100,in_port=4,ct_state=+trk,ct_zone=1,tcp,action=3
 757 ])
 758
 759 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 760
 761 dnl HTTP requests from p0->p1 should work fine.
 762 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 763 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 764
 765 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 766 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
 767 ])
 768
 769 dnl HTTP requests from p2->p3 should fail due to network failure.
 770 dnl Try 3 times, in 1 second intervals.
 771 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 772 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
 773
 774 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
 775 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>)
 776 ])
 777
 778 OVS_TRAFFIC_VSWITCHD_STOP
 779 AT_CLEANUP
 780
 781 AT_SETUP([conntrack - zones from field])
 782 CHECK_CONNTRACK()
 783 OVS_TRAFFIC_VSWITCHD_START()
 784
 785 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
 786
 787 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 788 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 789 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
 790 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
 791
 792 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 793 AT_DATA([flows.txt], [dnl
 794 priority=1,action=drop
 795 priority=10,arp,action=normal
 796 priority=10,icmp,action=normal
 797 priority=100,in_port=1,tcp,action=load:0x1001->NXM_NX_REG0[[0..15]],ct(commit,zone=NXM_NX_REG0[[0..15]]),2
 798 priority=100,in_port=2,ct_state=-trk,tcp,action=load:0x1001->NXM_NX_REG0[[0..15]],ct(table=0,zone=NXM_NX_REG0[[0..15]])
 799 priority=100,in_port=2,ct_state=+trk,ct_zone=0x1001,tcp,action=1
 800 priority=100,in_port=3,tcp,action=load:0x1002->NXM_NX_REG0[[0..15]],ct(commit,zone=NXM_NX_REG0[[0..15]]),4
 801 priority=100,in_port=4,ct_state=-trk,tcp,action=load:0x1002->NXM_NX_REG0[[0..15]],ct(table=0,zone=NXM_NX_REG0[[0..15]])
 802 priority=100,in_port=4,ct_state=+trk,ct_zone=0x1001,tcp,action=3
 803 ])
 804
 805 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 806
 807 dnl HTTP requests from p0->p1 should work fine.
 808 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 809 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 810
 811 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 812 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=4097,protoinfo=(state=<cleared>)
 813 ])
 814
 815 dnl HTTP requests from p2->p3 should fail due to network failure.
 816 dnl Try 3 times, in 1 second intervals.
 817 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
 818 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
 819
 820 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
 821 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),zone=4098,protoinfo=(state=<cleared>)
 822 ])
 823
 824 OVS_TRAFFIC_VSWITCHD_STOP
 825 AT_CLEANUP
 826
 827 AT_SETUP([conntrack - multiple bridges])
 828 CHECK_CONNTRACK()
 829 OVS_TRAFFIC_VSWITCHD_START(
 830    [_ADD_BR([br1]) --\
 831     add-port br0 patch+ -- set int patch+ type=patch options:peer=patch- --\
 832     add-port br1 patch- -- set int patch- type=patch options:peer=patch+ --])
 833
 834 ADD_NAMESPACES(at_ns0, at_ns1)
 835
 836 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 837 ADD_VETH(p1, at_ns1, br1, "10.1.1.2/24")
 838
 839 dnl Allow any traffic from ns0->br1, allow established in reverse.
 840 AT_DATA([flows-br0.txt], [dnl
 841 priority=1,action=drop
 842 priority=10,arp,action=normal
 843 priority=10,icmp,action=normal
 844 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(commit,zone=1),1
 845 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(table=0,zone=1)
 846 priority=100,in_port=1,tcp,ct_state=+trk+est,ct_zone=1,action=2
 847 ])
 848
 849 dnl Allow any traffic from br0->ns1, allow established in reverse.
 850 AT_DATA([flows-br1.txt], [dnl
 851 priority=1,action=drop
 852 priority=10,arp,action=normal
 853 priority=10,icmp,action=normal
 854 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(table=0,zone=2)
 855 priority=100,in_port=1,tcp,ct_state=+trk+new,ct_zone=2,action=ct(commit,zone=2),2
 856 priority=100,in_port=1,tcp,ct_state=+trk+est,ct_zone=2,action=2
 857 priority=100,in_port=2,tcp,ct_state=-trk,action=ct(table=0,zone=2)
 858 priority=100,in_port=2,tcp,ct_state=+trk+est,ct_zone=2,action=ct(commit,zone=2),1
 859 ])
 860
 861 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows-br0.txt])
 862 AT_CHECK([ovs-ofctl --bundle add-flows br1 flows-br1.txt])
 863
 864 dnl HTTP requests from p0->p1 should work fine.
 865 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 866 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 867
 868 OVS_TRAFFIC_VSWITCHD_STOP
 869 AT_CLEANUP
 870
 871 AT_SETUP([conntrack - multiple zones])
 872 CHECK_CONNTRACK()
 873 OVS_TRAFFIC_VSWITCHD_START()
 874
 875 ADD_NAMESPACES(at_ns0, at_ns1)
 876
 877 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
 878 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
 879
 880 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 881 AT_DATA([flows.txt], [dnl
 882 priority=1,action=drop
 883 priority=10,arp,action=normal
 884 priority=10,icmp,action=normal
 885 priority=100,in_port=1,tcp,action=ct(commit,zone=1),ct(commit,zone=2),2
 886 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0,zone=2)
 887 priority=100,in_port=2,ct_state=+trk,ct_zone=2,tcp,action=1
 888 ])
 889
 890 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 891
 892 dnl HTTP requests from p0->p1 should work fine.
 893 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 894 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 895
 896 dnl (again) HTTP requests from p0->p1 should work fine.
 897 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 898
 899 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 900 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
 901 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>)
 902 ])
 903
 904 OVS_TRAFFIC_VSWITCHD_STOP
 905 AT_CLEANUP
 906
 907 AT_SETUP([conntrack - multiple zones, local])
 908 CHECK_CONNTRACK()
 909 OVS_TRAFFIC_VSWITCHD_START()
 910
 911 ADD_NAMESPACES(at_ns0)
 912
 913 AT_CHECK([ip addr add dev br0 "10.1.1.1/24"])
 914 AT_CHECK([ip link set dev br0 up])
 915 on_exit 'ip addr del dev br0 "10.1.1.1/24"'
 916 ADD_VETH(p0, at_ns0, br0, "10.1.1.2/24")
 917
 918 dnl Allow traffic from local stack to ns0. Only allow neighbour discovery,
 919 dnl return traffic from ns0 back to the local stack.
 920 AT_DATA([flows.txt], [dnl
 921 priority=1,action=drop
 922 priority=10,arp,action=normal
 923 priority=100,in_port=LOCAL,ip,ct_state=-trk,action=drop
 924 priority=100,in_port=LOCAL,ip,ct_state=+trk+new,action=ct(commit,zone=1),ct(commit,zone=2),1
 925 priority=100,in_port=LOCAL,ip,ct_state=+trk+est,action=ct(commit,zone=1),ct(commit,zone=2),1
 926 priority=100,in_port=1,ip,ct_state=-trk,action=ct(table=1,zone=1)
 927 table=1,priority=100,in_port=1,ip,ct_state=+trk+est,ct_zone=1,action=ct(table=2,zone=2)
 928 table=2,priority=100,in_port=1,ip,ct_state=+trk+est,ct_zone=2,action=LOCAL
 929 ])
 930
 931 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
 932
 933 AT_CHECK([ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
 934 3 packets transmitted, 3 received, 0% packet loss, time 0ms
 935 ])
 936
 937 dnl HTTP requests from root namespace to p0 should work fine.
 938 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 939 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 940
 941 dnl (again) HTTP requests from root namespace to  p0 should work fine.
 942 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 943
 944 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep "zone"], [0], [dnl
 945 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=1
 946 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=2
 947 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
 948 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>)
 949 ])
 950
 951 OVS_TRAFFIC_VSWITCHD_STOP
 952 AT_CLEANUP
 953
 954 AT_SETUP([conntrack - multiple namespaces, internal ports])
 955 CHECK_CONNTRACK()
 956 OVS_TRAFFIC_VSWITCHD_START(
 957    [set-fail-mode br0 secure -- ])
 958
 959 ADD_NAMESPACES(at_ns0, at_ns1)
 960
 961 ADD_INT(p0, at_ns0, br0, "10.1.1.1/24")
 962 ADD_INT(p1, at_ns1, br0, "10.1.1.2/24")
 963
 964 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
 965 dnl
 966 dnl If skb->nfct is leaking from inside the namespace, this test will fail.
 967 AT_DATA([flows.txt], [dnl
 968 priority=1,action=drop
 969 priority=10,arp,action=normal
 970 priority=10,icmp,action=normal
 971 priority=100,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=1),2
 972 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0,zone=1)
 973 priority=100,in_port=2,ct_state=+trk,ct_zone=1,tcp,action=1
 974 ])
 975
 976 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
 977
 978 dnl HTTP requests from p0->p1 should work fine.
 979 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
 980 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 981
 982 dnl (again) HTTP requests from p0->p1 should work fine.
 983 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
 984
 985 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
 986 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
 987 ])
 988
 989 OVS_TRAFFIC_VSWITCHD_STOP(["dnl
 990 /ioctl(SIOCGIFINDEX) on .* device failed: No such device/d
 991 /removing policing failed: No such device/d"])
 992 AT_CLEANUP
 993
 994 AT_SETUP([conntrack - multi-stage pipeline, local])
 995 CHECK_CONNTRACK()
 996 OVS_TRAFFIC_VSWITCHD_START()
 997
 998 ADD_NAMESPACES(at_ns0)
 999
1000 AT_CHECK([ip addr add dev br0 "10.1.1.1/24"])
1001 AT_CHECK([ip link set dev br0 up])
1002 on_exit 'ip addr del dev br0 "10.1.1.1/24"'
1003 ADD_VETH(p0, at_ns0, br0, "10.1.1.2/24")
1004
1005 dnl Allow traffic from local stack to ns0. Only allow neighbour discovery,
1006 dnl return traffic from ns0 back to the local stack.
1007 AT_DATA([flows.txt], [dnl
1008 dnl default
1009 table=0,priority=1,action=drop
1010 table=0,priority=10,arp,action=normal
1011
1012 dnl Load the output port to REG0
1013 table=0,priority=100,ip,in_port=LOCAL,action=load:1->NXM_NX_REG0[[0..15]],goto_table:1
1014 table=0,priority=100,ip,in_port=1,action=load:65534->NXM_NX_REG0[[0..15]],goto_table:1
1015
1016 dnl Ingress pipeline
1017 dnl - Allow all connections from LOCAL port (commit and proceed to egress)
1018 dnl - All other connections go through conntracker using the input port as
1019 dnl   a connection tracking zone.
1020 table=1,priority=150,in_port=LOCAL,ip,ct_state=+trk+new,action=ct(commit,zone=OXM_OF_IN_PORT[[0..15]]),goto_table:2
1021 table=1,priority=100,ip,action=ct(table=2,zone=OXM_OF_IN_PORT[[0..15]])
1022 table=1,priority=1,action=drop
1023
1024 dnl Egress pipeline
1025 dnl - Allow all connections from LOCAL port (commit and skip to output)
1026 dnl - Allow other established connections to go through conntracker using
1027 dnl   output port as a connection tracking zone.
1028 table=2,priority=150,in_port=LOCAL,ip,ct_state=+trk+new,action=ct(commit,zone=NXM_NX_REG0[[0..15]]),goto_table:4
1029 table=2,priority=100,ip,ct_state=+trk+est,action=ct(table=3,zone=NXM_NX_REG0[[0..15]])
1030 table=2,priority=1,action=drop
1031
1032 dnl Only allow established traffic from egress ct lookup
1033 table=3,priority=100,ip,ct_state=+trk+est,action=goto_table:4
1034 table=3,priority=1,action=drop
1035
1036 dnl output table
1037 table=4,priority=100,ip,action=output:NXM_NX_REG0[[]]
1038 ])
1039
1040 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1041
1042 AT_CHECK([ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1043 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1044 ])
1045
1046 dnl HTTP requests from root namespace to p0 should work fine.
1047 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1048 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1049
1050 dnl (again) HTTP requests from root namespace to p0 should work fine.
1051 AT_CHECK([wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1052
1053 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | grep "zone"], [0], [dnl
1054 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=1
1055 icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,id=<cleared>),zone=65534
1056 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
1057 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=65534,protoinfo=(state=<cleared>)
1058 ])
1059
1060 OVS_TRAFFIC_VSWITCHD_STOP
1061 AT_CLEANUP
1062
1063 AT_SETUP([conntrack - ct_mark])
1064 CHECK_CONNTRACK()
1065 OVS_TRAFFIC_VSWITCHD_START()
1066
1067 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
1068
1069 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1070 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1071 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
1072 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
1073
1074 dnl Allow traffic between ns0<->ns1 using the ct_mark.
1075 dnl Check that different marks do not match for traffic between ns2<->ns3.
1076 AT_DATA([flows.txt], [dnl
1077 priority=1,action=drop
1078 priority=10,arp,action=normal
1079 priority=10,icmp,action=normal
1080 priority=100,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_mark)),2
1081 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
1082 priority=100,in_port=2,ct_state=+trk,ct_mark=1,tcp,action=1
1083 priority=100,in_port=3,tcp,action=ct(commit,exec(set_field:2->ct_mark)),4
1084 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
1085 priority=100,in_port=4,ct_state=+trk,ct_mark=1,tcp,action=3
1086 ])
1087
1088 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1089
1090 dnl HTTP requests from p0->p1 should work fine.
1091 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1092 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1093
1094 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1095 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),mark=1,protoinfo=(state=<cleared>)
1096 ])
1097
1098 dnl HTTP requests from p2->p3 should fail due to network failure.
1099 dnl Try 3 times, in 1 second intervals.
1100 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
1101 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
1102
1103 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
1104 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),mark=2,protoinfo=(state=<cleared>)
1105 ])
1106
1107 OVS_TRAFFIC_VSWITCHD_STOP
1108 AT_CLEANUP
1109
1110 AT_SETUP([conntrack - ct_mark bit-fiddling])
1111 CHECK_CONNTRACK()
1112 OVS_TRAFFIC_VSWITCHD_START()
1113
1114 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
1115
1116 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1117 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1118
1119 dnl Allow traffic between ns0<->ns1 using the ct_mark. Return traffic should
1120 dnl cause an additional bit to be set in the connection (and be allowed).
1121 AT_DATA([flows.txt], [dnl
1122 table=0,priority=1,action=drop
1123 table=0,priority=10,arp,action=normal
1124 table=0,priority=10,icmp,action=normal
1125 table=0,priority=100,in_port=1,tcp,action=ct(table=1)
1126 table=0,priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=1,commit,exec(set_field:0x2/0x6->ct_mark))
1127 table=1,priority=100,in_port=1,ct_state=+new,tcp,action=ct(commit,exec(set_field:0x5/0x5->ct_mark)),2
1128 table=1,priority=100,in_port=1,ct_state=-new,tcp,action=2
1129 table=1,priority=100,in_port=2,ct_state=+trk,ct_mark=3,tcp,action=1
1130 ])
1131
1132 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1133
1134 dnl HTTP requests from p0->p1 should work fine.
1135 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1136 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1137
1138 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1139 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),mark=3,protoinfo=(state=<cleared>)
1140 ])
1141
1142 OVS_TRAFFIC_VSWITCHD_STOP
1143 AT_CLEANUP
1144
1145 AT_SETUP([conntrack - ct_mark from register])
1146 CHECK_CONNTRACK()
1147 OVS_TRAFFIC_VSWITCHD_START()
1148
1149 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
1150
1151 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1152 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1153 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
1154 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
1155
1156 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1157 AT_DATA([flows.txt], [dnl
1158 priority=1,action=drop
1159 priority=10,arp,action=normal
1160 priority=10,icmp,action=normal
1161 priority=100,in_port=1,tcp,action=load:1->NXM_NX_REG0[[0..31]],ct(commit,exec(move:NXM_NX_REG0[[0..31]]->NXM_NX_CT_MARK[[]])),2
1162 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
1163 priority=100,in_port=2,ct_state=+trk,ct_mark=1,tcp,action=1
1164 priority=100,in_port=3,tcp,action=load:2->NXM_NX_REG0[[0..31]],ct(commit,exec(move:NXM_NX_REG0[[0..31]]->NXM_NX_CT_MARK[[]])),4
1165 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
1166 priority=100,in_port=4,ct_state=+trk,ct_mark=1,tcp,action=3
1167 ])
1168
1169 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1170
1171 dnl HTTP requests from p0->p1 should work fine.
1172 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1173 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1174
1175 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1176 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),mark=1,protoinfo=(state=<cleared>)
1177 ])
1178
1179 dnl HTTP requests from p2->p3 should fail due to network failure.
1180 dnl Try 3 times, in 1 second intervals.
1181 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
1182 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
1183
1184 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.4)], [0], [dnl
1185 tcp,orig=(src=10.1.1.3,dst=10.1.1.4,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.3,sport=<cleared>,dport=<cleared>),mark=2,protoinfo=(state=<cleared>)
1186 ])
1187
1188 OVS_TRAFFIC_VSWITCHD_STOP
1189 AT_CLEANUP
1190
1191 AT_SETUP([conntrack - ct_label])
1192 CHECK_CONNTRACK()
1193 OVS_TRAFFIC_VSWITCHD_START()
1194
1195 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
1196
1197 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1198 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1199 ADD_VETH(p2, at_ns2, br0, "10.1.1.3/24")
1200 ADD_VETH(p3, at_ns3, br0, "10.1.1.4/24")
1201
1202 dnl Allow traffic between ns0<->ns1 using the ct_label.
1203 dnl Check that different labels do not match for traffic between ns2<->ns3.
1204 AT_DATA([flows.txt], [dnl
1205 priority=1,action=drop
1206 priority=10,arp,action=normal
1207 priority=10,icmp,action=normal
1208 priority=100,in_port=1,tcp,action=ct(commit,exec(set_field:0x0a000d000005000001->ct_label)),2
1209 priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=0)
1210 priority=100,in_port=2,ct_state=+trk,ct_label=0x0a000d000005000001,tcp,action=1
1211 priority=100,in_port=3,tcp,action=ct(commit,exec(set_field:0x2->ct_label)),4
1212 priority=100,in_port=4,ct_state=-trk,tcp,action=ct(table=0)
1213 priority=100,in_port=4,ct_state=+trk,ct_label=0x0a000d000005000001,tcp,action=3
1214 ])
1215
1216 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1217
1218 dnl HTTP requests from p0->p1 should work fine.
1219 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1220 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1221
1222 dnl HTTP requests from p2->p3 should fail due to network failure.
1223 dnl Try 3 times, in 1 second intervals.
1224 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http1.pid])
1225 NS_CHECK_EXEC([at_ns2], [wget 10.1.1.4 -t 3 -T 1 -v -o wget1.log], [4])
1226
1227 OVS_TRAFFIC_VSWITCHD_STOP
1228 AT_CLEANUP
1229
1230 AT_SETUP([conntrack - ct_label bit-fiddling])
1231 CHECK_CONNTRACK()
1232 OVS_TRAFFIC_VSWITCHD_START()
1233
1234 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
1235
1236 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1237 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1238
1239 dnl Allow traffic between ns0<->ns1 using the ct_labels. Return traffic should
1240 dnl cause an additional bit to be set in the connection labels (and be allowed)
1241 AT_DATA([flows.txt], [dnl
1242 table=0,priority=1,action=drop
1243 table=0,priority=10,arp,action=normal
1244 table=0,priority=10,icmp,action=normal
1245 table=0,priority=100,in_port=1,tcp,action=ct(table=1)
1246 table=0,priority=100,in_port=2,ct_state=-trk,tcp,action=ct(table=1,commit,exec(set_field:0x200000000/0x200000004->ct_label))
1247 table=1,priority=100,in_port=1,tcp,ct_state=+new,action=ct(commit,exec(set_field:0x5/0x5->ct_label)),2
1248 table=1,priority=100,in_port=1,tcp,ct_state=-new,action=2
1249 table=1,priority=100,in_port=2,ct_state=+trk,ct_label=0x200000001,tcp,action=1
1250 ])
1251
1252 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1253
1254 dnl HTTP requests from p0->p1 should work fine.
1255 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1256 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1257
1258 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1259 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),labels=0x200000001,protoinfo=(state=<cleared>)
1260 ])
1261
1262 OVS_TRAFFIC_VSWITCHD_STOP
1263 AT_CLEANUP
1264
1265 AT_SETUP([conntrack - ct metadata, multiple zones])
1266 CHECK_CONNTRACK()
1267 OVS_TRAFFIC_VSWITCHD_START()
1268
1269 ADD_NAMESPACES(at_ns0, at_ns1, at_ns2, at_ns3)
1270
1271 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1272 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1273
1274 dnl Allow traffic between ns0<->ns1 using the ct_mark and ct_labels in zone=1,
1275 dnl but do *not* set any of these for the ct() in zone=2. Traffic should pass,
1276 dnl and we should see that the conntrack entries only apply the ct_mark and
1277 dnl ct_labels to the connection in zone=1.
1278 AT_DATA([flows.txt], [dnl
1279 table=0,priority=1,action=drop
1280 table=0,priority=10,arp,action=normal
1281 table=0,priority=10,icmp,action=normal
1282 table=0,priority=100,in_port=1,tcp,action=ct(zone=1,table=1)
1283 table=0,priority=100,in_port=2,ct_state=-trk,tcp,action=ct(zone=1,table=1,commit,exec(set_field:0x200000000/0x200000004->ct_label,set_field:0x2/0x6->ct_mark))
1284 table=1,priority=100,in_port=1,tcp,ct_state=+new,action=ct(zone=1,commit,exec(set_field:0x5/0x5->ct_label,set_field:0x5/0x5->ct_mark)),ct(commit,zone=2),2
1285 table=1,priority=100,in_port=1,tcp,ct_state=-new,action=ct(zone=2),2
1286 table=1,priority=100,in_port=2,tcp,action=ct(zone=2),1
1287 ])
1288
1289 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1290
1291 dnl HTTP requests from p0->p1 should work fine.
1292 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1293 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1294
1295 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1296 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,mark=3,labels=0x200000001,protoinfo=(state=<cleared>)
1297 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>)
1298 ])
1299
1300 OVS_TRAFFIC_VSWITCHD_STOP
1301 AT_CLEANUP
1302
1303 AT_SETUP([conntrack - ICMP related])
1304 CHECK_CONNTRACK()
1305 OVS_TRAFFIC_VSWITCHD_START()
1306
1307 ADD_NAMESPACES(at_ns0, at_ns1)
1308
1309 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1310 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1311
1312 dnl Allow UDP traffic from ns0->ns1. Only allow related ICMP responses back.
1313 AT_DATA([flows.txt], [dnl
1314 priority=1,action=drop
1315 priority=10,arp,action=normal
1316 priority=100,in_port=1,udp,action=ct(commit,exec(set_field:1->ct_mark)),2
1317 priority=100,in_port=2,icmp,ct_state=-trk,action=ct(table=0)
1318 priority=100,in_port=2,icmp,ct_state=+trk+rel,ct_mark=1,action=1
1319 ])
1320
1321 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1322
1323 dnl UDP packets from ns0->ns1 should solicit "destination unreachable" response.
1324 NS_CHECK_EXEC([at_ns0], [bash -c "echo a | nc $NC_EOF_OPT -u 10.1.1.2 10000"])
1325
1326 AT_CHECK([ovs-appctl revalidator/purge], [0])
1327 AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort | grep -v drop], [0], [dnl
1328  n_packets=1, n_bytes=44, priority=100,udp,in_port=1 actions=ct(commit,exec(load:0x1->NXM_NX_CT_MARK[[]])),output:2
1329  n_packets=1, n_bytes=72, priority=100,ct_state=+rel+trk,ct_mark=0x1,icmp,in_port=2 actions=output:1
1330  n_packets=1, n_bytes=72, priority=100,ct_state=-trk,icmp,in_port=2 actions=ct(table=0)
1331  n_packets=2, n_bytes=84, priority=10,arp actions=NORMAL
1332 NXST_FLOW reply:
1333 ])
1334
1335 OVS_TRAFFIC_VSWITCHD_STOP
1336 AT_CLEANUP
1337
1338 AT_SETUP([conntrack - ICMP related 2])
1339 CHECK_CONNTRACK()
1340 OVS_TRAFFIC_VSWITCHD_START()
1341
1342 ADD_NAMESPACES(at_ns0, at_ns1)
1343
1344 ADD_VETH(p0, at_ns0, br0, "172.16.0.1/24")
1345 ADD_VETH(p1, at_ns1, br0, "172.16.0.2/24")
1346
1347 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1348 AT_DATA([flows.txt], [dnl
1349 priority=1,action=drop
1350 priority=10,arp,action=normal
1351 priority=100,in_port=1,udp,ct_state=-trk,action=ct(commit,table=0)
1352 priority=100,in_port=1,ip,ct_state=+trk,actions=controller
1353 priority=100,in_port=2,ip,ct_state=-trk,action=ct(table=0)
1354 priority=100,in_port=2,ip,ct_state=+trk+rel+rpl,action=controller
1355 ])
1356
1357 AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows.txt])
1358
1359 AT_CAPTURE_FILE([ofctl_monitor.log])
1360 AT_CHECK([ovs-ofctl monitor br0 65534 invalid_ttl --detach --no-chdir --pidfile 2> ofctl_monitor.log])
1361
1362 dnl 1. Send an ICMP port unreach reply for port 8738, without any previous request
1363 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) 'f64c473528c9c6f54ecb72db080045c0003d2e8700004001f355ac100004ac1000030303553f0000000045000021317040004011b138ac100003ac10000411112222000d20966369616f0a'])
1364
1365 dnl 2. Send and UDP packet to port 5555
1366 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 1 ct\(commit,table=0\) 'c6f94ecb72dbe64c473528c9080045000021317040004011b138ac100001ac100002a28e15b3000d20966369616f0a'])
1367
1368 dnl 3. Send an ICMP port unreach reply for port 5555, related to the first packet
1369 AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 2 ct\(table=0\) 'e64c473528c9c6f94ecb72db080045c0003d2e8700004001f355ac100002ac1000010303553f0000000045000021317040004011b138ac100001ac100002a28e15b3000d20966369616f0a'])
1370
1371 dnl Check this output. We only see the latter two packets, not the first.
1372 AT_CHECK([cat ofctl_monitor.log], [0], [dnl
1373 NXT_PACKET_IN2 (xid=0x0): cookie=0x0 total_len=47 ct_state=new|trk,in_port=1 (via action) data_len=47 (unbuffered)
1374 udp,vlan_tci=0x0000,dl_src=e6:4c:47:35:28:c9,dl_dst=c6:f9:4e:cb:72:db,nw_src=172.16.0.1,nw_dst=172.16.0.2,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=41614,tp_dst=5555 udp_csum:2096
1375 NXT_PACKET_IN2 (xid=0x0): cookie=0x0 total_len=75 ct_state=rel|rpl|trk,in_port=2 (via action) data_len=75 (unbuffered)
1376 icmp,vlan_tci=0x0000,dl_src=c6:f9:4e:cb:72:db,dl_dst=e6:4c:47:35:28:c9,nw_src=172.16.0.2,nw_dst=172.16.0.1,nw_tos=192,nw_ecn=0,nw_ttl=64,icmp_type=3,icmp_code=3 icmp_csum:553f
1377 ])
1378
1379 OVS_TRAFFIC_VSWITCHD_STOP
1380 AT_CLEANUP
1381
1382 AT_SETUP([conntrack - FTP])
1383 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
1384 CHECK_CONNTRACK()
1385 OVS_TRAFFIC_VSWITCHD_START()
1386
1387 ADD_NAMESPACES(at_ns0, at_ns1)
1388
1389 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1390 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1391
1392 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1393 AT_DATA([flows1.txt], [dnl
1394 table=0,priority=1,action=drop
1395 table=0,priority=10,arp,action=normal
1396 table=0,priority=10,icmp,action=normal
1397 table=0,priority=100,in_port=1,tcp,action=ct(alg=ftp,commit),2
1398 table=0,priority=100,in_port=2,tcp,action=ct(table=1)
1399 table=1,in_port=2,tcp,ct_state=+trk+est,action=1
1400 table=1,in_port=2,tcp,ct_state=+trk+rel,action=1
1401 ])
1402
1403 dnl Similar policy but without allowing all traffic from ns0->ns1.
1404 AT_DATA([flows2.txt], [dnl
1405 table=0,priority=1,action=drop
1406 table=0,priority=10,arp,action=normal
1407 table=0,priority=10,icmp,action=normal
1408
1409 dnl Allow outgoing TCP connections, and treat them as FTP
1410 table=0,priority=100,in_port=1,tcp,action=ct(table=1)
1411 table=1,in_port=1,tcp,ct_state=+trk+new,action=ct(commit,alg=ftp),2
1412 table=1,in_port=1,tcp,ct_state=+trk+est,action=2
1413
1414 dnl Allow incoming FTP data connections and responses to existing connections
1415 table=0,priority=100,in_port=2,tcp,action=ct(table=1)
1416 table=1,in_port=2,tcp,ct_state=+trk+new+rel,action=ct(commit),1
1417 table=1,in_port=2,tcp,ct_state=+trk+est,action=1
1418 table=1,in_port=2,tcp,ct_state=+trk-new+rel,action=1
1419 ])
1420
1421 AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows1.txt])
1422
1423 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp1.pid])
1424 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
1425 OVS_WAIT_UNTIL([ip netns exec at_ns1 netstat -l | grep ftp])
1426
1427 dnl FTP requests from p1->p0 should fail due to network failure.
1428 dnl Try 3 times, in 1 second intervals.
1429 NS_CHECK_EXEC([at_ns1], [wget ftp://10.1.1.1 --no-passive-ftp  -t 3 -T 1 -v -o wget1.log], [4])
1430 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.1)], [0], [dnl
1431 ])
1432
1433 dnl FTP requests from p0->p1 should work fine.
1434 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1435 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1436 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>),helper=ftp
1437 ])
1438
1439 dnl Try the second set of flows.
1440 AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows2.txt])
1441 AT_CHECK([ovs-appctl dpctl/flush-conntrack])
1442
1443 dnl FTP requests from p1->p0 should fail due to network failure.
1444 dnl Try 3 times, in 1 second intervals.
1445 NS_CHECK_EXEC([at_ns1], [wget ftp://10.1.1.1 --no-passive-ftp  -t 3 -T 1 -v -o wget1.log], [4])
1446 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.1)], [0], [dnl
1447 ])
1448
1449 dnl Active FTP requests from p0->p1 should work fine.
1450 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v -o wget0-1.log])
1451 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1452 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>),helper=ftp
1453 tcp,orig=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
1454 ])
1455
1456 AT_CHECK([ovs-appctl dpctl/flush-conntrack])
1457
1458 dnl Passive FTP requests from p0->p1 should work fine.
1459 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0-2.log])
1460 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1461 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
1462 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>),helper=ftp
1463 ])
1464
1465 OVS_TRAFFIC_VSWITCHD_STOP
1466 AT_CLEANUP
1467
1468
1469 AT_SETUP([conntrack - IPv6 FTP])
1470 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
1471 CHECK_CONNTRACK()
1472 OVS_TRAFFIC_VSWITCHD_START()
1473
1474 ADD_NAMESPACES(at_ns0, at_ns1)
1475
1476 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1477 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1478
1479 dnl Allow any traffic from ns0->ns1.
1480 dnl Only allow nd, return traffic from ns1->ns0.
1481 AT_DATA([flows.txt], [dnl
1482 dnl Track all IPv6 traffic and drop the rest.
1483 dnl Allow ICMPv6 both ways.  No commit, so pings will not be tracked.
1484 table=0 priority=100 in_port=1 icmp6, action=2
1485 table=0 priority=100 in_port=2 icmp6, action=1
1486 table=0 priority=10 ip6, action=ct(table=1)
1487 table=0 priority=0 action=drop
1488 dnl
1489 dnl Table 1
1490 dnl
1491 dnl Allow new TCPv6 FTP control connections from port 1.
1492 table=1 in_port=1 ct_state=+new, tcp6, tp_dst=21, action=ct(alg=ftp,commit),2
1493 dnl Allow related TCPv6 connections from port 2.
1494 table=1 in_port=2 ct_state=+new+rel, tcp6, action=ct(commit),1
1495 dnl Allow established TCPv6 connections both ways.
1496 table=1 in_port=1 ct_state=+est, tcp6, action=2
1497 table=1 in_port=2 ct_state=+est, tcp6, action=1
1498 dnl Drop everything else.
1499 table=1 priority=0, action=drop
1500 ])
1501
1502 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1503
1504 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
1505 dnl waiting, we get occasional failures due to the following error:
1506 dnl "connect: Cannot assign requested address"
1507 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2 >/dev/null])
1508
1509 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
1510 OVS_WAIT_UNTIL([ip netns exec at_ns1 netstat -l | grep ftp])
1511
1512 dnl FTP requests from p0->p1 should work fine.
1513 NS_CHECK_EXEC([at_ns0], [wget ftp://[[fc00::2]] -6 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
1514
1515 dnl Discards CLOSE_WAIT and CLOSING
1516 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(fc00::2)], [0], [dnl
1517 tcp,orig=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),reply=(src=fc00::2,dst=fc00::1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>),helper=ftp
1518 tcp,orig=(src=fc00::2,dst=fc00::1,sport=<cleared>,dport=<cleared>),reply=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
1519 ])
1520
1521 OVS_TRAFFIC_VSWITCHD_STOP
1522 AT_CLEANUP
1523
1524
1525 AT_SETUP([conntrack - FTP with multiple expectations])
1526 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
1527 CHECK_CONNTRACK()
1528 OVS_TRAFFIC_VSWITCHD_START()
1529
1530 ADD_NAMESPACES(at_ns0, at_ns1)
1531
1532 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1533 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1534
1535 dnl Dual-firewall, allow all from ns1->ns2, allow established and ftp ns2->ns1.
1536 AT_DATA([flows.txt], [dnl
1537 table=0,priority=1,action=drop
1538 table=0,priority=10,arp,action=normal
1539 table=0,priority=10,icmp,action=normal
1540
1541 dnl Traffic from ns1
1542 table=0,priority=100,in_port=1,tcp,action=ct(table=1,zone=1,alg=ftp)
1543 table=1,in_port=1,tcp,ct_zone=1,ct_state=+trk+new,action=ct(commit,alg=ftp,zone=1),ct(commit,alg=ftp,zone=2),2
1544 table=1,in_port=1,tcp,ct_zone=1,ct_state=+trk+est,action=ct(table=2,zone=2)
1545 table=2,in_port=1,tcp,ct_zone=2,ct_state=+trk+est,action=2
1546
1547 dnl Traffic from ns2
1548 table=0,priority=100,in_port=2,tcp,action=ct(table=1,alg=ftp,zone=2)
1549 table=1,in_port=2,tcp,ct_zone=2,ct_state=+trk+rel,action=ct(commit,zone=2),ct(commit,zone=1),1
1550 table=1,in_port=2,tcp,ct_zone=2,ct_state=+trk+est,action=ct(table=2,zone=1)
1551 table=2,in_port=2,tcp,ct_zone=1,ct_state=+trk+rel,action=ct(commit,zone=2),ct(commit,zone=1),1
1552 table=2,in_port=2,tcp,ct_zone=1,ct_state=+trk+est,action=1
1553 ])
1554
1555 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1556
1557 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp1.pid])
1558 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
1559
1560 dnl FTP requests from p1->p0 should fail due to network failure.
1561 dnl Try 3 times, in 1 second intervals.
1562 NS_CHECK_EXEC([at_ns1], [wget ftp://10.1.1.1 --no-passive-ftp  -t 3 -T 1 -v -o wget1.log], [4])
1563 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.1)], [0], [dnl
1564 ])
1565
1566 dnl Active FTP requests from p0->p1 should work fine.
1567 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1568 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1569 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>),helper=ftp
1570 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>),helper=ftp
1571 tcp,orig=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
1572 tcp,orig=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>)
1573 ])
1574
1575 AT_CHECK([ovs-appctl dpctl/flush-conntrack])
1576
1577 dnl Passive FTP requests from p0->p1 should work fine.
1578 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
1579 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
1580 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
1581 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>),helper=ftp
1582 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>)
1583 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=2,protoinfo=(state=<cleared>),helper=ftp
1584 ])
1585
1586 OVS_TRAFFIC_VSWITCHD_STOP
1587 AT_CLEANUP
1588
1589 AT_SETUP([conntrack - IPv4 fragmentation ])
1590 CHECK_CONNTRACK()
1591 OVS_TRAFFIC_VSWITCHD_START()
1592
1593 ADD_NAMESPACES(at_ns0, at_ns1)
1594
1595 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1596 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1597
1598 dnl Sending ping through conntrack
1599 AT_DATA([flows.txt], [dnl
1600 priority=1,action=drop
1601 priority=10,arp,action=normal
1602 priority=100,in_port=1,icmp,action=ct(commit,zone=9),2
1603 priority=100,in_port=2,ct_state=-trk,icmp,action=ct(table=0,zone=9)
1604 priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1
1605 ])
1606
1607 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1608
1609 dnl Ipv4 fragmentation connectivity check.
1610 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1611 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1612 ])
1613
1614 dnl Ipv4 larger fragmentation connectivity check.
1615 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1616 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1617 ])
1618
1619 OVS_TRAFFIC_VSWITCHD_STOP
1620 AT_CLEANUP
1621
1622 AT_SETUP([conntrack - IPv4 fragmentation expiry])
1623 CHECK_CONNTRACK()
1624 OVS_TRAFFIC_VSWITCHD_START()
1625
1626 ADD_NAMESPACES(at_ns0, at_ns1)
1627
1628 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1629 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1630
1631 AT_DATA([flows.txt], [dnl
1632 priority=1,action=drop
1633 priority=10,arp,action=normal
1634
1635 dnl Only allow non-fragmented messages and 1st fragments of each message
1636 priority=100,in_port=1,icmp,ip_frag=no,action=ct(commit,zone=9),2
1637 priority=100,in_port=1,icmp,ip_frag=firstaction=ct(commit,zone=9),2
1638 priority=100,in_port=2,ct_state=-trk,icmp,action=ct(table=0,zone=9)
1639 priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1
1640 ])
1641
1642 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1643
1644 dnl Ipv4 fragmentation connectivity check.
1645 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 1 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl
1646 7 packets transmitted, 0 received, 100% packet loss, time 0ms
1647 ])
1648
1649 OVS_TRAFFIC_VSWITCHD_STOP
1650 AT_CLEANUP
1651
1652 AT_SETUP([conntrack - IPv4 fragmentation + vlan])
1653 CHECK_CONNTRACK()
1654 OVS_TRAFFIC_VSWITCHD_START()
1655
1656 ADD_NAMESPACES(at_ns0, at_ns1)
1657
1658 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1659 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1660 ADD_VLAN(p0, at_ns0, 100, "10.2.2.1/24")
1661 ADD_VLAN(p1, at_ns1, 100, "10.2.2.2/24")
1662
1663 dnl Sending ping through conntrack
1664 AT_DATA([flows.txt], [dnl
1665 priority=1,action=drop
1666 priority=10,arp,action=normal
1667 priority=100,in_port=1,icmp,action=ct(commit,zone=9),2
1668 priority=100,in_port=2,ct_state=-trk,icmp,action=ct(table=0,zone=9)
1669 priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1
1670 ])
1671
1672 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1673
1674 dnl Ipv4 fragmentation connectivity check.
1675 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
1676 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1677 ])
1678
1679 dnl Ipv4 larger fragmentation connectivity check.
1680 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl
1681 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1682 ])
1683
1684 OVS_TRAFFIC_VSWITCHD_STOP
1685 AT_CLEANUP
1686
1687 AT_SETUP([conntrack - IPv6 fragmentation])
1688 CHECK_CONNTRACK()
1689 OVS_TRAFFIC_VSWITCHD_START()
1690
1691 ADD_NAMESPACES(at_ns0, at_ns1)
1692
1693 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1694 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1695
1696 dnl Sending ping through conntrack
1697 AT_DATA([flows.txt], [dnl
1698 priority=1,action=drop
1699 priority=10,in_port=1,ipv6,action=ct(commit,zone=9),2
1700 priority=10,in_port=2,ct_state=-trk,ipv6,action=ct(table=0,zone=9)
1701 priority=10,in_port=2,ct_state=+trk+est-new,ipv6,action=1
1702 priority=100,icmp6,icmp_type=135,action=normal
1703 priority=100,icmp6,icmp_type=136,action=normal
1704 ])
1705
1706 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1707
1708 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
1709 dnl waiting, we get occasional failures due to the following error:
1710 dnl "connect: Cannot assign requested address"
1711 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
1712
1713 dnl Ipv6 fragmentation connectivity check.
1714 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1715 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1716 ])
1717
1718 dnl Ipv6 larger fragmentation connectivity check.
1719 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1720 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1721 ])
1722
1723 OVS_TRAFFIC_VSWITCHD_STOP
1724 AT_CLEANUP
1725
1726 AT_SETUP([conntrack - IPv6 fragmentation expiry])
1727 CHECK_CONNTRACK()
1728 OVS_TRAFFIC_VSWITCHD_START()
1729
1730 ADD_NAMESPACES(at_ns0, at_ns1)
1731
1732 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1733 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1734
1735 AT_DATA([flows.txt], [dnl
1736 priority=1,action=drop
1737
1738 dnl Only allow non-fragmented messages and 1st fragments of each message
1739 priority=10,in_port=1,ipv6,ip_frag=first,action=ct(commit,zone=9),2
1740 priority=10,in_port=1,ipv6,ip_frag=no,action=ct(commit,zone=9),2
1741 priority=10,in_port=2,ct_state=-trk,ipv6,action=ct(table=0,zone=9)
1742 priority=10,in_port=2,ct_state=+trk+est-new,ipv6,action=1
1743
1744 dnl Neighbour Discovery
1745 priority=100,icmp6,icmp_type=135,action=normal
1746 priority=100,icmp6,icmp_type=136,action=normal
1747 ])
1748
1749 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1750
1751 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
1752 dnl waiting, we get occasional failures due to the following error:
1753 dnl "connect: Cannot assign requested address"
1754 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
1755
1756 dnl Send an IPv6 fragment. Some time later, it should expire.
1757 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 1 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1758 7 packets transmitted, 0 received, 100% packet loss, time 0ms
1759 ])
1760
1761 dnl At this point, the kernel will either crash or everything is OK.
1762
1763 OVS_TRAFFIC_VSWITCHD_STOP
1764 AT_CLEANUP
1765
1766 AT_SETUP([conntrack - IPv6 fragmentation + vlan])
1767 CHECK_CONNTRACK()
1768 OVS_TRAFFIC_VSWITCHD_START()
1769
1770 ADD_NAMESPACES(at_ns0, at_ns1)
1771
1772 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
1773 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
1774
1775 ADD_VLAN(p0, at_ns0, 100, "fc00:1::3/96")
1776 ADD_VLAN(p1, at_ns1, 100, "fc00:1::4/96")
1777
1778 dnl Sending ping through conntrack
1779 AT_DATA([flows.txt], [dnl
1780 priority=1,action=drop
1781 priority=10,in_port=1,ipv6,action=ct(commit,zone=9),2
1782 priority=10,in_port=2,ct_state=-trk,ipv6,action=ct(table=0,zone=9)
1783 priority=10,in_port=2,ct_state=+trk+est-new,ipv6,action=1
1784 priority=100,icmp6,icmp_type=135,action=normal
1785 priority=100,icmp6,icmp_type=136,action=normal
1786 ])
1787
1788 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1789
1790 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
1791 dnl waiting, we get occasional failures due to the following error:
1792 dnl "connect: Cannot assign requested address"
1793 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
1794
1795 dnl Ipv4 fragmentation connectivity check.
1796 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00:1::4 | FORMAT_PING], [0], [dnl
1797 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1798 ])
1799
1800 dnl Ipv4 larger fragmentation connectivity check.
1801 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00:1::4 | FORMAT_PING], [0], [dnl
1802 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1803 ])
1804
1805 OVS_TRAFFIC_VSWITCHD_STOP
1806 AT_CLEANUP
1807
1808 AT_SETUP([conntrack - Fragmentation over vxlan])
1809 OVS_CHECK_VXLAN()
1810 CHECK_CONNTRACK()
1811
1812 OVS_TRAFFIC_VSWITCHD_START()
1813 ADD_BR([br-underlay])
1814 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
1815
1816 ADD_NAMESPACES(at_ns0)
1817
1818 dnl Sending ping through conntrack
1819 AT_DATA([flows.txt], [dnl
1820 priority=1,action=drop
1821 priority=10,arp,action=normal
1822 priority=100,in_port=1,icmp,action=ct(commit,zone=9),LOCAL
1823 priority=100,in_port=LOCAL,icmp,action=ct(table=1,zone=9)
1824 table=1,priority=100,in_port=LOCAL,ct_state=+trk+est,icmp,action=1
1825 ])
1826
1827 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1828
1829 dnl Set up underlay link from host into the namespace using veth pair.
1830 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
1831 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
1832 AT_CHECK([ip link set dev br-underlay up])
1833
1834 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
1835 dnl linux device inside the namespace.
1836 ADD_OVS_TUNNEL([vxlan], [br0], [at_vxlan0], [172.31.1.1], [10.1.1.100/24])
1837 ADD_NATIVE_TUNNEL([vxlan], [at_vxlan1], [at_ns0], [172.31.1.100], [10.1.1.1/24],
1838                   [id 0 dstport 4789])
1839
1840 dnl First, check the underlay
1841 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
1842 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1843 ])
1844
1845 dnl Okay, now check the overlay with different packet sizes
1846 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
1847 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1848 ])
1849 NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
1850 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1851 ])
1852 NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.100 | FORMAT_PING], [0], [dnl
1853 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1854 ])
1855
1856 OVS_TRAFFIC_VSWITCHD_STOP
1857 AT_CLEANUP
1858
1859 AT_SETUP([conntrack - IPv6 Fragmentation over vxlan])
1860 OVS_CHECK_VXLAN()
1861 CHECK_CONNTRACK()
1862
1863 OVS_TRAFFIC_VSWITCHD_START()
1864 ADD_BR([br-underlay])
1865 AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
1866
1867 ADD_NAMESPACES(at_ns0)
1868
1869 dnl Sending ping through conntrack
1870 AT_DATA([flows.txt], [dnl
1871 priority=1,action=drop
1872 priority=100,in_port=1,ipv6,action=ct(commit,zone=9),LOCAL
1873 priority=100,in_port=LOCAL,ipv6,action=ct(table=1,zone=9)
1874 table=1,priority=100,in_port=LOCAL,ct_state=+trk+est,ipv6,action=1
1875
1876 dnl Neighbour Discovery
1877 priority=1000,icmp6,icmp_type=135,action=normal
1878 priority=1000,icmp6,icmp_type=136,action=normal
1879 ])
1880
1881 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1882
1883 dnl Set up underlay link from host into the namespace using veth pair.
1884 ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24")
1885 AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
1886 AT_CHECK([ip link set dev br-underlay up])
1887
1888 dnl Set up tunnel endpoints on OVS outside the namespace and with a native
1889 dnl linux device inside the namespace.
1890 ADD_OVS_TUNNEL([vxlan], [br0], [at_vxlan0], [172.31.1.1], ["fc00::2/96"])
1891 ADD_NATIVE_TUNNEL([vxlan], [at_vxlan1], [at_ns0], [172.31.1.100], ["fc00::1/96"],
1892                   [id 0 dstport 4789])
1893
1894 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
1895 dnl waiting, we get occasional failures due to the following error:
1896 dnl "connect: Cannot assign requested address"
1897 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
1898
1899 dnl First, check the underlay
1900 NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 172.31.1.100 | FORMAT_PING], [0], [dnl
1901 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1902 ])
1903
1904 dnl Okay, now check the overlay with different packet sizes
1905 NS_CHECK_EXEC([at_ns0], [ping6 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1906 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1907 ])
1908 NS_CHECK_EXEC([at_ns0], [ping6 -s 1600 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1909 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1910 ])
1911 NS_CHECK_EXEC([at_ns0], [ping6 -s 3200 -q -c 3 -i 0.3 -w 2 fc00::2 | FORMAT_PING], [0], [dnl
1912 3 packets transmitted, 3 received, 0% packet loss, time 0ms
1913 ])
1914
1915 OVS_TRAFFIC_VSWITCHD_STOP
1916 AT_CLEANUP
1917
1918 AT_SETUP([conntrack - resubmit to ct multiple times])
1919 CHECK_CONNTRACK()
1920
1921 OVS_TRAFFIC_VSWITCHD_START(
1922    [set-fail-mode br0 secure -- ])
1923
1924 ADD_NAMESPACES(at_ns0, at_ns1)
1925
1926 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1927 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1928
1929 AT_DATA([flows.txt], [dnl
1930 table=0,priority=150,arp,action=normal
1931 table=0,priority=100,ip,in_port=1,action=resubmit(,1),resubmit(,2)
1932
1933 table=1,priority=100,ip,action=ct(table=3)
1934 table=2,priority=100,ip,action=ct(table=3)
1935
1936 table=3,ip,action=drop
1937 ])
1938
1939 AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
1940
1941 NS_CHECK_EXEC([at_ns0], [ping -q -c 1 10.1.1.2 | FORMAT_PING], [0], [dnl
1942 1 packets transmitted, 0 received, 100% packet loss, time 0ms
1943 ])
1944
1945 AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
1946  n_packets=1, n_bytes=98, priority=100,ip,in_port=1 actions=resubmit(,1),resubmit(,2)
1947  n_packets=2, n_bytes=84, priority=150,arp actions=NORMAL
1948  table=1, n_packets=1, n_bytes=98, priority=100,ip actions=ct(table=3)
1949  table=2, n_packets=1, n_bytes=98, priority=100,ip actions=ct(table=3)
1950  table=3, n_packets=2, n_bytes=196, ip actions=drop
1951 NXST_FLOW reply:
1952 ])
1953
1954 OVS_TRAFFIC_VSWITCHD_STOP
1955 AT_CLEANUP
1956
1957
1958 AT_SETUP([conntrack - simple SNAT])
1959 CHECK_CONNTRACK()
1960 OVS_TRAFFIC_VSWITCHD_START()
1961
1962 ADD_NAMESPACES(at_ns0, at_ns1)
1963
1964 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
1965 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
1966 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
1967
1968 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
1969 AT_DATA([flows.txt], [dnl
1970 in_port=1,ip,action=ct(commit,zone=1,nat(src=10.1.1.240-10.1.1.255)),2
1971 in_port=2,ct_state=-trk,ip,action=ct(table=0,zone=1,nat)
1972 in_port=2,ct_state=+trk,ct_zone=1,ip,action=1
1973 dnl
1974 dnl ARP
1975 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
1976 priority=10 arp action=normal
1977 priority=0,action=drop
1978 dnl
1979 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
1980 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
1981 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
1982 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
1983 dnl TPA IP in reg2.
1984 dnl Swaps the fields of the ARP message to turn a query to a response.
1985 table=10 priority=100 arp xreg0=0 action=normal
1986 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
1987 table=10 priority=0 action=drop
1988 ])
1989
1990 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
1991
1992 dnl HTTP requests from p0->p1 should work fine.
1993 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
1994 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
1995
1996 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
1997 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
1998 ])
1999
2000 OVS_TRAFFIC_VSWITCHD_STOP
2001 AT_CLEANUP
2002
2003
2004 AT_SETUP([conntrack - SNAT with port range])
2005 CHECK_CONNTRACK()
2006 OVS_TRAFFIC_VSWITCHD_START()
2007
2008 ADD_NAMESPACES(at_ns0, at_ns1)
2009
2010 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
2011 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2012 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
2013
2014 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
2015 AT_DATA([flows.txt], [dnl
2016 in_port=1,tcp,action=ct(commit,zone=1,nat(src=10.1.1.240-10.1.1.255:34567-34568,random)),2
2017 in_port=2,ct_state=-trk,tcp,tp_dst=34567,action=ct(table=0,zone=1,nat)
2018 in_port=2,ct_state=-trk,tcp,tp_dst=34568,action=ct(table=0,zone=1,nat)
2019 in_port=2,ct_state=+trk,ct_zone=1,tcp,action=1
2020 dnl
2021 dnl ARP
2022 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2023 priority=10 arp action=normal
2024 priority=0,action=drop
2025 dnl
2026 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2027 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2028 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2029 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2030 dnl TPA IP in reg2.
2031 dnl Swaps the fields of the ARP message to turn a query to a response.
2032 table=10 priority=100 arp xreg0=0 action=normal
2033 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2034 table=10 priority=0 action=drop
2035 ])
2036
2037 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2038
2039 dnl HTTP requests from p0->p1 should work fine.
2040 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
2041 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
2042
2043 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
2044 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
2045 ])
2046
2047 OVS_TRAFFIC_VSWITCHD_STOP
2048 AT_CLEANUP
2049
2050
2051 AT_SETUP([conntrack - more complex SNAT])
2052 CHECK_CONNTRACK()
2053 OVS_TRAFFIC_VSWITCHD_START()
2054
2055 ADD_NAMESPACES(at_ns0, at_ns1)
2056
2057 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
2058 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2059 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
2060
2061 AT_DATA([flows.txt], [dnl
2062 dnl Track all IP traffic, NAT existing connections.
2063 priority=100 ip action=ct(table=1,zone=1,nat)
2064 dnl
2065 dnl Allow ARP, but generate responses for NATed addresses
2066 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2067 priority=10 arp action=normal
2068 priority=0 action=drop
2069 dnl
2070 dnl Allow any traffic from ns0->ns1. SNAT ns0 to 10.1.1.240-10.1.1.255
2071 table=1 priority=100 in_port=1 ip ct_state=+trk+new-est action=ct(commit,zone=1,nat(src=10.1.1.240-10.1.1.255)),2
2072 table=1 priority=100 in_port=1 ip ct_state=+trk-new+est action=2
2073 dnl Only allow established traffic from ns1->ns0.
2074 table=1 priority=100 in_port=2 ip ct_state=+trk-new+est action=1
2075 table=1 priority=0 action=drop
2076 dnl
2077 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2078 table=8 priority=100 reg2=0x0a0101f0/0xfffffff0 action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2079 dnl Zero result means not found.
2080 table=8 priority=0 action=load:0->OXM_OF_PKT_REG0[[]]
2081 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2082 dnl ARP TPA IP in reg2.
2083 table=10 priority=100 arp xreg0=0 action=normal
2084 dnl Swaps the fields of the ARP message to turn a query to a response.
2085 table=10 priority=10 arp arp_op=1 action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2086 table=10 priority=0 action=drop
2087 ])
2088
2089 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2090
2091 dnl HTTP requests from p0->p1 should work fine.
2092 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
2093 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
2094
2095 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
2096 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
2097 ])
2098
2099 OVS_TRAFFIC_VSWITCHD_STOP
2100 AT_CLEANUP
2101
2102 AT_SETUP([conntrack - simple DNAT])
2103 CHECK_CONNTRACK()
2104 OVS_TRAFFIC_VSWITCHD_START()
2105
2106 ADD_NAMESPACES(at_ns0, at_ns1)
2107
2108 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
2109 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
2110 NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address 80:88:88:88:88:88])
2111
2112 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
2113 AT_DATA([flows.txt], [dnl
2114 priority=100 in_port=1,ip,nw_dst=10.1.1.64,action=ct(zone=1,nat(dst=10.1.1.2),commit),2
2115 priority=10 in_port=1,ip,action=ct(commit,zone=1),2
2116 priority=100 in_port=2,ct_state=-trk,ip,action=ct(table=0,nat,zone=1)
2117 priority=100 in_port=2,ct_state=+trk+est,ct_zone=1,ip,action=1
2118 dnl
2119 dnl ARP
2120 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2121 priority=10 arp action=normal
2122 priority=0,action=drop
2123 dnl
2124 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2125 table=8,reg2=0x0a010140,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2126 dnl Zero result means not found.
2127 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2128 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2129 dnl TPA IP in reg2.
2130 table=10 priority=100 arp xreg0=0 action=normal
2131 dnl Swaps the fields of the ARP message to turn a query to a response.
2132 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2133 table=10 priority=0 action=drop
2134 ])
2135
2136 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2137
2138 dnl Should work with the virtual IP address through NAT
2139 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
2140 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.64 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
2141
2142 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.64)], [0], [dnl
2143 tcp,orig=(src=10.1.1.1,dst=10.1.1.64,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
2144 ])
2145
2146 dnl Should work with the assigned IP address as well
2147 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
2148
2149 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
2150 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
2151 ])
2152
2153 OVS_TRAFFIC_VSWITCHD_STOP
2154 AT_CLEANUP
2155
2156 AT_SETUP([conntrack - more complex DNAT])
2157 CHECK_CONNTRACK()
2158 OVS_TRAFFIC_VSWITCHD_START()
2159
2160 ADD_NAMESPACES(at_ns0, at_ns1)
2161
2162 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
2163 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
2164 NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address 80:88:88:88:88:88])
2165
2166 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
2167 AT_DATA([flows.txt], [dnl
2168 dnl Track all IP traffic
2169 table=0 priority=100 ip action=ct(table=1,zone=1,nat)
2170 dnl
2171 dnl Allow ARP, but generate responses for NATed addresses
2172 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2173 table=0 priority=10 arp action=normal
2174 table=0 priority=0 action=drop
2175 dnl
2176 dnl Allow any IP traffic from ns0->ns1. DNAT ns0 from 10.1.1.64 to 10.1.1.2
2177 table=1 priority=100 in_port=1 ct_state=+new ip nw_dst=10.1.1.64 action=ct(zone=1,nat(dst=10.1.1.2),commit),2
2178 table=1 priority=10 in_port=1 ct_state=+new ip action=ct(commit,zone=1),2
2179 table=1 priority=100 in_port=1 ct_state=+est ct_zone=1 action=2
2180 dnl Only allow established traffic from ns1->ns0.
2181 table=1 priority=100 in_port=2 ct_state=+est ct_zone=1 action=1
2182 table=1 priority=0 action=drop
2183 dnl
2184 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2185 table=8,reg2=0x0a010140,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2186 dnl Zero result means not found.
2187 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2188 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2189 dnl TPA IP in reg2.
2190 table=10 priority=100 arp xreg0=0 action=normal
2191 dnl Swaps the fields of the ARP message to turn a query to a response.
2192 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2193 table=10 priority=0 action=drop
2194 ])
2195
2196 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2197
2198 dnl Should work with the virtual IP address through NAT
2199 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py]], [http0.pid])
2200 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.64 -t 5 -T 1 --retry-connrefused -v -o wget0.log])
2201
2202 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.64)], [0], [dnl
2203 tcp,orig=(src=10.1.1.1,dst=10.1.1.64,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
2204 ])
2205
2206 dnl Should work with the assigned IP address as well
2207 NS_CHECK_EXEC([at_ns0], [wget 10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o wget0.log])
2208
2209 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
2210 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),zone=1,protoinfo=(state=<cleared>)
2211 ])
2212
2213 OVS_TRAFFIC_VSWITCHD_STOP
2214 AT_CLEANUP
2215
2216 AT_SETUP([conntrack - ICMP related with NAT])
2217 CHECK_CONNTRACK()
2218 OVS_TRAFFIC_VSWITCHD_START()
2219
2220 ADD_NAMESPACES(at_ns0, at_ns1)
2221
2222 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
2223 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2224 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
2225
2226 dnl Allow UDP traffic from ns0->ns1. Only allow related ICMP responses back.
2227 dnl Make sure ICMP responses are reverse-NATted.
2228 AT_DATA([flows.txt], [dnl
2229 in_port=1,udp,action=ct(commit,nat(src=10.1.1.240-10.1.1.255),exec(set_field:1->ct_mark)),2
2230 in_port=2,icmp,ct_state=-trk,action=ct(table=0,nat)
2231 in_port=2,icmp,nw_dst=10.1.1.1,ct_state=+trk+rel,ct_mark=1,action=1
2232 dnl
2233 dnl ARP
2234 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2235 priority=10 arp action=normal
2236 priority=0,action=drop
2237 dnl
2238 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2239 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2240 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2241 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2242 dnl TPA IP in reg2.
2243 dnl Swaps the fields of the ARP message to turn a query to a response.
2244 table=10 priority=100 arp xreg0=0 action=normal
2245 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2246 table=10 priority=0 action=drop
2247 ])
2248
2249 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2250
2251 dnl UDP packets from ns0->ns1 should solicit "destination unreachable" response.
2252 NS_CHECK_EXEC([at_ns0], [bash -c "echo a | nc $NC_EOF_OPT -u 10.1.1.2 10000"])
2253
2254 AT_CHECK([ovs-appctl revalidator/purge], [0])
2255 AT_CHECK([ovs-ofctl -O OpenFlow15 dump-flows br0 | ofctl_strip | sort | grep -v drop], [0], [dnl
2256  n_packets=1, n_bytes=42, priority=10,arp actions=NORMAL
2257  n_packets=1, n_bytes=44, udp,in_port=1 actions=ct(commit,nat(src=10.1.1.240-10.1.1.255),exec(set_field:0x1->ct_mark)),output:2
2258  n_packets=1, n_bytes=72, ct_state=+rel+trk,ct_mark=0x1,icmp,in_port=2,nw_dst=10.1.1.1 actions=output:1
2259  n_packets=1, n_bytes=72, ct_state=-trk,icmp,in_port=2 actions=ct(table=0,nat)
2260  n_packets=2, n_bytes=84, priority=100,arp,arp_op=1 actions=move:NXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2261  table=10, n_packets=1, n_bytes=42, priority=10,arp,arp_op=1 actions=set_field:2->arp_op,move:NXM_NX_ARP_SHA[[]]->NXM_NX_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_NX_ARP_SHA[[]],move:NXM_OF_ARP_SPA[[]]->NXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->NXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],set_field:0->in_port,output:NXM_NX_REG3[[0..15]]
2262  table=10, n_packets=1, n_bytes=42, priority=100,arp,reg0=0,reg1=0 actions=NORMAL
2263  table=8, n_packets=1, n_bytes=42, priority=0 actions=set_field:0->xreg0
2264  table=8, n_packets=1, n_bytes=42, reg2=0xa0101f0/0xfffffff0 actions=set_field:0x808888888888->xreg0
2265 OFPST_FLOW reply (OF1.5):
2266 ])
2267
2268 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2) | sed -e 's/dst=10.1.1.2[[45]][[0-9]]/dst=10.1.1.2XX/'], [0], [dnl
2269 udp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.2XX,sport=<cleared>,dport=<cleared>),mark=1
2270 ])
2271
2272 OVS_TRAFFIC_VSWITCHD_STOP
2273 AT_CLEANUP
2274
2275
2276 AT_SETUP([conntrack - FTP with NAT])
2277 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
2278 CHECK_CONNTRACK()
2279
2280 OVS_TRAFFIC_VSWITCHD_START()
2281
2282 ADD_NAMESPACES(at_ns0, at_ns1)
2283
2284 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
2285 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2286 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
2287
2288 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
2289
2290 AT_DATA([flows.txt], [dnl
2291 dnl track all IP traffic, de-mangle non-NEW connections
2292 table=0 in_port=1, ip, action=ct(table=1,nat)
2293 table=0 in_port=2, ip, action=ct(table=2,nat)
2294 dnl
2295 dnl ARP
2296 dnl
2297 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2298 table=0 priority=10 arp action=normal
2299 table=0 priority=0 action=drop
2300 dnl
2301 dnl Table 1: port 1 -> 2
2302 dnl
2303 dnl Allow new FTP connections. These need to be commited.
2304 table=1 ct_state=+new, tcp, tp_dst=21, nw_src=10.1.1.1, action=ct(alg=ftp,commit,nat(src=10.1.1.240)),2
2305 dnl Allow established TCP connections, make sure they are NATted already.
2306 table=1 ct_state=+est, tcp, nw_src=10.1.1.240,     action=2
2307 dnl
2308 dnl Table 1: droppers
2309 dnl
2310 table=1 priority=10, tcp, action=drop
2311 table=1 priority=0,action=drop
2312 dnl
2313 dnl Table 2: port 2 -> 1
2314 dnl
2315 dnl Allow established TCP connections, make sure they are reverse NATted
2316 table=2 ct_state=+est, tcp, nw_dst=10.1.1.1, action=1
2317 dnl Allow (new) related (data) connections.  These need to be commited.
2318 table=2 ct_state=+new+rel, tcp, nw_dst=10.1.1.240, action=ct(commit,nat),1
2319 dnl Allow related ICMP packets, make sure they are reverse NATted
2320 table=2 ct_state=+rel, icmp, nw_dst=10.1.1.1, action=1
2321 dnl
2322 dnl Table 2: droppers
2323 dnl
2324 table=2 priority=10, tcp, action=drop
2325 table=2 priority=0, action=drop
2326 dnl
2327 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2328 dnl
2329 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2330 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2331 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2332 dnl TPA IP in reg2.
2333 dnl Swaps the fields of the ARP message to turn a query to a response.
2334 table=10 priority=100 arp xreg0=0 action=normal
2335 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2336 table=10 priority=0 action=drop
2337 ])
2338
2339 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2340
2341 dnl NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp1.pid])
2342 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
2343 OVS_WAIT_UNTIL([ip netns exec at_ns1 netstat -l | grep ftp])
2344
2345 dnl FTP requests from p0->p1 should work fine.
2346 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -4 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
2347
2348 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
2349 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>),helper=ftp
2350 tcp,orig=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
2351 ])
2352
2353 OVS_TRAFFIC_VSWITCHD_STOP
2354 AT_CLEANUP
2355
2356
2357 AT_SETUP([conntrack - FTP with NAT 2])
2358 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
2359 CHECK_CONNTRACK()
2360 OVS_TRAFFIC_VSWITCHD_START()
2361
2362 ADD_NAMESPACES(at_ns0, at_ns1)
2363
2364 ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24")
2365 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2366 ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24")
2367
2368 dnl Allow any traffic from ns0->ns1.
2369 dnl Only allow nd, return traffic from ns1->ns0.
2370 AT_DATA([flows.txt], [dnl
2371 dnl track all IP traffic (this includes a helper call to non-NEW packets.)
2372 table=0 ip, action=ct(table=1)
2373 dnl
2374 dnl ARP
2375 dnl
2376 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2377 table=0 priority=10 arp action=normal
2378 table=0 priority=0 action=drop
2379 dnl
2380 dnl Table 1
2381 dnl
2382 dnl Allow new FTP connections. These need to be commited.
2383 dnl This does helper for new packets.
2384 table=1 in_port=1 ct_state=+new, tcp, tp_dst=21, action=ct(alg=ftp,commit,nat(src=10.1.1.240)),2
2385 dnl Allow and NAT established TCP connections
2386 table=1 in_port=1 ct_state=+est, tcp,     action=ct(nat),2
2387 table=1 in_port=2 ct_state=+est, tcp,     action=ct(nat),1
2388 dnl Allow and NAT (new) related active (data) connections.
2389 dnl These need to be commited.
2390 table=1 in_port=2 ct_state=+new+rel, tcp, action=ct(commit,nat),1
2391 dnl Allow related ICMP packets.
2392 table=1 in_port=2 ct_state=+rel, icmp,    action=ct(nat),1
2393 dnl Drop everything else.
2394 table=1 priority=0, action=drop
2395 dnl
2396 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2397 dnl
2398 table=8,reg2=0x0a0101f0/0xfffffff0,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2399 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2400 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2401 dnl TPA IP in reg2.
2402 dnl Swaps the fields of the ARP message to turn a query to a response.
2403 table=10 priority=100 arp xreg0=0 action=normal
2404 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2405 table=10 priority=0 action=drop
2406 ])
2407
2408 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2409
2410 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
2411 OVS_WAIT_UNTIL([ip netns exec at_ns1 netstat -l | grep ftp])
2412
2413 dnl FTP requests from p0->p1 should work fine.
2414 NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -4 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
2415
2416 dnl Discards CLOSE_WAIT and CLOSING
2417 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl
2418 tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>),helper=ftp
2419 tcp,orig=(src=10.1.1.2,dst=10.1.1.240,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.1,dst=10.1.1.2,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
2420 ])
2421
2422 OVS_TRAFFIC_VSWITCHD_STOP
2423 AT_CLEANUP
2424
2425 AT_SETUP([conntrack - IPv6 HTTP with NAT])
2426 CHECK_CONNTRACK()
2427 OVS_TRAFFIC_VSWITCHD_START()
2428
2429 ADD_NAMESPACES(at_ns0, at_ns1)
2430
2431 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
2432 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2433 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
2434 NS_CHECK_EXEC([at_ns1], [ip -6 neigh add fc00::240 lladdr 80:88:88:88:88:88 dev p1])
2435
2436 dnl Allow any traffic from ns0->ns1. Only allow nd, return traffic from ns1->ns0.
2437 AT_DATA([flows.txt], [dnl
2438 priority=1,action=drop
2439 priority=10,icmp6,action=normal
2440 priority=100,in_port=1,ip6,action=ct(commit,nat(src=fc00::240)),2
2441 priority=100,in_port=2,ct_state=-trk,ip6,action=ct(nat,table=0)
2442 priority=100,in_port=2,ct_state=+trk+est,ip6,action=1
2443 priority=200,in_port=2,ct_state=+trk+new,icmp6,icmpv6_code=0,icmpv6_type=135,nd_target=fc00::240,action=ct(commit,nat(dst=fc00::1)),1
2444 ])
2445
2446 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2447
2448 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
2449 dnl waiting, we get occasional failures due to the following error:
2450 dnl "connect: Cannot assign requested address"
2451 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2])
2452
2453 dnl HTTP requests from ns0->ns1 should work fine.
2454 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py http6]], [http0.pid])
2455
2456 NS_CHECK_EXEC([at_ns0], [wget http://[[fc00::2]] -t 3 -T 1 --retry-connrefused -v -o wget0.log])
2457
2458 dnl HTTP requests from ns1->ns0 should fail due to network failure.
2459 dnl Try 3 times, in 1 second intervals.
2460 NETNS_DAEMONIZE([at_ns0], [[$PYTHON $srcdir/test-l7.py http6]], [http1.pid])
2461 NS_CHECK_EXEC([at_ns1], [wget http://[[fc00::1]] -t 3 -T 1 -v -o wget1.log], [4])
2462
2463 OVS_TRAFFIC_VSWITCHD_STOP
2464 AT_CLEANUP
2465
2466
2467 AT_SETUP([conntrack - IPv6 FTP with NAT])
2468 AT_SKIP_IF([test $HAVE_PYFTPDLIB = no])
2469 CHECK_CONNTRACK()
2470 OVS_TRAFFIC_VSWITCHD_START()
2471
2472 ADD_NAMESPACES(at_ns0, at_ns1)
2473
2474 ADD_VETH(p0, at_ns0, br0, "fc00::1/96")
2475 NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address 80:88:88:88:88:88])
2476 ADD_VETH(p1, at_ns1, br0, "fc00::2/96")
2477 dnl Would be nice if NAT could translate neighbor discovery messages, too.
2478 NS_CHECK_EXEC([at_ns1], [ip -6 neigh add fc00::240 lladdr 80:88:88:88:88:88 dev p1])
2479
2480 dnl Allow any traffic from ns0->ns1.
2481 dnl Only allow nd, return traffic from ns1->ns0.
2482 AT_DATA([flows.txt], [dnl
2483 dnl Allow other ICMPv6 both ways (without commit).
2484 table=1 priority=100 in_port=1 icmp6, action=2
2485 table=1 priority=100 in_port=2 icmp6, action=1
2486 dnl track all IPv6 traffic (this includes NAT & help to non-NEW packets.)
2487 table=0 priority=10 ip6, action=ct(nat,table=1)
2488 table=0 priority=0 action=drop
2489 dnl
2490 dnl Table 1
2491 dnl
2492 dnl Allow new TCPv6 FTP control connections.
2493 table=1 in_port=1 ct_state=+new tcp6 ipv6_src=fc00::1 tp_dst=21  action=ct(alg=ftp,commit,nat(src=fc00::240)),2
2494 dnl Allow related TCPv6 connections from port 2 to the NATted address.
2495 table=1 in_port=2 ct_state=+new+rel tcp6 ipv6_dst=fc00::240 action=ct(commit,nat),1
2496 dnl Allow established TCPv6 connections both ways, enforce NATting
2497 table=1 in_port=1 ct_state=+est tcp6 ipv6_src=fc00::240   action=2
2498 table=1 in_port=2 ct_state=+est tcp6 ipv6_dst=fc00::1     action=1
2499 dnl Drop everything else.
2500 table=1 priority=0, action=drop
2501 ])
2502
2503 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2504
2505 dnl Linux seems to take a little time to get its IPv6 stack in order. Without
2506 dnl waiting, we get occasional failures due to the following error:
2507 dnl "connect: Cannot assign requested address"
2508 OVS_WAIT_UNTIL([ip netns exec at_ns0 ping6 -c 1 fc00::2 >/dev/null])
2509
2510 NETNS_DAEMONIZE([at_ns1], [[$PYTHON $srcdir/test-l7.py ftp]], [ftp0.pid])
2511 OVS_WAIT_UNTIL([ip netns exec at_ns1 netstat -l | grep ftp])
2512
2513 dnl FTP requests from p0->p1 should work fine.
2514 NS_CHECK_EXEC([at_ns0], [wget ftp://[[fc00::2]] -6 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v --server-response --no-proxy --no-remove-listing -o wget0.log -d])
2515
2516 dnl Discards CLOSE_WAIT and CLOSING
2517 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(fc00::2)], [0], [dnl
2518 tcp,orig=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),reply=(src=fc00::2,dst=fc00::240,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>),helper=ftp
2519 tcp,orig=(src=fc00::2,dst=fc00::240,sport=<cleared>,dport=<cleared>),reply=(src=fc00::1,dst=fc00::2,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
2520 ])
2521
2522 OVS_TRAFFIC_VSWITCHD_STOP
2523 AT_CLEANUP
2524
2525 AT_SETUP([conntrack - DNAT load balancing])
2526 CHECK_CONNTRACK()
2527 OVS_TRAFFIC_VSWITCHD_START()
2528
2529 ADD_NAMESPACES(at_ns1, at_ns2, at_ns3, at_ns4)
2530
2531 ADD_VETH(p1, at_ns1, br0, "10.1.1.1/24")
2532 ADD_VETH(p2, at_ns2, br0, "10.1.1.2/24")
2533 ADD_VETH(p3, at_ns3, br0, "10.1.1.3/24")
2534 ADD_VETH(p4, at_ns4, br0, "10.1.1.4/24")
2535 NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address 80:88:88:88:88:11])
2536 NS_CHECK_EXEC([at_ns2], [ip link set dev p2 address 80:88:88:88:88:22])
2537 NS_CHECK_EXEC([at_ns3], [ip link set dev p3 address 80:88:88:88:88:33])
2538 NS_CHECK_EXEC([at_ns4], [ip link set dev p4 address 80:88:88:88:88:44])
2539
2540 dnl Select group for load balancing.  One bucket per server.  Each bucket
2541 dnl tracks and NATs the connection and recirculates to table 4 for egress
2542 dnl routing.  Packets of existing connections are always NATted based on
2543 dnl connection state, only new connections are NATted according to the
2544 dnl specific NAT parameters in each bucket.
2545 AT_CHECK([ovs-ofctl -O OpenFlow15 -vwarn add-group br0 "group_id=234,type=select,bucket=weight=100,ct(nat(dst=10.1.1.2),commit,table=4),bucket=weight=100,ct(nat(dst=10.1.1.3),commit,table=4),bucket=weight=100,ct(nat(dst=10.1.1.4),commit,table=4)"])
2546
2547 AT_DATA([flows.txt], [dnl
2548 dnl Track connections to the virtual IP address.
2549 table=0 priority=100 ip nw_dst=10.1.1.64 action=group:234
2550 dnl All other IP traffic is allowed but the connection state is no commited.
2551 table=0 priority=90 ip action=ct(table=4,nat)
2552 dnl
2553 dnl Allow ARP, but generate responses for virtual addresses
2554 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2555 table=0 priority=10 arp action=normal
2556 table=0 priority=0 action=drop
2557 dnl
2558 dnl Routing table
2559 dnl
2560 table=4,ip,nw_dst=10.1.1.1 action=mod_dl_dst:80:88:88:88:88:11,output:1
2561 table=4,ip,nw_dst=10.1.1.2 action=mod_dl_dst:80:88:88:88:88:22,output:2
2562 table=4,ip,nw_dst=10.1.1.3 action=mod_dl_dst:80:88:88:88:88:33,output:3
2563 table=4,ip,nw_dst=10.1.1.4 action=mod_dl_dst:80:88:88:88:88:44,output:4
2564 table=4 priority=0 action=drop
2565 dnl
2566 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2567 table=8,reg2=0x0a010140,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2568 dnl Zero result means not found.
2569 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2570 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2571 dnl TPA IP in reg2.
2572 table=10 priority=100 arp xreg0=0 action=normal
2573 dnl Swaps the fields of the ARP message to turn a query to a response.
2574 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2575 table=10 priority=0 action=controller
2576 ])
2577
2578 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2579
2580 dnl Start web servers
2581 NETNS_DAEMONIZE([at_ns2], [[$PYTHON $srcdir/test-l7.py]], [http2.pid])
2582 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http3.pid])
2583 NETNS_DAEMONIZE([at_ns4], [[$PYTHON $srcdir/test-l7.py]], [http4.pid])
2584
2585 on_exit 'ovs-ofctl -O OpenFlow15 dump-flows br0'
2586 on_exit 'ovs-appctl revalidator/purge'
2587 on_exit 'ovs-appctl dpif/dump-flows br0'
2588
2589 dnl Should work with the virtual IP address through NAT
2590 for i in 1 2 3 4 5 6 7 8 9 10 11 12; do
2591     echo Request $i
2592     NS_CHECK_EXEC([at_ns1], [wget 10.1.1.64 -t 5 -T 1 --retry-connrefused -v -o wget$i.log])
2593 done
2594
2595 dnl Each server should have at least one connection.
2596 AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.64)], [0], [dnl
2597 tcp,orig=(src=10.1.1.1,dst=10.1.1.64,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.2,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
2598 tcp,orig=(src=10.1.1.1,dst=10.1.1.64,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.3,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
2599 tcp,orig=(src=10.1.1.1,dst=10.1.1.64,sport=<cleared>,dport=<cleared>),reply=(src=10.1.1.4,dst=10.1.1.1,sport=<cleared>,dport=<cleared>),protoinfo=(state=<cleared>)
2600 ])
2601
2602 ovs-appctl dpif/dump-flows br0
2603 ovs-appctl revalidator/purge
2604 ovs-ofctl -O OpenFlow15 dump-flows br0
2605 ovs-ofctl -O OpenFlow15 dump-group-stats br0
2606
2607 OVS_TRAFFIC_VSWITCHD_STOP
2608 AT_CLEANUP
2609
2610
2611 AT_SETUP([conntrack - DNAT load balancing with NC])
2612 CHECK_CONNTRACK()
2613 OVS_TRAFFIC_VSWITCHD_START()
2614
2615 ADD_NAMESPACES(at_ns1, at_ns2, at_ns3, at_ns4, at_ns5)
2616
2617 ADD_VETH(p1, at_ns1, br0, "10.1.1.1/24")
2618 ADD_VETH(p2, at_ns2, br0, "10.1.1.2/24")
2619 ADD_VETH(p3, at_ns3, br0, "10.1.1.3/24")
2620 ADD_VETH(p4, at_ns4, br0, "10.1.1.4/24")
2621 ADD_VETH(p5, at_ns5, br0, "10.1.1.5/24")
2622 NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address 80:88:88:88:88:11])
2623 NS_CHECK_EXEC([at_ns2], [ip link set dev p2 address 80:88:88:88:88:22])
2624 NS_CHECK_EXEC([at_ns3], [ip link set dev p3 address 80:88:88:88:88:33])
2625 NS_CHECK_EXEC([at_ns4], [ip link set dev p4 address 80:88:88:88:88:44])
2626 NS_CHECK_EXEC([at_ns5], [ip link set dev p5 address 80:88:88:88:88:55])
2627
2628 dnl Select group for load balancing.  One bucket per server.  Each bucket
2629 dnl tracks and NATs the connection and recirculates to table 4 for egress
2630 dnl routing.  Packets of existing connections are always NATted based on
2631 dnl connection state, only new connections are NATted according to the
2632 dnl specific NAT parameters in each bucket.
2633 AT_CHECK([ovs-ofctl -O OpenFlow15 -vwarn add-group br0 "group_id=234,type=select,bucket=weight=100,ct(nat(dst=10.1.1.2),commit,table=4),bucket=weight=100,ct(nat(dst=10.1.1.3),commit,table=4),bucket=weight=100,ct(nat(dst=10.1.1.4),commit,table=4)"])
2634
2635 AT_DATA([flows.txt], [dnl
2636 dnl Track connections to the virtual IP address.
2637 table=0 priority=100 ip nw_dst=10.1.1.64 action=group:234
2638 dnl All other IP traffic is allowed but the connection state is no commited.
2639 table=0 priority=90 ip action=ct(table=4,nat)
2640 dnl
2641 dnl Allow ARP, but generate responses for virtual addresses
2642 table=0 priority=100 arp arp_op=1 action=move:OXM_OF_ARP_TPA[[]]->NXM_NX_REG2[[]],resubmit(,8),goto_table:10
2643 table=0 priority=10 arp action=normal
2644 table=0 priority=0 action=drop
2645 dnl
2646 dnl Routing table
2647 dnl
2648 table=4,ip,nw_dst=10.1.1.1 action=mod_dl_dst:80:88:88:88:88:11,output:1
2649 table=4,ip,nw_dst=10.1.1.2 action=mod_dl_dst:80:88:88:88:88:22,output:2
2650 table=4,ip,nw_dst=10.1.1.3 action=mod_dl_dst:80:88:88:88:88:33,output:3
2651 table=4,ip,nw_dst=10.1.1.4 action=mod_dl_dst:80:88:88:88:88:44,output:4
2652 table=4,ip,nw_dst=10.1.1.5 action=mod_dl_dst:80:88:88:88:88:55,output:5
2653 table=4 priority=0 action=drop
2654 dnl
2655 dnl MAC resolution table for IP in reg2, stores mac in OXM_OF_PKT_REG0
2656 table=8,reg2=0x0a010140,action=load:0x808888888888->OXM_OF_PKT_REG0[[]]
2657 dnl Zero result means not found.
2658 table=8,priority=0,action=load:0->OXM_OF_PKT_REG0[[]]
2659 dnl ARP responder mac filled in at OXM_OF_PKT_REG0, or 0 for normal action.
2660 dnl TPA IP in reg2.
2661 table=10 priority=100 arp xreg0=0 action=normal
2662 dnl Swaps the fields of the ARP message to turn a query to a response.
2663 table=10 priority=10,arp,arp_op=1,action=load:2->OXM_OF_ARP_OP[[]],move:OXM_OF_ARP_SHA[[]]->OXM_OF_ARP_THA[[]],move:OXM_OF_PKT_REG0[[0..47]]->OXM_OF_ARP_SHA[[]],move:OXM_OF_ARP_SPA[[]]->OXM_OF_ARP_TPA[[]],move:NXM_NX_REG2[[]]->OXM_OF_ARP_SPA[[]],move:NXM_OF_ETH_SRC[[]]->NXM_OF_ETH_DST[[]],move:OXM_OF_PKT_REG0[[0..47]]->NXM_OF_ETH_SRC[[]],move:NXM_OF_IN_PORT[[]]->NXM_NX_REG3[[0..15]],load:0->NXM_OF_IN_PORT[[]],output:NXM_NX_REG3[[0..15]]
2664 table=10 priority=0 action=controller
2665 ])
2666
2667 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt])
2668
2669 dnl Start web servers
2670 NETNS_DAEMONIZE([at_ns2], [[$PYTHON $srcdir/test-l7.py]], [http2.pid])
2671 NETNS_DAEMONIZE([at_ns3], [[$PYTHON $srcdir/test-l7.py]], [http3.pid])
2672 NETNS_DAEMONIZE([at_ns4], [[$PYTHON $srcdir/test-l7.py]], [http4.pid])
2673
2674 on_exit 'ovs-ofctl -O OpenFlow15 dump-flows br0'
2675 on_exit 'ovs-appctl revalidator/purge'
2676 on_exit 'ovs-appctl dpif/dump-flows br0'
2677
2678 sleep 5
2679
2680 dnl Should work with the virtual IP address through NAT
2681 for i in 1 2 3 4 5 6 7 8 9; do
2682     echo Request $i
2683     NS_CHECK_EXEC([at_ns1], [echo "TEST1" | nc -p 4100$i 10.1.1.64 80 > nc-1-$i.log])
2684     NS_CHECK_EXEC([at_ns5], [echo "TEST5" | nc -p 4100$i 10.1.1.64 80 > nc-5-$i.log])
2685 done
2686
2687 conntrack -L 2>&1
2688
2689 ovs-appctl dpif/dump-flows br0
2690 ovs-appctl revalidator/purge
2691 ovs-ofctl -O OpenFlow15 dump-flows br0
2692 ovs-ofctl -O OpenFlow15 dump-group-stats br0
2693
2694 OVS_TRAFFIC_VSWITCHD_STOP
2695 AT_CLEANUP